Article View: de.comm.software.mailserver
Article #4Wie filtere ich diese Art von Spam über procmail?
From: Gerhard Engler
Date: Mon, 13 Nov 2006 20:11
Date: Mon, 13 Nov 2006 20:11
95 lines
4772 bytes
4772 bytes
Hallo Newsgroup, ich werde derzeit von einem Spamer regelrecht �bersch�ttet. Teilweise erhalte ich am Tag 350 der nachfolgenden Art. Meine Mails werden �ber procmail + razor2 gefiltert. Leider l��t razor2 noch eine Menge durch. Ich w�rde nun gerne den Rest �ber procmail herauswerfen. Alle Mails haben im Text den Teil "welc ome to the best pharmacy". Wie m��te denn eine procmail-Regel aussehen, damit danach gefiltert wird. Mein bisheriger Versuch mit: :0 * ^*pharmacy | /bin/sed 1d | $TRASH hat leider nicht funktioniert. Danke! Gerhard Hier eine Spam-Mail im Quelltext: From - Mon Nov 13 20:48:22 2006 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: <gerhard@gustav> Received: from gustav ([unix socket]) (authenticated user=gerhard bits=0) by gustav (Cyrus v2.1.18-IPv6-Debian-2.1.18-1+sarge2) with LMTP; Mon, 13 Nov 2006 19:22:12 +0100 X-Sieve: CMU Sieve 2.2 Return-path: <hekina@glarus.net> Envelope-to: gerhard@localhost Delivery-date: Mon, 13 Nov 2006 19:22:01 +0100 Received: from localhost ([127.0.0.1] ident=amavis) by gustav with esmtp (Exim 4.50) id 1GjgRS-00013n-Ic for gerhard@localhost; Mon, 13 Nov 2006 19:21:58 +0100 Received: from gustav ([127.0.0.1]) by localhost (gustav [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 03992-02 for <gerhard@localhost>; Mon, 13 Nov 2006 19:21:42 +0100 (CET) Received: from localhost ([127.0.0.1] ident=fetchmail) by gustav with esmtp (Exim 4.50) id 1GjfVC-0000Mt-CN for gerhard@localhost; Mon, 13 Nov 2006 18:21:46 +0100 Received: from popproxy.augustakom.net [80.81.6.27] by localhost with POP3 (fetchmail-6.2.5) for gerhard@localhost (single-drop); Mon, 13 Nov 2006 18:21:46 +0100 (CET) Received: from poschtbot ([unix socket]) by poschtbot (Cyrus v2.2.12-Debian-2.2.12-1) with LMTPA; Mon, 13 Nov 2006 13:35:51 +0100 X-Sieve: CMU Sieve 2.2 Received: from mx1.augustakom.net ([80.81.6.20]) by poschtbot with esmtp (Exim 4.50) id 1Gjb2U-00055U-U5 for ba071709@mail1.augustakom.net; Mon, 13 Nov 2006 13:35:51 +0100 Received: from [121.24.55.206] (helo=137063968) by mx1.augustakom.net with smtp (Exim 4.62) (envelope-from <hekina@glarus.net>) id 1Gjb2C-00041C-0z for gerhard.engler@a-city.de; Mon, 13 Nov 2006 12:35:38 +0000 Received: from glarus.net (143051272 [144328328]) by globalfenestration.com (Qmailv1) with ESMTP id D4139C7F3F for <gerhard.engler@a-city.de>; Mon, 13 Nov 2006 07:27:38 -0700 Date: Mon, 13 Nov 2006 07:27:38 -0700 From: "Deli V. Quill" <hekina@glarus.net> X-Mailer: The Bat! (v2.00.2) Personal X-Priority: 3 Message-ID: <5383464237.20061113072738@glarus.net> To: Gerhard <gerhard.engler@a-city.de> MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit X-AntiVirus: checked by AntiVir MailGate (version: 2.0.1.5; AVE: 6.17.0.2; VDF: 6.17.0.5; host: globalfenestration.com) X-Received-For: gerhard.engler@a-city.de X-SA-Exim-Connect-IP: 80.81.6.20 X-SA-Exim-Mail-From: hekina@glarus.net Subject: Re: X-SA-Exim-Version: 4.2 (built Thu, 03 Mar 2005 10:44:12 +0100) X-SA-Exim-Scanned: Yes (on poschtbot) X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at example.com X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on gustav.duck X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=failed version=3.0.3 welc ome to the best pharmacy http://<HTML><HEAD><META HTTP-EQUIV="Refresh" CONTENT="0.1; URL=/cgi-bin/domainruller/domainruller.pl?getlink=1">/?IJESRKVldBXFRDVh1RW1ZeVkZ1UB9QXUFIHFdR
Technical Details
Message-ID:
<4558d158$0$30321$9b4e6d93@newsspool1.arcor-online.net>Path:
arc1-ca.pugleaf.net!g2news2.google.com!news4.google.com!news2.google.com!news.germany.com!newsfeed.freenet.de!newsfeed01.chello.at!newsfeed.arcor.de!newsspool3.arcor-online.net!news.arcor.de.POSTED!not-for-mailShow Full Headers
Complete Article Headers
X-Google-Thread: fb9fe,3807dc8c616c62e0,start X-Google-Thread: 1101c9,3807dc8c616c62e0,start X-Google-Attributes: gidfb9fe,gid1101c9,public X-Google-Language: GERMAN,ASCII Path: arc1-ca.pugleaf.net!g2news2.google.com!news4.google.com!news2.google.com!news.germany.com!newsfeed.freenet.de!newsfeed01.chello.at!newsfeed.arcor.de!newsspool3.arcor-online.net!news.arcor.de.POSTED!not-for-mail Date: Mon, 13 Nov 2006 21:11:05 +0100 From: Gerhard Engler <gerhard.engler@gmx.de> User-Agent: Thunderbird 1.5.0.8 (Windows/20061025) MIME-Version: 1.0 Newsgroups: de.comm.software.mailserver,at.linux Followup-To: at.linux Subject: Wie filtere ich diese Art von Spam über procmail? Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 8bit Lines: 97 Message-ID: <4558d158$0$30321$9b4e6d93@newsspool1.arcor-online.net> Organization: Arcor NNTP-Posting-Date: 13 Nov 2006 21:11:04 CET NNTP-Posting-Host: 3532d543.newsspool1.arcor-online.net X-Trace: DXC=DoW<8>m=]K7LNKYb?b>076ic==]BZ:af>4Fo<]lROoR1^YC2XCjHcb9NF@1RL7T@e<UTEAfnAR\T1@JWJ8E:^d<?@KD>@blQfg8bZ<Y7IkfBn8 X-Complaints-To: usenet-abuse@arcor.de