# .nospam - procmail anti-spam filters for myers@umich.edu ###################################################################### # @(#) Last changed: 11Sep2002 # Note on EXITCODE=67 in some spam filters below: # EXITCODE is from /usr/include/sysexits.h, where it's defined as # define EX_NOUSER 67 /* addressee unknown */ # So setting EXITCODE=67 causes sendmail to return the e-mail # as undeliverable because the addressee is unknown. This will # hopefully make the spammers think that your address is wrong # or doesn't even exist. At least you won't have to deal with it. ######################################## ## Anti-Spam: chuck anything from these bozos (but log it to spambox) :0 * ^X-Advertisement: { EXITCODE=67 :0 | formail -A "X-Suspected-Spam: Caught by .procmailrc, A" >> $SPAMBOX } ################# ## Particular subjects/keywords: :0 * ^Subject.*(BAN DAN|Dr. Santillo|Marketing|Bible of Dating|Hotel Coupon|\ laser printer toner|FREE_Satellite_Dish|Findout About Anyone|ADV:|ADVT:|\ Very Special Offer|Make \$.*|142 MILLION Email|Rates are Coming Down|Nasdaq:|\ Uncollected Judgment|Advertise .* for FREE|toner cartridges|OTCBB:|\ Need a Home Loan?|laster toner|cellphone antenna|Mortgage|Life Insurance|\ Discount Pharmacy|Size Counts|It's me again.|=\?UNKNOWN|\?\?|\ database that Bill Gates|URGENT|Regarding your resume|Tristan et Iseut) { EXITCODE=67 :0 | formail -A "X-Suspected-Spam: Caught by .procmailrc, A" >> $SPAMBOX } ################# # Companies/domains: :0 * ^From.*(@hotmail.com|@webtv.com|worldwidepromo.com|collegenews.com|@msn.com|\ thedrill.com|worldweb-guide.com|greenharvest.com|valueweb.net|@england.com\ metroinfo.com|mfcnet.net|imbc.com|cybersurf.com|sendad.com|poline.com|\ jumbo.com|homeworkheaven.com|nowhere.com|abac.com|universitytext.com|\ qlink2info.com|t-1net.com|23106.com|VirtualServing.com|TheRest.com|\ dotcom-xpress.net|savoynet.com|cyberswap.com|\.one\.net|@magg.net|kornet.net|\ dataimpressions.com|crushnet.com|mail-man.net|samart.co.th|@acmemail.net|\ twosst.com|tireguard.com|colman.com|21stcenturymarketing.com|pedagonet.com|\ netaccess.ca|ybecker.net|ws2.com|@GoGlobal.com|Liquid-Fire.com|\ @us.checkpoint.com|@tiesseci.it|@bobook.com|narn.netnames.net|@4u.net|\ luckynumber.com|lagnet.com.mx|globecomm.net|playful.com|ctimail.com|\ lightrealm.com|inspired.co.uk|@netsearchsolutions.com|@idmail.com|0mm.com|\ youralumni.com|thebest.net|babenet.com|xxxfiles.com|grabnow.com|@cupahr.org|\ venere.inet.it|bigfoot.com|Gethrucollege.com|freensafe.com|.zzn.com|\ .quickdot.com|cbeon.com|serviceconceptsint.com|netvigator.com|mall.com|\ internetseer.com|relatemedia.com|UltraTrim|debeaumont.net|londonlinks|\ marketing|cbltvdscrmblrs|@mixmail.com|@shutdown.com|9netway.com|tradersnet@|\ @paid4survey.net|sik@businessworldw|@trafficmagnet.net|@akoss.net|\ @eroticmemo.com|weatherbug.com|brand-offers.com|csiprotection.com|\ Wall *Street|@schoolsports.com|@allexecs.com|Ceri Star|rent.com|\ @millenniumdata.com|trafficmagnet.com|maxgroup.com|@uptilt.com|\ @necsi.org|musiciansfriend|recruit) { EXITCODE=67 :0 | formail -A "X-Suspected-Spam: Caught by .procmailrc, B" >> $SPAMBOX } ########## # Individual Addresses (non AOL): :0 * ^From.*(bobby@bellsouth.com|attyraymullins@provide.net|robharris@msn.com|\ Bull.