🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: de.comm.software.mailserver
Article #4

Wie filtere ich diese Art von Spam über procmail?

#4
From: Gerhard Engler
Date: Mon, 13 Nov 2006 20:11
95 lines
4772 bytes
Hallo Newsgroup,

ich werde derzeit von einem Spamer regelrecht �bersch�ttet. Teilweise 
erhalte ich am Tag 350 der nachfolgenden Art.

Meine Mails werden �ber procmail + razor2 gefiltert. Leider l��t razor2 
noch eine Menge durch.

Ich w�rde nun gerne den Rest �ber procmail herauswerfen. Alle Mails 
haben im Text den Teil "welc ome to the best pharmacy". Wie m��te denn 
eine procmail-Regel aussehen, damit danach gefiltert wird.

Mein bisheriger Versuch mit:

:0
* ^*pharmacy
| /bin/sed 1d | $TRASH

hat leider nicht funktioniert.

Danke!

Gerhard

Hier eine Spam-Mail im Quelltext:

 From - Mon Nov 13 20:48:22 2006
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <gerhard@gustav>
Received: from gustav ([unix socket]) (authenticated user=gerhard bits=0)
	by gustav (Cyrus v2.1.18-IPv6-Debian-2.1.18-1+sarge2) with LMTP; Mon, 
13 Nov 2006 19:22:12 +0100
X-Sieve: CMU Sieve 2.2
Return-path: <hekina@glarus.net>
Envelope-to: gerhard@localhost
Delivery-date: Mon, 13 Nov 2006 19:22:01 +0100
Received: from localhost ([127.0.0.1] ident=amavis)
	by gustav with esmtp (Exim 4.50)
	id 1GjgRS-00013n-Ic
	for gerhard@localhost; Mon, 13 Nov 2006 19:21:58 +0100
Received: from gustav ([127.0.0.1])
	by localhost (gustav [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 03992-02 for <gerhard@localhost>;
	Mon, 13 Nov 2006 19:21:42 +0100 (CET)
Received: from localhost ([127.0.0.1] ident=fetchmail)
	by gustav with esmtp (Exim 4.50)
	id 1GjfVC-0000Mt-CN
	for gerhard@localhost; Mon, 13 Nov 2006 18:21:46 +0100
Received: from popproxy.augustakom.net [80.81.6.27]
	by localhost with POP3 (fetchmail-6.2.5)
	for gerhard@localhost (single-drop); Mon, 13 Nov 2006 18:21:46 +0100 (CET)
Received: from poschtbot ([unix socket])
	 by poschtbot (Cyrus v2.2.12-Debian-2.2.12-1) with LMTPA;
	 Mon, 13 Nov 2006 13:35:51 +0100
X-Sieve: CMU Sieve 2.2
Received: from mx1.augustakom.net ([80.81.6.20])
	by poschtbot with esmtp (Exim 4.50)
	id 1Gjb2U-00055U-U5
	for ba071709@mail1.augustakom.net; Mon, 13 Nov 2006 13:35:51 +0100
Received: from [121.24.55.206] (helo=137063968)
	by mx1.augustakom.net with smtp (Exim 4.62)
	(envelope-from <hekina@glarus.net>)
	id 1Gjb2C-00041C-0z
	for gerhard.engler@a-city.de; Mon, 13 Nov 2006 12:35:38 +0000
Received: from glarus.net (143051272 [144328328])
	by globalfenestration.com (Qmailv1) with ESMTP id D4139C7F3F
	for <gerhard.engler@a-city.de>; Mon, 13 Nov 2006 07:27:38 -0700
Date: Mon, 13 Nov 2006 07:27:38 -0700
From: "Deli V. Quill" <hekina@glarus.net>
X-Mailer: The Bat! (v2.00.2) Personal
X-Priority: 3
Message-ID: <5383464237.20061113072738@glarus.net>
To: Gerhard <gerhard.engler@a-city.de>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-AntiVirus: checked by AntiVir MailGate (version: 2.0.1.5; AVE: 
6.17.0.2; VDF: 6.17.0.5; host: globalfenestration.com)
X-Received-For: gerhard.engler@a-city.de
X-SA-Exim-Connect-IP: 80.81.6.20
X-SA-Exim-Mail-From: hekina@glarus.net
Subject: Re:
X-SA-Exim-Version: 4.2 (built Thu, 03 Mar 2005 10:44:12 +0100)
X-SA-Exim-Scanned: Yes (on poschtbot)
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at example.com
X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on gustav.duck
X-Spam-Level:
X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=failed
	version=3.0.3

welc ome to the best pharmacy http://<HTML><HEAD><META 
HTTP-EQUIV="Refresh" CONTENT="0.1; 
URL=/cgi-bin/domainruller/domainruller.pl?getlink=1">/?IJESRKVldBXFRDVh1RW1ZeVkZ1UB9QXUFIHFdR
Technical Details
Message-ID: <4558d158$0$30321$9b4e6d93@newsspool1.arcor-online.net>
Path: arc1-ca.pugleaf.net!g2news2.google.com!news4.google.com!news2.google.com!news.germany.com!newsfeed.freenet.de!newsfeed01.chello.at!newsfeed.arcor.de!newsspool3.arcor-online.net!news.arcor.de.POSTED!not-for-mail

Show Full Headers
Complete Article Headers
X-Google-Thread: fb9fe,3807dc8c616c62e0,start
X-Google-Thread: 1101c9,3807dc8c616c62e0,start
X-Google-Attributes: gidfb9fe,gid1101c9,public
X-Google-Language: GERMAN,ASCII
Path: arc1-ca.pugleaf.net!g2news2.google.com!news4.google.com!news2.google.com!news.germany.com!newsfeed.freenet.de!newsfeed01.chello.at!newsfeed.arcor.de!newsspool3.arcor-online.net!news.arcor.de.POSTED!not-for-mail
Date: Mon, 13 Nov 2006 21:11:05 +0100
From: Gerhard Engler <gerhard.engler@gmx.de>
User-Agent: Thunderbird 1.5.0.8 (Windows/20061025)
MIME-Version: 1.0
Newsgroups: de.comm.software.mailserver,at.linux
Followup-To: at.linux
Subject: Wie filtere ich diese Art von Spam über procmail?
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 8bit
Lines: 97
Message-ID: <4558d158$0$30321$9b4e6d93@newsspool1.arcor-online.net>
Organization: Arcor
NNTP-Posting-Date: 13 Nov 2006 21:11:04 CET
NNTP-Posting-Host: 3532d543.newsspool1.arcor-online.net
X-Trace: DXC=DoW<8>m=]K7LNKYb?b>076ic==]BZ:af>4Fo<]lROoR1^YC2XCjHcb9NF@1RL7T@e<UTEAfnAR\T1@JWJ8E:^d<?@KD>@blQfg8bZ<Y7IkfBn8
X-Complaints-To: usenet-abuse@arcor.de