Warmest regards,
Mark Chino
--
[email protected]
www.antennex.com
From: John Hardin
Date: 2015-06-29 17:33
To: [email protected]
CC: USERS-SPAMASSASSIN
Subject: Re: Re: India spam
On Mon, 29 Jun 2015, [email protected] wrote:
> Here's would be type examples:
> [email protected]
> [email protected]
> [email protected]
> ....and on and on.
>
> I've looked up some of the domains used which are not as obvious as my
> examples and they don't exist. The IPs may be OK and don't want to use IPs to
> snag those.
>
> Again, not much constants in the bodies to do much good to use "HB ??" in the
> recipe to look in the header and body.
Well, the basic /\.in\.net/ RE is likely to be rather FP-prone, especially
in Procmail if you aren't using weighting.
There are ways to bound that RE to limit what it will match, but different
parts of the message will need different bounds.
Untested:
* ^Received: .*from [^ ]*\.in\.net[ ]
* ^From: .*\.in\.net[>$]
* ^Return-Path: .*\.in\.net>
* ^Message-ID: .*\.in\.net>
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
---------------------------------------------------
John:
How about this one-liner then? They do move the handles around a lot.
:0:
* ^Received: .*from [^ ]*\.in\.net[ ]|* ^From: .*\.in\.net[>$]|* ^Return-Path:
.*\.in\.net>|* ^Message-ID: .*\.in\.net>
$SPAM
/Chino
