On Sun, 07 Dec 2003 17:19:26 -0500, Bryan Hoover <[EMAIL PROTECTED]> posted to spamassassin-talk: > Robert Nicholson wrote: >> Reply-To: <[EMAIL PROTECTED]> >> <[EMAIL PROTECTED]> >> Do we have a way of dealing with the spammer who's Reply-To's always >> look the same? > Oh, but it's supposed to be *absent* a separating comma - so I removed > the comma: > /^reply-to:[EMAIL PROTECTED](\.org|\.net)[EMAIL PROTECTED](\.org|\.net)\$/igm
This is probably a sufficient pattern, but one distinguishing feature in the examples was that the same address would be repeated twice. Also the examples are in the .com domain so the restriction to .org/.net is wrong. I'd go with simply: /^Reply-to:\s+(\S+)\s+\1/i I'm guessing the multi-line appearance was simply due to word wraps in Robert's mail program, and not actually there in the original headers. /* era */ -- The email address era the contact information Just for kicks, imagine at iki dot fi is heavily link on my home page at what it's like to get spam filtered. If you <http://www.iki.fi/era/> 500 pieces of spam for want to reach me, see instead. each wanted message. ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
