I'm having a pretty hard time with this one for some reason, mainly because
I don't understand regex. I have a large number of emails that are getting
past my spamassassin setup (Maia Mailguard 1.02a) as well as my Barracuda.
I would like to add a score to email from noreply@*. I'm not asking for
anyone to write the rule for me (though that would be nice), but general
guidance on how to go about doing this *easily*.

Curtis LaMasters
http://www.curtis-lamasters.com
http://www.builtnetworks.com

On Tue, 2008-08-26 at 14:31 -0500, Curtis LaMasters wrote:
> I'm having a pretty hard time with this one for some reason, mainly
> because I don't understand regex. I have a large number of emails
> that are getting past my spamassassin setup (Maia Mailguard 1.02a) as
> well as my Barracuda. I would like to add a score to email from
> noreply@*. I'm not asking for anyone to write the rule for me (though
> that would be nice), but general guidance on how to go about doing
> this *easily*.

I've recently been putting in IP blocks for what seems to be a single
spam outfit using noreply@... in all emails. So far it seems they're
moving around a fairly small number of hosting providers but no one is
onto them yet.

Derek

> -----Original Message-----
> From: Derek Harding [mailto:derek@innovyx.com]
> Sent: 3 September 2008 1:48 p.m.
> To: Curtis LaMasters
> Cc: users@spamassassin.apache.org
> Subject: Re: adding score for email from noreply@
>
> On Tue, 2008-08-26 at 14:31 -0500, Curtis LaMasters wrote:
> > I'm having a pretty hard time with this one for some reason, mainly
> > because I don't understand regex. I have a large number of emails
> > that are getting past my spamassassin setup (Maia Mailguard 1.02a)
as
> > well as my Barracuda. I would like to add a score to email from
> > noreply@*. I'm not asking for anyone to write the rule for me
(though
> > that would be nice), but general guidance on how to go about doing
> > this *easily*.
>
> I've recently been putting in IP blocks for what seems to be a single
> spam outfit using noreply@... in all emails. So far it seems they're
> moving around a fairly small number of hosting providers but no one is
> onto them yet.
>
> Derek

Hello Derek.

Check out http://wiki.apache.org/spamassassin/WritingRules for writing
custom rules. I learnt how to do it from that page, and then by looking
at how everyone else makes rules (check out the ones that already come
with Spamassassin - and go about understanding them)

If you're on a linux box with the Perl manuals installed, you can get an
idea about regular expressions from "man perlre". Takes a little while
for regular expressions to sink in, but you've got to start somewhere.

It may also help to understand Perl itself a little better... I bought a
book to do that

HTH, Cheers,
Michael Hutchinson
Manux Solutions Limited.

On Wed, 2008-09-03 at 14:13 +1200, Michael Hutchinson wrote:
> Check out http://wiki.apache.org/spamassassin/WritingRules for writing
> custom rules. I learnt how to do it from that page, and then by looking
> at how everyone else makes rules (check out the ones that already come
> with Spamassassin - and go about understanding them)
>
> If you're on a linux box with the Perl manuals installed, you can get an
> idea about regular expressions from "man perlre". Takes a little while
> for regular expressions to sink in, but you've got to start somewhere.
>
> It may also help to understand Perl itself a little better... I bought a
> book to do that

Thanks Michael,

I'm pretty familiar with Perl. However writing a rule for noreply@
wasn't where I wanted to go given that it's too simplistic a pattern and
prone to false positives with automated systems that use noreply@. Given
the IPs only produce this stuff it seemed smarter to just block them. W

What intrigues me is who these guys are and how/why they're flying under
the anti-spam radar.

Derek