Subject: SPAM procmail filter for Bcc?

From: Steve Machol <[email-masked]>
Date: 30 Mar 1997 06:37:08 GMT

It appears that many of the more recent spammers may be using Bcc to send
me their e-mail drivel.  In order to combat this, I am trying to add a
procmail filter which will send any e-mail with my username in the Bcc
field to a default folder.  This is what I've put into my .procmailrc
file: 

:0:
* ^Bcc.*smachol
IN.testing

However, when I've tested this by Bcc'ing myself from another account, the
mail is getting through just fine and nothing shows up in my IN.testing
folder.

I would appreciate any help I can get in finding a way to use a procmail
filter on the Bcc field.

Steve
-- 
 ___  ____  ____  _  _  ____
/ __)(_  _)( ___)( \/ )( ___) Steve Machol
\__ \  )(   )__)  \  /  )__)  [email-masked]
(___/ (__) (____)  \/  (____) http://www.optiboard.com/steve

---

From: Paul O Bartlett <[email-masked]>
Date: Sun, 30 Mar 1997 11:38:44 -0500

On 30 Mar 1997, Steve Machol wrote (excerpt):

> procmail filter [...]

> I would appreciate any help I can get in finding a way to use a procmail

    Well, for starters, your question has *nothing* to do with Pine,
although you posted it on the Pine newsgroup.  It would be appropriate
for the Procmail mailing list rather than comp.mail.pine.

    However.......  One scheme that I have found that works somewhat
well is to check whether the incoming mail has a To:-like field with my
email address in it.  If it does not, there is a good chance it is
spam, and I have procmail deliver it to a special folder where I can
check it out later, just in the off chance that it could be legitimate
mail (as has happened once).

    My recipe looks like this:

:0:
* !^TOpobart@access[1-5]*.digex.net
IN.xdiscard

Paul                             <[email-masked]>
----------------------------------------------------------
Paul O. Bartlett, P.O. Box 857, Vienna, VA 22183-0857, USA
Finger, keyserver, or WWW for PGP 2.6.2 public key
Home Page:  http://www.access.digex.net/~pobart

---

From: Eli the Bearded <[email-masked]>
Date: 31 Mar 1997 19:22:01 GMT

In article <[email-masked]>,  <Wotan> wrote:
>Another useful method is to use scoring.  Have procmail score your mail 
>based upon it meeting certian criteria that is common to lots of spam.  
>Some examples are:

For an example (now slightly better documented) of lots of scoring
rules applied at once in perl, see my version of Johnbob's jmdigest.
His is availible at <URL:http://www.io.com/~johnbob/jm/>. My stuff
is availible at <URL:ftp://ftp.netusa.net/users/eli/jmdigest>
and <URL:ftp://ftp.netusa.net/users/eli/jmdrc>. It has a large
number of header checks and a very large collection of 'scam'
regular expressions.

It can be used from a procmailrc but I am still working out a
sample recipe for it.

Sample of my jmdigest RE scam checks applied to subject and body.
Each one of these ups the score by one. (I generally use a cutoff
value of 3, YMMV.) Long lines folded at 75 columns.

# Try to catch any price followed by an additional price for postage.
+/\b(\$\s*\d+.*){2}(p(ost(age)?)?(\s*(and|\+|\&)\s*h(andling)?)?|ship)/i

# Match such constructs as "You can change your life if you take five
# minutes to read this" or "5 minutes to read this and it could change
# your life". Note that order of phrases is not important. Will also
# catch weird stuff like "Read this now read this now read this now".
+/(((5|five)\s+minutes|read\s+this|change\s+your\s+life)\b(\s*\S+\s+){0,3}
){3}/i

# Next two catch many of the 'free' cd-rom offers.
+/\bfree\s+(nude\s+)?(adult|teen|xxx|celebrit(y|ies)|gay)s?\s+cd[-\s]*r[o0
]m/i
+/\b(nude\s+)?(adult|teen|xxx|celebrit(y|ies)|gay)s?\s+free\s+cd[-\s]*r[o0
]m/i

# From "free usage at our homepage" to "free admittence to the website"
+/\bfree\s+(entrance|admit+[ea]nce|access|usage)\s+(at|to)\s+(our|the)\s+(
(web)?site|(home|web)?page)/i

Elijah
------
my jmdigest is under constant refinement for better aim.

---

From: [email-masked]
Date: Sun, 30 Mar 1997 13:38:20 GMT

In article <[email-masked]>,
Felix Tilley <[email-masked]> wrote while drinking:

>
>
>Send any spam you get to /dev/null.  I recommend using Procmail to trigger
>off the Received: line in the mail header.  Very few spammers know how to
>forge Received: lines.   All spammers know how to forge the From: line.

Dollar signs in the subject
Hair loss comments.
making money
Lots of urls.

Your milage may vary.  
-- 
Save energy: be apathetic.