On Thu, 26 Mar 2009, Arthur Dent wrote:
On Thu, Mar 26, 2009 at 09:40:34AM -0400, spamassas...@corwyn.net wrote:
Is it possible to get spamassassin to score email addresses with 4 (or
more) numeric digits in sequence in the user name?
(seems like a lot of our spam comes in for garbage users with user names
that are strings of numbers).
If you use procmail before spamassassin you can use the following rule
which I created with help from someone on this list (thanks Karsten!):
# This one matches anything which has more than 5 digits in the name:
# catch bad numerical To: headers
:0:
* ^TO_.*[0-9][0-9][0-9][0-9][0-9]
/dev/null #(or a quarantine location...)
That looks FP-prone to me. What if the mail is being sent to multiple
recipients and one of them is a legitimate address with 5 digits in the
name?
NOTE: I use *5* digits ever since I found that I was missing out on a
distribution list because one of the group's recipients had an address
something like "myname2...@somemail.com"
Yeah, see?
It is probably just as easy to create a spamassassin rule along similar
lines but you'll have to wait for one of the gurus to come along for
that...
Again, this should be done by the MTA, which (supposedly) knows who valid
recipients are.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
A well educated Electorate, being necessary to the liberty of a
free State, the Right of the People to Keep and Read Books,
shall not be infringed.
-----------------------------------------------------------------------
64 days since Obama's inauguration and still no unicorn!
