Use scoring, too. Thanks to the TCLUG Procmail presentation, I've spent
several months developing my procmail rules, though I haven't learned as
much as I'd like. Here's my spam.rc (used after I grab friends, family
and lists):
---
ODDCHARS="[^ -~]"
:0 HB
* -11^0
* -4^0 H ?? ^Subject: Re:
* -8^0 H ?? ^TO.*(myaddress\@mydomain1\.com|myaddress\@mydomain2\.com)
* 4^0 H ?? ^To:[ ]*$
* 4^0 H ?? ^To:.*friend
* 4^0 H ?? ^from:.*[0-9]@
* 7^0 H ??
^(From|Received).*\.\<(ar|br|ch|cl|cn|cr|cz|fi|it|hk|jp|kr|mx|my|nl|nu|p
l|pt|ro|ru|si|to|tv|tw|vn)\>
* 5^0 H ?? ^message-id:[^a-z]*$
* 5^0 H ?? ^subject:.*[ ][ ][0-9][0-9]+$
* 5^0 H ?? ^Received:.*unknown
* 2^0 H ?? undisclosed-recipients
* 5^0 H ?? ^Subject:[ 1-9]*$
* 5^0 H ?? ^Subject:.*ADV:
* 5^0 H ?? ^X-Rocket-Spam
* 5^0 H ?? ^X-YahooFilteredBulk
* 3^1 H ?? myaddress1\@
* 3^0 (yahoo|mail|msn|starmail|excite|bigfoot|email|hotmail|sohu)\.com
* 3^1 \$[0-9],000
* 2^1 [- ](800|888)[- ]
* 2^1 \$\$\$*
* 2^1 \!\!\!*
* 2^0 text/html
* 5^0 (real|easy)[- ]*money
* 3^1 \<click\>.*\<link\>.*\<remove\>
* 3^1 hello[ ]*friend
* 2^2 earn \$
* 3^1 \<a\s+friend\>
* 3^1 \<limited\s+time\>
* 3^1 \<dot\s+com\>
* 2^1 $ ()$ODDCHARS$ODDCHARS$ODDCHARS$ODDCHARS+
* 4^1 (from|in)[ ]*the[ ]*subject
* 4^1 remove[ ]*your[ ]*email[ ]*address
* 4^1 get[- ]*rich[- ]*quick
* 3^1 (part|full)[ -]time
* 3^1 ((extra|more|enough)[ ]*)money
* 2^1 wor(k|king)[ ]*(at|from)[ ]*home
* 4^0 to[ ]*be[ ]*(removed|unsubscribed)
* 4^0 subject=(auto)?remove|remove\.htm
* 3^1 act[
]*now|\<ads\>|adult|advertis|afford|amateur|aphrodisiac|appeal|asia|as[
]*seen[ ]*on|attention|attract|animal
* 2^1 background[ ]*check|bank|banned|banner|billion|bills|bingo|black[-
]*jack|bond|boost|boyfriend|britney[ ]*spears|broadcast|bul
k |burn[ ]*fat
* 2^1 cable |cams|career|cartridge|casino|cell|chat|cheap|china|click[-
]*here|cock|confidential|consolidat|credit
* 2^1 dating|dear[ ]*friend|decoder|debt|degree|dentist|diet|domain[
]*name|diploma|dollars|dvd|doctor|dental
* 2^1 earning|ejaculat|erectile.*d[iy]sfunction|e[-
]*commerce|esquire|ebit
* 3^1 fantas(y|ies)|fat[ ]burn|fda|finance
|fortune|foryou|freedom|freehost|free[ ]*information|free[
]*vacation|fuck
* 3^1 girlfriend|girls|guarantee
* 3^1 hard[- ]*core|herbal|hidden|home[ ]*loan|home[
]*work|horny|hosting|hot |hottest|huge[ ]*sale
* 2^0 inches|\<internet[ ]*marketing\>|income|increase[
]*sales|incredible|ink[ ]*jet|insurance|invest
* 4^1 jackpot
* 2^1 legal|lesbian|libido|\<life\>|long[- ]*distance
* 2^1 market|mate|merchant[
]*(status|account)|metabolism|million|\<mlm\>|money|monthly[
]*payment|mortgage|must[ ]*have
* 5^1 naked|\<nude\>
* 3^1 opportunit|opt[- ]*out|offend|opt[- ]*in|off[- ]shore|optical
* 3^1
penis|pervers|petro|pharmac|pheromone|phone|porn|prescription|proven|pro
fit|psychic
* 3^1 recommend|recession|regist|removal|removed
* 3^1 sales|scramble|search
engine|secret|sex|shock|shopping|SIC|smoke|snore|snoring|spy|stock|strip
per|stuffing.*envelopes|success|
suppressed
* 3^1 teen|testimon|thousand|toner|traffic
* 3^1
uncensored|uncollected|undisclosed|underpaid|unedited|university|unsubsc
ribe|urgent
* 4^1 vacation|viagra
* 4^1 web[- ]*cam|weight|whore|wild|\<win\>|win[ ]*cash|women
* 6^1 XXX
* 6^1 young girls
| $PMDIR/reporter.pl
---
My reporter.pl looks like this:
---
#!/usr/bin/perl
# Spamcop reporter
open(SENDMAIL, "|/usr/sbin/sendmail -oi -t") || die "Cannot open
sendmail output";
print SENDMAIL <<"ENDENDEND";
From: $sender
To: submit.FXP8WTWSZpOPYi4Y\@spam.spamcop.net
Subject: report spam
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="DeathToSpamDeathToSpamDeathToSpam"
This is a multi-part message in MIME format.
--DeathToSpamDeathToSpamDeathToSpam
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
--DeathToSpamDeathToSpamDeathToSpam
Content-Type: message/rfc822
Content-Disposition: attachment
ENDENDEND
while (<STDIN>) {
print SENDMAIL ;
}
print SENDMAIL <<"ENDENDEND";
--DeathToSpamDeathToSpamDeathToSpam--
ENDENDEND
close (SENDMAIL);
---
-----Original Message-----
From: tclug-list-admin at mn-linux.org
[mailto:tclug-list-admin at mn-linux.org] On Behalf Of Joel Rosenberg
Sent: Wednesday, February 27, 2002 2:37 PM
To: tclug-list at mn-linux.org; Raymond Norton
Subject: Re: [TCLUG] content filter for email
On Wednesday 27 February 2002 12:49 pm, Raymond Norton wrote:
> Our users are getting hammered with porn in their email. Is there an
> add on to Sendmail, or some other area of the mail process that will
> allow us to trash this stuff?
Procmail can filter on content, although you've got to be a bit careful
about
what phrases you search for, and/or set up some pass rules in advance of
the
blocking rules, or you're going to trash an invitation for free tickets
to
"The Vagina monologues", say.
"Hot girl-on-girl action", though, should be safe.
--
-------------------------------------
There's a widow in sleepy Chester
Who weeps for her only son;
There's a grave on the Pabeng River,
A grave that the Burmans shun,
And there's Subadar Prag Tewarri
Who tells how the work was done.
-------------------------------------
_______________________________________________
Twin Cities Linux Users Group Mailing List - Minneapolis/St. Paul,
Minnesota http://www.mn-linux.org tclug-list at mn-linux.org
https://mailman.mn-linux.org/mailman/listinfo/tclug-list