From: John Hardin Date: 2015-06-29 14:39 To: [email protected] CC: SpamAssassin Users List Subject: Re: Re: India spam Keep replies on-list, please. On Mon, 29 Jun 2015, [email protected] wrote: >> >>> How can I format a recipe that will catch the ".in.net" portion of an >>> IP as many domain names are used in front of that domain bit? >> >> Where do you want to look for that? In the sender's email address? In >> URLs embedded in the message body? In MTA relays? >> >> -- >> John Hardin KA7OHZ http://www.impsec.org/~jhardin/ > > First I mispoke by stating recipe for spamass. That should be procmail. Not a problem. > Somehow catching those in the domain name would be the broadest way if > possible. I am using some phrases found in the body already, but that > only applies to some. Everyday, I get a bunch from the ".in.net" domain. You still need to clarify where you want to look for ".in.net". The last bit suggests in the from address. Can you post a spample to (e.g.) pastebin so that we can take a look? -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ =================================================================
Hi John! Thanks for the response. Here's would be type examples: [email protected] [email protected] [email protected] ....and on and on. I've looked up some of the domains used which are not as obvious as my examples and they don't exist. The IPs may be OK and don't want to use IPs to snag those. Again, not much constants in the bodies to do much good to use "HB ??" in the recipe to look in the header and body. Does the above explain better? /Chino