*Eye|ALPHANET1@prodigy.net|AfroCubaWeb|bdmf@email.msn.com|\ svenbuck@injersey.com|hopelessmail@mindspring.com|HV@derfriseur.de|\ Pent550MHz@flash.net|lumine@spotmail.com|Toledoswords@yahoo.com|\ usayhello@earthlink.net|olk@olk.co.kr|travel-y2vacation|mary22@uk2.net|\ sixty_six_million@yahoo.com|riche@xoommail.com|otv@dst.at|scholars@us.net|\ Pharmacom-Medical@|hj4hj6@yahoo.com|AnnaHolubkova@revert.com|udo@xww.net|\ morris369@excite.ca|michlive@shianet.org|rplongdis@excite.com|\ oB5PI5fbb@mail.internet.com.mx|strieb@mail.kattare.com|Multi-function.Dig|\ stay.*ard@|AcquireSolution|Artprice@|Catherine.Lawler@prodigy.net.mx) { EXITCODE=67 :0 | formail -A "X-Suspected-Spam: Caught by .procmailrc, C" >> $SPAMBOX } ########### # Mail TO: address is often a sign of spam :0 * ^TO.*(@webtv.com|4you@usa.net|@mailffx.LASER.NET) { EXITCODE=67 :0 | formail -A "X-Suspected-Spam: Caught by .procmailrc, D" >> $SPAMBOX } :0 * ^Subject:.*SPAM-TEST { EXITCODE=67 :0 | formail -A "X-Suspected-Spam: Caught by .procmailrc, E" >> $SPAMBOX } ########### # Individual Spammers from AOL: just accept it quietly and ignore, no # need to bounce it back. :0 * ^From.*(fbj3@aol.com|pio98@aol.com|b15@aol.com|311@aol.com|\ Teenbab160@aol.com|Vendor5576@aol.com|GGershon@aol.com|\ SpDrKiLL@aol.com|SpDrKiLL@aol.com|JennaShell@aol.com|JSMaurig@aol.com|\ TWLIMO@aol.com|FloBall@aol.com|Caws711@aol.com|CoolcatSM@aol.com|\ CoolcatsN@aol.com|KatieRose@aol.com|JackieSara@aol.com Afm971@aol.com|\ Cyberbug15@aol.com|KATATAK14@aol.com|Talis79319@aol.com|TOLEDOSWORDS@aol.com|\ Karen11526@aol.com|Doobie1217@aol.com|GIRL699391@aol.com|\ Elmo165@aol.com|ERNIE94830@aol.com|PLSVIS@aol.com|Honey3321@aol.com|\ PlayaPB@aol.com|TamaleG@aol.com|KKrause23@aol.com|BABY124@aol.com|\ Scruffy971@aol.com|LILY825@aol.com|MF15@aol.com|Nirvana835@aol.com|\ ultratrim2000@aol.com|turbocash2@aol.com|outla77500@aol.com) | formail -A "X-Suspected-Spam: Caught by .procmailrc, F" >> $SPAMBOX :0 * ^From.*(EyEmMe4FuN@aol.com|BRONXBABE6@aol.com|AcQuAgRl@aol.com|\ FallingUp2@aol.com|SMURFMAN15@aol.com|Cadelena@aol.com|@yahoogroups.com|\ XxHKBOYxX@aol.com|BaByThug14@aol.com|SwE3TtHAnG@aol.com|\ InVicious@aol.com|VgUrLQt@aol.com|WaRiOr222@aol.com|XMiao@aol.com|\ Corrie3692@aol.com|THUG915@aol.com|DaBrat14f@aol.com|CPC69@aol.com|\ Heidi10377@aol.com|Tomygrl591@aol.com|SEABREAZE9@aol.com|\ TAZ1TWE951@aol.com|TM413@aol.com|NrvanaKid1@aol.com|Wildwo1978@aol.com|\ BFC98@aol.com|Jess329@aol.com|GRock007@aol.com|Nikki813@aol.com|\ Srfnhawaii@aol.com|BosSocRChk@aol.com|PsiberFLRT@aol.com|\ HotLipsUSA@aol.com|Twiggy1568@aol.com|ShyGrl479@aol.com|BestBut@\ DANCE1717@aol.com|GATHR750@aol.com|Pooh0001@aol.com|Pretygrl50@aol.com|\ DrDuck13@aol.com|Myrnoko@aol.com|SPICE13174@aol.com|STARS512@aol.com) | formail -A "X-Suspected-Spam: Caught by .procmailrc, G" >> $SPAMBOX # Masked headers: lots of xxxxxxxxxx's in Received: header is a # sign of spammers trying to hide their tracks :0 * ^Received:.*xxxxxxxxxxxx { EXITCODE=67 :0 | formail -A "X-Suspected-Spam: Caught by .procmailrc, H1" >> $SPAMBOX } # Teltale from paterns :0 * ^From:.*(\"\"|Inkjet) { EXITCODE=67 :0 | formail -A "X-Suspected-Spam: Caught by .procmailrc, H2" >> $SPAMBOX } ############### # Anything in Korean is spam :0 : * ^Content-Type: text/html; charset=.*(euc-kr|ks) { EXITCODE=67 :0 | formail -A "X-Suspected-Spam: Caught by .procmailrc, K1" >> $SPAMBOX } :0 : * ^Subject:.**(=?ks_c|=?EUC-KR) { EXITCODE=67 :0 | formail -A "X-Suspected-Spam: Caught by .procmailrc, K2" >> $SPAMBOX } ################ # Anything in HTML *might* be spam so just save it there for later # (no need for NOUSER code) :0 : * ^Content-Type: text/html; spambox ##EOF .procmailrc.spam ##