🚀 go-pugleaf

In article <34c238b4.1663293@news.demon.co.uk>
           john@assen.demon.co.uk.nospam "John McCabe" writes:

> A lot of junk mail has the source address set to 99876@12345.com and
> other such crap. Would it be posible to implement a regular expression
> matching algorithm for use in the mail kill so that rather than
> *@compuserve.com, I could use e.g. [0-9]*@compuserve.com to represent
> any purely numerical user field?

This might be rather tricky with the basic mailkill mechanism
- I presume WinDIS uses the same or similar code to the
standard NET 2.16d.  Both the recent GremNOS version of ka9q
and my own local delivery program (and perhaps YAN/others)
support a keep as well as a kill facility, similar to news
kill.  In order to do what you want, I have the two entries:

 *[0-9][0-9][0-9][0-9]*@*

which gets anything with 4 consec digits as you'd expect,
and

 !*[0-7][0-7][0-7][0-7][0-7].[0-7][0-7][0-7]*@compuserve*

which lets valid Compu$erve mail through, mail which would
otherwise have been rejected by the first rule.

Without a keep facility, the best I can think of at the moment
is:

 *[89]*@compuserve.com 

which should kill mail forged to appear as though from CS,
but only if there's a 8 or 9 in the numeric part (there
usually is, in my experience.)  Perhaps someone else can
come up with a better kill rule for this sort of mail.

It's certainly worth doing - the rules above from my mailkill
account for over 2/3 of the UCE rejections here.
-- 
Pete