Re: [Exim] I knew there was something ... spam

Tony Earnshaw <tonni@???> writes:

> Example:
>
> ----------------------
>
> Return-path: <netfilter-admin@???>
> Envelope-to: tonni@???
> Delivery-date: Sun, 17 Mar 2002 08:30:25 +0100
> Received: from punt-15.mail.nl.demon.net ([194.159.73.24]) by
> billy.demon.nl with smtp (Exim 4.01) id 16mV7Y-0001UI-00 for
> tonni@???; Sun, 17 Mar 2002 08:30:25 +0100
> Received: from punt-14.mail.nl.demon.net by mailstore for
> tonni@??? id 1016335120:14:29994:0; Sun, 17 Mar 2002 03:18:40
> GMT
> Received: from samba.sourceforge.net ([198.186.203.85]) by
> punt-12.mail.nl.demon.net id aa1200071; 17 Mar 2002 3:18 GMT
> Received: from va.samba.org (localhost [127.0.0.1]) by lists.samba.org
> (Postfix) with ESMTP id 811E74190; Sat, 16 Mar 2002 19:14:20 -0800 (PST)
> Delivered-To: netfilter@???
> Received: from localhost (unknown [211.190.93.196]) by lists.samba.org
> (Postfix) with SMTP id D4A614111 for <netfilter@???>; Sat,
> 16 Mar 2002 19:13:06 -0800 (PST)

Maybe heretical on this list, but wouldn't it be a lot easier to do
that with procmail?

You could tailor this once you see what it catches that you don't
want caught:

:0
* ^Received.*unknown [211\.
spam_suspect1.in

Or even just:
:0
* ^Received.*[211\.
spam_suspect1.in

You might want to add addresses beginning 202 as well