Re: From=To filter

Frederick Bambrough <fred@...> wrote:

>Is it possible to create a filter that performs -
>
>'Act if From: = To:' or better, 'Act if Part of From: = Part of To:' ?
>
> As for many others, I'm getting a lot of spam recently which is addressed
> from someone@myaddress to someone@myaddress which don't get picked up
> otherwise.

If you know what the 'someone@myaddress' value is, you can define a filter
which contains more than one rule and looks for 

      message sender contains <whatever>
 AND  Envelope-To    contains <whatever>

which would work if, say, <whatever>  is   @ypical.demon.co.uk

but if eg you want to accept mails you've genuinely sent from
fred@... to safety@..., but catch those sent
eg to/from lots of separate combinations like pqrst123@ or 045CD12A@ or ...
- that is have have completely arbitrary matching of unknown parts of
headers, then you can't do it directly.


On the other hand, how many genuine mails do you get that actually are from
one of your own domain's email addresses?  You might be able to filter lots
of them just with tests on the From value, if you use regex testing on the
from value to define a pattern against which you can match typical bad
values.  I filter lots of my incoming spam by looking for lefthand parts of
email addresses that don't contain any dots in the lh part, with a rule
like:

  Match if Envelope-To: does not match regular expression

       newsreply|odeon|postmaster|singer

       and Envelope-To: matches regular expression

       ^([a-zA-Z0-9]){1,999}\@wingsandbeaks\.org\.uk


In my case a few old email addresses I use do have lefthand parts that have
no dots in them, as shown in the list of alternatives in the first rule. The
second rule looks for Envelope-To values that 

 ^ start, then have 

between 1 and 999 instances of ([a-zA-Z0-9])     - which means an individual
character that is one of a-z or A-Z or 0-9;   then I expect to see

 \@                 a literal at-sign, then
 wingsandbeaks      then 
 \.                 a literal dot, then 
 org                then
 \.                 a literal dot, then
 uk


In other words, an incoming email address whose lefthand part is 1-999
alphanumeric characters (so can't include dots), but not one of the few
explicit known-to-be-ok values.



Another example is a rule which matches if Envelope-To: contains something
that matches regular expression:

   jn\.th\.\d{6,6}.{0,1}\@wingsandbeaks\.org\.uk

which is meant to look for values like:  jn.th.120911c@...

This is the sort of email address I use for what are intended to be one-off
'throwaway' email enquiries to particular companies.  I keep a list of what
I ask and who I sent it to...  Originally I only ever used one such address
per day, of form jn.th.yymmdd@ but after a while I started using separate
a/b/c etc suffixes for the 1st/2nd/3rd such query on any particular day.  So
the example address would be what I would have used for the 3rd outbound
query sent by me on 11 Sept 2012.

When emails arrive for a valid example of such an address, identified by
this rule, I route them to a particular folder.  There are a few such
addresses previously used for genuine contact with companies, which now get
spammed and I have explicit rules ahead of the pattern rule that route the
spams elsewhere.  

The regex looks for literally "jn.th." followed by 6 digits - \d occurring
between 6 and 6 times - followed by an optional character - "." matches
anything, occurring between 0 and 1 time - (the "c" in my example isn't
always present), followed by the rest of the @wingsandbeaks.org.uk value. 


-- 
Jeremy C B Nicoll - my opinions are my own.

______________________________________________________________________
This message was sent via the gemini-users mailing list
To unsubscribe, mail gemini-users+unsubscribe@...