Hi all,
Recently I wrote a rule to filter a Viagra emails. I found that the pattern
of this spam emails are the "From" is appear as "Viagra.com Inc
<[EMAIL PROTECTED]>".
In my local.cd, I have added a simple rule which like this:
header No_Viagra_From From:addr =~ /viagra/i
score No_Viagra_From 10.0
describe No_Viagra_From From that contains a word viagra
But unfortunately, it doesn't works. Anyone here can teach me how to write a
rule to block this type of emails, please?
I have attached the head of the spam mail here. Thanks in advanced!
----------------------------------------------------------------------------
>From [EMAIL PROTECTED] Fri Sep 21 06:55:39 2007
Return-Path: <[EMAIL PROTECTED]>
X-Original-To: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
Received: from localhost (unknown [127.0.0.1])
by nav6.org (Postfix) with ESMTP id 4A7F21D6010B
for <[EMAIL PROTECTED]>; Thu, 20 Sep 2007 22:55:39 +0000 (UTC)
X-Virus-Scanned: amavisd-new at nav6.org
Received: from c66-235-44-65.sea2.cablespeed.com
(c66-235-44-65.sea2.cablespeed.com [66.235.44.65])
by nav6.org (Postfix) with SMTP id AF38F1D600CA
for <[EMAIL PROTECTED]>; Fri, 21 Sep 2007 06:55:32 +0800 (MYT)
Received: from Lupe Cash (10.12.13.16) by c66-235-44-65.sea2.cablespeed.com
(PowerMTA(TM) v3.2r4) id hfp10o93d75j00 for <[EMAIL PROTECTED]>; Thu, 20 Sep
2007 02:52:29 -0800
Message-Id: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: Lovers package at discount price!
From: Viagra.com Inc <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Date: Fri, 21 Sep 2007 06:55:32 +0800 (MYT)
X-UID: 3
Status: RO
X-Keywords:
Content-Length: 2705
----------------------------------------------------------------------------
Best Regards,
Simon Teh
Network and System Administrator
National Advanced IPv6
Centre of Excellence,
School of Computer Science,
Universiti Sains Malaysia
