procmail spam rules
# $HOME/.procmailrc## Maildir delivery## (maildir = one file for each message, no locking needed for delivery)## (The following lines are needed as sendmail only can handle mbox delivery.# Procmail will take care of the maildir delivery with these lines.)#DEFAULT=$HOME/Maildir/## Change to this directory#MAILDIR=$DEFAULT# Logging##VERBOSE=no# Logfile format: procmail_log_2004.06.11LOGFILE=$HOME/logs/procmail_log_`date "+%Y.%m.%d"`# Forward everything to spamassassin# The condition line ensures that only messages smaller than 250 kB# (250 * 1024 = 256000 bytes) are processed by SpamAssassin. Most spam# isn't bigger than a few k and working with big messages can bring# SpamAssassin to its knees.## The lock file ensures that only 1 spamassassin invocation happens# at 1 time, to keep the load down.## Uncomment the next 3 lines to enable spam tagging# In my particular case, the spam is already filtered# by a central mail server, so a second SA scan is redundant#:0fw:spam.lockfile#* < 256000#| /usr/local/bin/spamc -d localhost# SpamAssassin really thinks this is spam:0* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*/dev/null:0* ^(Received|From):.*\.(kr|hu|tw|br|ru|cn|jp|pt|cz|cl|ro)\>/dev/null# CHINANET Hebei province 202.99.128.0 - 202.99.191.255 [202.99.183.163]) wide:0* ^Received:.*202\.99\.[0-9]+\.[0-9]+/dev/null# CHINANET Beijing province network 202.108.0.0 - 202.108.255.255 .163.com ([202.108.44.203] [202.108.44.205]:0* ^Received:.*202\.108\.[0-9]+\.[0-9]+/dev/null# CHINANET Guangdong province network 202.103.128.0 - 202.103.191.255 netease.com ([202.103.134.9] wide:0* ^Received:.*202\.103\.[0-9]+\.[0-9]+/dev/null# China Telecom Shanghai 61.169.0.0 - 61.171.255.255 [61.170.130.217]:0* ^Received:.*\[61\.(169|17[0-1])\.[0-9]+\.[0-9]+/dev/null# Development Research Center of the# State Councile of China:0* ^Received:.*202\.106\.171\.[0-9]+/dev/null# CHINANET Jiangsu province network# Data Communication Division# China Telecom 61.132.0.0 - 61.132.127.255 wide:0* ^Received:.*\[61\.132\.[0-9]+\.[0-9]+/dev/null# Korea Network Information Center 203.232.0.0 - 203.239.255.255 websrv.pakatex.com ([203.233.4.2]) AdAd NY:0* ^Received:.*203\.23[2-9]\.[0-9]+\.[0-9]+/dev/null# Korea Network Information Center# 211.32.0.0 - 211.39.255.255# 211.40.0.0 - 211.41.255.255# 211.41.0.0 - 211.51.255.255# 211.52.0.0 - 211.63.255.255## 211.168.0.0 - 211.171.255.255# 211.172.0.0 - 211.199.255.255#(aussie blocks in between):0* ^Received:.*211\.[0-9]+\.[0-9]+\.[0-9]+/dev/null# drugs:0 HB* (accutane|allegra|allergy|ambien|cialis|cipro|codeine|coumadin|diazepam|effexor|herbal|hydroxycut|levitra|lexapro|MEDFEST|migrane|norvasc|oxycontin|paxil|phentermin|propecia|prozac|valium|xan(a|e)x|xenical|zyban|pharmac(y|ies)|ritalin|tramadol|valium|(V|v)(i|1|ii)(a|@)gr(a|@)|zocor|zoloft|zyban|zyrtec)/dev/null# sex:0 HB* (anal|blowjob|bondage|c(o|0)ck|cum|erection|fuck|impotenc(e|y|ey)|masturbat(e|ion)|(o|0)rgy|pen(i|1)s|pussy|xxx)/dev/null# finance:0 HB* (Benin|c(a|@)s(i|1)n(o|0)|Nigeria|refinanc(e|ing|ment)|rep(l|1|\|)(i|1)ca|rolex)/dev/null:H* ^From:.*spamcop\@devnull.spamcop.net* ^Subject:.*has accepted.*emails for processing/dev/null:0 HB* (Amsterdam|blackjack|boob|breast|dick|fetish|girth|huss(ies|y)|inch|lesbian|nude|pills|poker|p(o|0)rn|(O|0)EM|remit|tits).Junk/:0:* ^Content-Type:.*charset="(.*big5|iso-2022-jp|ISO-2022-KR|euc-kr|gb2312|ks_c_5601-1987|windows-1251|windows-1256)* ^Content-Type: .*ks_c_5601-1987* ^Content-Type: .*[gG][bB]2312* ^Subject: \=\?GB2312\?.** ^Subject: \=\?big5\?.** ^Content-Type: text/html; charset=euc-kr* ^Content-Type: text/html; charset="euc-kr"* ^Subject: \[[gG][bB]2312\].** ^Subject: \[[Bb]ig5\].*.Junk/# Move Spam Assassin flagged mails to the SPAM folder inside your INBOX# (format for Maildir is .foldername/ or .foldername.subfoldername/)# Uncomment the next 3 lines to filter spam into a dedicated spam folder:0:* ^X-Spam-Flag: YES* ^X-Spam-Level: \*\*\*\*\*.Junk/# Everything not processed yet goes into to the normal inbox


Post new comment