Merc transaction-level filtering - Pegasus

Dave wrote:

> I am getting hundreds of spams from a multitude
> of IPs with a HELO greeting of either
>
> "1" followed by 9 digits
>
> or
>
>"-1" followed by 9 digits
>
> This works: "*1[0-9][0-9][0-9]*", but blocks many legit greetings.
>

Try:

H, "*1[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]*", BS, "554 Rejected"

--
OpenPGP: id=18795161E22D3905; preference=signencrypt;
url=http://guysalias.batcave.net/pgpkeys.txt

"Guy" <Use-Reply-To-Address-Header@[127.1]> wrote in message
news:9755$910AF$1261$2E284CEEC009E394A9D7@127.0.0.1...
> Try:
> H, "*1[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]*", BS, "554 Rejected"

Thanks for the reply.

Some legit greetings have a sequence of numbers preceded by location info.
I'm concerned that even limiting to an exact minimum of digits might still
match a legit sender.

When I realized the entire line must be matched, I figured e.g. the
expression
"HELO -1[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]"
would match "HELO -1234567890", but unfortunately it doesn't.

Dave schrieb:
> How does one filter on a specific subject or HELO greeting?
>
> This works: "*1[0-9][0-9][0-9]*", but blocks many legit greetings.
>
> Any ideas?

Same problem here. I use

"*/b-[0-9][0-9][0-9]*" (could be extended)
and
"*/b[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]*"

this works for me.