# # A really lite set of receipts gleaned from the Procmail list #These will kill better then 90% of the UCE/UBE/E-SPAM you receive #(at least that's what my logs show, at the current time) # First we kill 'bad' addresses # Kill numberic only addresses (no-one I know of uses only numbers, even #Compuserve adds a period. :0 * ^From:[ ]*[0-9]+@.*(\>|$) /dev/null # Cyberpromo and several other of the similar groups actually add this #header, talk about making life easier :0 * ^X-Advertisement:.* /dev/null # Edward J. Sabol : E-mails with # X-UIDL: headers are almost definitely spam unless they've been # Resent-To: me by someone. Also, valid X-UIDL: headers have 32 # hexadecimal digits exactly. :0 * ^X-UIDL: * !^X-UIDL:[ ]*[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]\ [0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]\ [0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]\ [0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]\ [0-9a-f][0-9a-f][0-9a-f][0-9a-f][ ]*$ * !^Resent-To: /dev/null # Based on the scripts of #J. Daniel Smith http://www.bristol.com/~DanS # # required headers, if there isn't a From, To, and Date, KILL IT :0h * ^From: * ^(Apparently-)?To: * ^Date: { } :E /dev/null # # Invalid Message-Id:s are likely SPAM, any non-RFC complaint ID gets nailed :0 * ! ^Message-Id:[ ]*<[^ <>@]+@[^ <>@]+>[ ]*$ /dev/null # Check if From: = To: MATCH=${SENDER:-`formail -rtzx To:`} # We exclude anything with a Resent- header to avoid problems with # lists that change the Reply-To: to point back to the list. :0 * $^TO$MATCH\> * !^Resent- /dev/null # No large headers, ie where you and several hundred (well ok 46) people are listed in # the TO or CC headers :0 { MAX_COMMAS=45 # # From David W. Tamkin # :0h # H is implicit; this is h * ^Resent-(To|Cc): ADDRESSES=|formail -czxResent-To: -xResent-Cc: :0Eh ADDRESSES=|formail -czxTo: -xCc: -xApparently-To: # Now, the number of addressees should be the number of non-empty # lines (procmail always sees an extra empty line at the end of a # search area) plus the number of commas; this will still overcount # if someone has a comma inside a name comment (thus MAX_COMMAS # instead of MAX_ADDRESSES). :0 * 1^1 ADDRESSES ?? ^.+$ * 1^1 ADDRESSES ?? , * $-${MAX_COMMAS}^0 /dev/null }