On Fri, 20 Feb 2015 19:52:37 -0800, fakename@fakeURL.com wrote:
>I have sucessfully filtered this spam, using Agent 7.
>
>There is a rash of JPG spam in multiple groups, using several
>different subject lines, "pregnant wives" being one of many.
>
>These are tough to kill as they use several different subject lines,
>each with a random name and email address. A filter that filters on
>the subject, name or email address works for awhile, until they change
>that info.
>
>I have discovered one commonality that allows you to filter everything
>from this poster.
>
>The key is to look at the Message ID field. Here is the Message ID
>field from one of the "Pregnant Wives" posts:
>
>Message-ID: <a446.a02.138@gfkwt.com>
>
>Here is one from the "Dripping teen asian sweetie" posts:
>
>Message-ID: <a448.9e9d.5d@hoacw.com>
>
>Here is one from the "day at the beach" posts:
>
>Message-ID: <a448.4c5e.3b9@zijwm.com>
>
>Note the one common feature of the Message IDs - they all start with
>"a4". The two numbers following increment, and everything after that
>is random characters. It'll be a446 for a while, then a447, then
>a448, etc.
>
>Here is the filter I use:
>
>Message-ID: {^<a4}
>
>The "^" symbol means "starts with", so this filter will match any post
>whose Message ID field starts with "<a4".
>
>This filter may also catch the occasional legitimate post whose
>Message ID just happens to start with "a4", but that's a small price
>to pay for zapping a ton of spam.
>
>When I try a new filter, I start out by selecting "mark read" instead
>of "delete". I try it for a few days, to see if any legit posts are
>getting marked. If so, I tweak the filter. If it's only catching
>spam, they I switch the filter to "delete".
>
>Long time Usenetter,
>No One You Know
A good lesson in Agent's expressions and a great reminder to always
test first.
EG.
|
|