On Thu, 2009-03-26 at 14:17 +0000, Arthur Dent wrote:
> On Thu, Mar 26, 2009 at 09:40:34AM -0400, spamassas...@corwyn.net wrote:
> > Is it possible to get spamassassin to score email addresses with 4 (or
> > more) numeric digits in sequence in the user name?
> If you use procmail before spamassassin you can use the following rule which I
> created with help from someone on this list (thanks Karsten!):
Yay. I have some vague recollection of this... ;)
> # This one matches anything which has more than 5 digits in the name:
>
> # catch bad numerical To: headers
> :0:
> * ^TO_.*[0-9][0-9][0-9][0-9][0-9]
> /dev/null #(or a quarantine location...)
In my not-so-humble opinion, this is too weak a pattern to use as a
poison pill. Even worse, to discard such mail at sight without any
possibility for other rules to exonerate that message.
The SA way of handling this -- gather results from multiple tests. Do
never ever judge a mail by triggering a single test.
Note that my previously posted rule is incorrect. I read the OP to be
talking about senders addresses, rather than garbage *recipients*. Sigh.
Now if the list server wouldn't lag like hell today, I could follow up
there...
> NOTE: I use *5* digits ever since I found that I was missing out on a
> distribution list because one of the group's recipients had an address
> something like "myname2...@somemail.com"
Sic.
> It is probably just as easy to create a spamassassin rule along similar lines
> but you'll have to wait for one of the gurus to come along for that...
If you really feel that strongly about any such weak rule, I suggest to
combine both ways. That is, let SA do the judgement, not ruling out
negative scoring tests.
Then, right after SA processing and before your general quarantining or
even discarding of high scoring spam, have a procmail recipe that checks
for (a) the message being at least classified spam and (b) a particu-
lar rule firing, like FROM_NUMS or whatever. Discard that, if you feel
so inclined, but don't discard based on a single rule triggering.
Back to the OP's context. Garbage recipients? Do you by any chance have
a catch-all address?
--
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
