Procmail Anti-Spam Recipe

am 24.06.2005 07:39:41 von Alan Connor

I've been testing this for about a week, and so far,
it has captured only spam.

It is very simple: If the From: header and Return-Path
don't match, then the mail is probably spam.

(after the part of one's filter that contains the pass list for
individuals, businesses, non-profits, and mailing lists, of
course)

:0h
* ^From:.*\/<[A-Za-z0-9_.+-]+@[A-Za-z0-9_.+-]+\.[A-Za-z0-9]+>
* ! ^Return-Path:.*${MATCH}
spam-test

------------------------------------------------------------

Note: Most of the posters on this group are trolls and spammers
pretending to be spam-fighters, and I don't even read their
posts.

They hate me because I promote the use of Challenge-Response
filters, which they can't beat.

And no matter how many stupid and dishonest articles on the
subject they post, I still promote Challenge-Response filters,
and they still can't beat them.

Which the feebs don't ever seem to notice.

AC

--
alanconnor AT earthlink DOT net
Use your real return address or I'll never know you
even tried to mail me. http://tinyurl.com/2t5kp
~

Re: Procmail Anti-Spam Recipe

am 24.06.2005 08:56:21 von Alan Connor

On comp.mail.misc, in , "Alan Connor" wrote:
>
>
> I've been testing this for about a week, and so far,
> it has captured only spam.
>
> It is very simple: If the From: header and Return-Path
> don't match, then the mail is probably spam.
>
> (after the part of one's filter that contains the pass list for
> individuals, businesses, non-profits, and mailing lists, of
> course)
>
>:0h
> * ^From:.*\/<[A-Za-z0-9_.+-]+@[A-Za-z0-9_.+-]+\.[A-Za-z0-9]+>
> * ! ^Return-Path:.*${MATCH}
> spam-test
>
> ------------------------------------------------------------
>
> Note: Most of the posters on this group are trolls and spammers
> pretending to be spam-fighters, and I don't even read their
> posts.
>
> They hate me because I promote the use of Challenge-Response
> filters, which they can't beat.
>
> And no matter how many stupid and dishonest articles on the
> subject they post, I still promote Challenge-Response filters,
> and they still can't beat them.
>
> Which the feebs don't ever seem to notice.
>
> AC
>
> --
> alanconnor AT earthlink DOT net
> Use your real return address or I'll never know you
> even tried to mail me. http://tinyurl.com/2t5kp
> ~

Here's a perfect example:

# From clinician.094073magdaia@kcventures.com Thu Jun 23 23:17:38 2005
# Return-Path:
# Received: from pop.earthlink.net [209.86.93.202]
# by localhost with POP3 (fetchmail-5.9.11 polling pop.earthlink.net account alanconnor@earthlink.net)
# for alanc@localhost (single-drop); Thu, 23 Jun 2005 23:17:38 -0700 (PDT)
# Received: from 209.86.93.226 ([222.109.160.39])
# by mx-nebolish.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1dLHq03nC3Nl3490
# Fri, 24 Jun 2005 02:11:42 -0400 (EDT)
# Received: from capo.jahipster.com (222.109.160.39)
# by 222.109.160.39 (lamar 7.2 HotFix 0.66) with SMTP
# id ; Fri, 24 Jun 2005 02:04:04 -0500
# Reply-To: "tracy bosch"
# From: "tracy bosch"
# To: alanco@earthlink.net
# Cc: alancodd@earthlink.net, alancoffin@earthlink.net, alancohen@earthlink.net, alancohn@earthlink.net, alancole@earthlink.net, alancoles@earthlink.net, alancollins@earthlink.net, alancolvard@earthlink.net, alancon@earthlink.net, alanconnor@earthlink.net, alancoon@earthlink.net, alancorbett@earthlink.net , alancox@earthlink.net, alancrouch@earthlink.net, alancsw@earthlink.net, alanct@earthlink.net, alancunningham@earthlink.net, aland5@earthlink.net
# Subject: I Hate You Now
# Date: Fri, 24 Jun 2005 01:03:04 -0600
# MIME-Version: 1.0
# X-Scanned: Symantec Scan Engine v2.0
# Content-Type: multipart/alternative;
# boundary="--148632_42414562.oH92"
# Message-Id: <200506240211.1dLHq03nC3Nl3490@mx-nebolish.atl.sa.earthlink.net>
# X-ELNK-AV: 0
# Status: RO
# Content-Length: 0
# Lines: 0

Trollmail that was captured (headers only, the body and any
attachments were dumped) by the above script.

I don't care whether you hate me or not, troll.

Just stay out of my mailboxes. That's a command, not a request.

