lwilton at earthlink
Sep 20, 2007, 9:11 PM
Post #2 of 2
(877 views)
Permalink
|
|
Re: How to write a rule to filter this email?
[In reply to]
|
|
Take the :addr off.
Loren
----- Original Message -----
From: "chteh" <chteh [at] nav6>
To: <users [at] SpamAssassin>
Sent: Thursday, September 20, 2007 8:14 PM
Subject: How to write a rule to filter this email?
> Hi all,
>
> Recently I wrote a rule to filter a Viagra emails. I found that the
> pattern
> of this spam emails are the "From" is appear as "Viagra.com Inc
> <chteh [at] nav6>".
>
> In my local.cd, I have added a simple rule which like this:
> header No_Viagra_From From:addr =~ /viagra/i
> score No_Viagra_From 10.0
> describe No_Viagra_From From that contains a word viagra
>
> But unfortunately, it doesn't works. Anyone here can teach me how to write
> a
> rule to block this type of emails, please?
>
> I have attached the head of the spam mail here. Thanks in advanced!
>
> ----------------------------------------------------------------------------
>>From chteng [at] pccs Fri Sep 21 06:55:39 2007
> Return-Path: <chteng [at] pccs>
> X-Original-To: chteh [at] nav6
> Delivered-To: chteh [at] nav6
> Received: from localhost (unknown [127.0.0.1])
> by nav6.org (Postfix) with ESMTP id 4A7F21D6010B
> for <chteh [at] nav6>; Thu, 20 Sep 2007 22:55:39 +0000 (UTC)
> X-Virus-Scanned: amavisd-new at nav6.org
> Received: from c66-235-44-65.sea2.cablespeed.com
> (c66-235-44-65.sea2.cablespeed.com [66.235.44.65])
> by nav6.org (Postfix) with SMTP id AF38F1D600CA
> for <chteh [at] nav6>; Fri, 21 Sep 2007 06:55:32 +0800 (MYT)
> Received: from Lupe Cash (10.12.13.16) by
> c66-235-44-65.sea2.cablespeed.com
> (PowerMTA(TM) v3.2r4) id hfp10o93d75j00 for <chteh [at] nav6>; Thu, 20 Sep
> 2007 02:52:29 -0800
> Message-Id: <20070920-65229.58036.qmail [at] c66-235-44-65>
> To: <chteh [at] nav6>
> Subject: Lovers package at discount price!
> From: Viagra.com Inc <chteh [at] nav6>
> MIME-Version: 1.0
> Content-Type: text/html; charset="iso-8859-1"
> Content-Transfer-Encoding: 8bit
> Date: Fri, 21 Sep 2007 06:55:32 +0800 (MYT)
> X-UID: 3
> Status: RO
> X-Keywords:
> Content-Length: 2705
> ----------------------------------------------------------------------------
>
> Best Regards,
>
> Simon Teh
> Network and System Administrator
> National Advanced IPv6
> Centre of Excellence,
> School of Computer Science,
> Universiti Sains Malaysia
|
