Re: Spam filters

Replies:

Parents:

On Mon, Dec 18, 2000 at 06:54:51AM -0500, Gerald Oskoboiny wrote:

> I've been getting a ton of spam lately (~36 messages per day this
> December, out of a total of 384 messages per day), so I implemented
> this whitelist-based filtering. Notes/code:
>
>     http://impressive.net/people/gerald/2000/12/spam-filtering.html
>
> Woohoo, no more spam in my inbox, ever!

I just noticed that almost all of the spam that gets trapped by
this filter has From: lines like this:

   From: [email protected]

rather than the usual formats:

   From: Gerald Oskoboiny <[email protected]>
   From: [email protected] (Gerald Oskoboiny)

i.e. they are missing full names. (this is the case for 90 out of
the 103 new messages in my current unknown-sender mailbox.)

So I modified my whitelist filter to only capture mail that does not
contain a space anywhere after '^From: ' in the header. (so from now
on, almost all the mail that gets trapped by this filter will be spam,
and I can check it even less often than before.)

The new line I added to my .procmailrc is:

   * ^From: .*\

(the trailing space is important)

Sample of recent crud that got trapped by my whitelist filter:

136   + Mar 17 Amazon.com      (9.6K) Your Source for Home Office Accessories  
137 N   Mar 17 carlos2576@500a (1.8K) INCREASE YOUR Sales!
138 N   Mar 17 [email protected] (4.2K) Watch Cable Tv!
139 N   Mar 18 globe002@talk21 (1.1K) Make Money NOW!
140 N   Mar 17 [email protected] (2.7K) Kiss Your Job Goodbye!!!!!!!
141 N   Mar 17 frank_zane@msn. (4.7K) Set Your Own Work Schedule!!!!!!!
142 N   Mar 18 [email protected] (5.2K) HUMAN GROWTH HORMONE - Reduce Body Fat
143 N + Mar 18 hm_renaolds@yah ( 14K) It's Your Turn !
144 N   Mar 18 seoinfo2@earthl (1.2K) Is Your Site Lost in Cyberspace?
145 N   Mar 18 [email protected] (2.7K) Set Your Own Work Schedule!!!!!!!
146 N   Mar 17 21770520@excite (3.9K) U.S. NEWS AND WORLD REPORT "A GOLD RUSH
147 N   Mar 18 15067040@excite (3.9K) U.S. NEWS AND WORLD REPORT "A GOLD RUSH
148 N   Mar 18 07333353@hotmai (3.1K) Exciting Business Opportunity not mlm $$
149 N   Mar 18 bk22bk89@yahoo. (1.5K) At Your Service
150 N   Mar 18 juzyrvreyy@hotb (0.5K) FREE Mortgage Rate Quote!
151 N   Mar 11 [email protected]     (6.6K) How To Advertise To 16-Million People
152 N   Mar 18 [email protected] (5.2K) HUMAN GROWTH HORMONE - Reduce Body Fat

(note that almost none of them have real names, just email addresses)

--
Gerald Oskoboiny <[email protected]>
http://impressive.net/people/gerald/

Re: Spam filters

Replies:

  • None.

Parents:

On Tue, Mar 20, 2001 at 02:58:41AM -0500, Gerald Oskoboiny wrote:
:
> So I modified my whitelist filter to only capture mail that does not
> contain a space anywhere after '^From: ' in the header. (so from now
> on, almost all the mail that gets trapped by this filter will be spam,
> and I can check it even less often than before.)
>
> The new line I added to my .procmailrc is:
>
>     * ^From: .*\
>
> (the trailing space is important)

Oops... no, that doesn't work, because procmail strips leading
and trailing whitespace. (I thought I tested it and it worked,
but I guess not.)

So I changed that to:

   SPACE=" "
   :0
   *$ ^From: .*$SPACE

etc.

--
Gerald Oskoboiny <[email protected]>
http://impressive.net/people/gerald/

HURL: fogo mailing list archives, maintained by Gerald Oskoboiny