And thanks for helping me test the recipe.

By-the-way: That mail would have been sent to /dev/null for
several other reasons, so you never had a chance of getting it
into my mailboxes.

AC

--
alanconnor AT earthlink DOT net http://tinyurl.com/2t5kp
Please visit my home page:
http://angel.1jh.com./nanae/kooks/alanconnor.html

Re: Procmail Anti-Spam Recipe

am 24.06.2005 15:15:50 von Sam

Re: Procmail Anti-Spam Recipe

am 27.06.2005 07:24:58 von Alan Connor

Re: Procmail Anti-Spam Recipe

am 27.06.2005 14:24:47 von Sam

Re: Procmail Anti-Spam Recipe

am 01.07.2005 23:22:04 von Todd

On Fri, 24 Jun 2005 06:56:21 GMT, Alan Connor wrote:

>On comp.mail.misc, in , "Alan Connor" wrote:
>>
>>
>> I've been testing this for about a week, and so far,
>> it has captured only spam.
>>
>> It is very simple: If the From: header and Return-Path
>> don't match, then the mail is probably spam.
>>
>> (after the part of one's filter that contains the pass list for
>> individuals, businesses, non-profits, and mailing lists, of
>> course)
>>
>>:0h
>> * ^From:.*\/<[A-Za-z0-9_.+-]+@[A-Za-z0-9_.+-]+\.[A-Za-z0-9]+>
>> * ! ^Return-Path:.*${MATCH}
>> spam-test
>>
>> ------------------------------------------------------------

Idiot.
You just filtered out half of the kegitimate emails/

>> Note: Most of the posters on this group are trolls and spammers
>> pretending to be spam-fighters, and I don't even read their
>> posts.
>>
>> They hate me because I promote the use of Challenge-Response
>> filters, which they can't beat.
>>
>> And no matter how many stupid and dishonest articles on the
>> subject they post, I still promote Challenge-Response filters,
>> and they still can't beat them.

They hate you because you are a kook.

Re: Procmail Anti-Spam Recipe

am 01.07.2005 23:30:13 von Alan Connor

On comp.mail.misc, in , "Alan Connor" wrote:

Well. Let's pull "Todd's" headers out and see what google groups has to say:

Searched all groups
Results 1 - 1 of 1 from Jul 1, 2004 to Jul 1, 2005
for author:Todd author:.
(0.17 seconds)

1 post in the last year. Right.

Guess I won't be reading the article nor any responses to it,
and I guess I'll be killfiling that alias.

AC

Re: Procmail Anti-Spam Recipe

am 02.07.2005 00:42:41 von Sam

This is a MIME GnuPG-signed message. If you see this text, it means that
your E-mail or Usenet software does not support MIME signed messages.

--=_mimegpg-commodore.email-scan.com-14512-1120257761-0013
Content-Type: text/plain; format=flowed; charset="UTF-8"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
X-Mime-Autoconverted: from 8bit to quoted-printable by mimegpg

Usenet Beavis writes:

> On comp.mail.misc, in et>, "Alan Connor" wrote:
>
>
>
> Well. Let's pull "Todd's" headers out and see what google groups has to sa=
y:

Sounds like a good idea, Beavis.

> Searched all groups
> Results 1 - 1 of 1 from Jul 1, 2004 to Jul 1, 2005
> for author:Todd author:.
> (0.17 seconds)
>
> 1 post in the last year. Right.

Results 1 - 10 of 31,400 for usenet beavis (0.41 seconds)

Once again, Beavis, you win. There's only a minor problem with your
previous message. You forgot to announce that you don't read my posts.

> Guess I won't be reading the article nor any responses to it,
> and I guess I'll be killfiling that alias.

If anyone around here cares about what Beavis allegedly reads or doesn't
read, please raise your hand.

While we're waiting for someone to respond, this sounds like a good time for=

another Beavis theme song. This time it's a short one.

ITSY-BITSY BEAVIS
(to the tune of the â=9CItsy-Bitsy spiderâ=9D nursery rhyme)

Itsy-Bitsy Beavis logged on, and had a cow.
Then came the laughter and all the jokes abound.
Everyone was laughing at Beavis having a fit.
Itsy-Bitsy Beavis, he's always full of shit.

--=_mimegpg-commodore.email-scan.com-14512-1120257761-0013
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBCxcbhx9p3GYHlUOIRAplYAJ9rtU63eaFZIilCGgF4UhNf1kcbTACf V953
DTDLsScL2HMUOuSUxMFI+nY=
=uB1T
-----END PGP SIGNATURE-----

--=_mimegpg-commodore.email-scan.com-14512-1120257761-0013--