On Sat, 1 Jun 2002, Theo Van Dinter wrote:
> * ^Received:.*\[\/(25[6-9]|2[6-9][0-9]|[3-9][0-9][0-9])\..+
>
> This could be turned into a SA rule very easily...
Like this?
header FAKE_IP_RCVD Received =~
/\[0|(?:\d{1,3}\.){0,3}(?:2(?:5[6-9]|[6-9]\d)|[3-9]\d\d)[.\d]*\]/
describe FAKE_IP_RCVD Received via an impossible IP address
test FAKE_IP_RCVD ok [0.1.2.3]
test FAKE_IP_RCVD ok [1.2.345.6]
test FAKE_IP_RCVD fail [255.0.0.0]
test FAKE_IP_RCVD fail [199.199.199.199]
However, no spam matches it in my archive of the last 2 weeks.
_______________________________________________________________
Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
