On Wed, 23 Jul 2003, Angel Gabriel wrote: >Is there any spam filters out there, that can maybe redflag certain >email, which it thinks is spam, so that I can use my mailer to filter it >out, and then change the 'spam filter' if it gets it wrong?
I use procmail, Spambouncer (http://www.spambouncer.org), and SpamAssassin for this. Everything is filtered by procmail. If it is from a known mailing list or sender, it gets filtered into the proper folder, then spam checks start. First I check and see if the message is HTML only. If this is the case it is tagged as spam and put into my spam folder. Next I see if it is from netscape, yahoo, or hotmail, and check to verifyu that the message is really from those servers. If it is not from those servers, then the from address has been forged, and it is put into my spam folder. >From there SpamBouncer processes the messages and tags what it thinks is spam, then spamassassin processes the messages and tags what it thinks is spam and tagged spam is put into my spam folder, untagged messages (very few at this point) are put into my inbox. Here is an example of my .procmailrc --- Begin .procmailrc # Settings for Spambouncer and Procmail DEFAULT=/home/chrisf/mail/.mbox LOGFILE=/home/chrisf/procmail.log MAILDIR=/home/chrisf/mail FORMAIL=/usr/bin/formail SBDIR=/home/chrisf/antispam ADMINFOLDER=admin [EMAIL PROTECTED] ALWAYSBLOCK=NONE ARABIC=no BLOCKFOLDER=${HOME}/mail/procmail-filtered BLOCKREPLY=SILENT BULKFOLDER=${HOME}/mail/procmail-filtered BYPASSWD=BYPASSWORD CHINESE=no CYRILLIC=no DATE=date DEBUG=no DORKSLCHECK=no DSBLCHECK=no DSBLMULTICHECK=no DULCHECK=no ECHO=echo EXECHECKING=yes EXEDOCCHECKING=yes FILTER=yes FREEMAIL=INTERNAL FTSGDIALCHECK=no FTSGIGNORECHECK=no FTSGMULTICHECK=no FTSGOPTOUTCHECK=no FTSGOTHERCHECK=no FTSGRSSCHECK=no FTSGSRCCHECK=no FTSGWEBFORMCHECK=no GARBLEDCHARSET=yes GLOBALNOBOUNCE=NONE GREEK=no GREP=fgrep HEBREW=no JAPANESE=no KOREAN=no LEAN=yes LEGITLISTS=NONE LOCALHOSTFILE=${HOME}/.localhostfile MONKEYFORMMAILCHECK=yes MONKEYPROXYCHECK=yes MYEMAIL=${HOME}/.myemail NOBOUNCE=${HOME}/.nobounce NOLOOP=${ALTFROM} NSLOOKUP="nslookup -sil" ORDBCHECK=no OSDIALCHECK=no OSHAVENCHECK=no OSOOLCHECK=no OSOPSCHECK=no OSORCHECK=no OSSHRCHECK=no OSSPAMCHECK=no PATTERNMATCHING=SILENT PROXYSOCKS=no RBLCHECK=no RFCIPWHOISCHECK=yes RM=rm RSLCHECK=no RSSCHECK=no RUSSIAN=no SBDEBUG=no SBTEMP=/tmp SBTRAP=NONE SENDMAIL=/usr/sbin/sendmail SPAMFOLDER=${HOME}/mail/procmail-filtered SPAMCOPCHECK=no SPAMHAUSORGCHECK=yes SPAMREPLY=SILENT SPEWSCHECK=no TEST=test THISISP=${HOST} TURKISH=no TWOMBITCHECK=no VIRUSCHECKING=yes VIRUSFOLDER=${HOME}/mail/virus # Rebuild the From address to make sure it is valid :0 fhw | $FORMAIL -I "From " -a "From " # E-mail addresses that are known to not be spammers # Mostly just my personal friends :0 * ^(From):.*([EMAIL PROTECTED]|\ [EMAIL PROTECTED]|\ [EMAIL PROTECTED]) .mbox :0 * ^(List-Id):.*Gentoo Linux mail* gentoo-user # Mark messages that are HTML without the correct # Charset. Only spammers have that. :0 fhw * ^Content-type: text/html * ! html; charset= * ! from hotmail | ${FORMAIL} -A "X-Spammers: text/html only message" # Detect spam with fake hotmail return address :0 fhw * ^(From|Return-Path):[EMAIL PROTECTED] { :0 * ^From: ".+" <[EMAIL PROTECTED]> * ^X-OriginalArrivalTime: * ^X-Originating-IP: \[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+] * ^Received: from hotmail.com \(\/... * $ ^Message-ID: <[EMAIL PROTECTED]> { } :0 Efhw | formail -A "X-Spammers: fake hotmail" } # Detect spam with fake yahoo return address :0 fhw * ^(From|Return-Path):[EMAIL PROTECTED] { :0 * ^Message-ID: <([0-9.]+\.qmail|[0-9]+\.[0-9A-Z]+)@\/[a-z0-9-]+\. yahoo\.[a-z.]+ * $ ^Received: from .+by $MATCH { } :0 Efhw | formail -A "X-Spammers: fake yahoo" } # detect spam with fake netscape return address :0 fhw * ^(From|Return-Path):[EMAIL PROTECTED] { :0 * ^X-Mailer: Atlas * ^Received: from +netscape.*MAILIN * ^Return-Path: <\/[EMAIL PROTECTED] * $ ^From:.*$MATCH * $ ^Received: from $MATCH.*by [a-z0-9.-]+\.aol\.com * ^Message-ID: <[EMAIL PROTECTED] :0 Efhw | formail -A "X-Spammers: fake netscape" } :0fw | /usr/bin/spamc :0: * ^X-Spam-Status: Yes procmail-filtered :0 * ^(X-Spammers):.* procmail-filtered :0 * ^(X-Spam-Flag):.YES procmail-filtered INCLUDERC=/home/chrisf/antispam/sb.rc :0 * ^(X-SBClass):.Blocked procmail-filtered :0 * ^(X-SBClass):.Admin admin :0 * ^(X-SBClass):.Bulk procmail-filtered :0 * ^(X-SBClass):.Spam procmail-filtered :0 * ^(X-SBClass):.Virus virus :0 * ^(X-SBClass):.OK .mbox --- End .procmailrc Christopher Fisk -- Keep brain from freezing. -- Homer Simpson, Simpson and Delilah -- [EMAIL PROTECTED] mailing list
