Mailbox filters...brain hurts


#1

Ok. Getting hammered with spam from Burstnet/Hostnoc. Want it to go away. Did this in “Email Filters”

First, add [hostnoc spam] to the subject of emails with .*\[64.120.* in the headers and stop. Then, add [hostnoc spam] to the subject of emails with .*\[64.191.* in the headers and stop. Then, add [hostnoc spam] to the subject of emails that match any of the following: Contains .*\[66.96.19* in the headers Contains .*\[66.96.2* in the headers and stop. Then, add [hostnoc spam] to the subject of emails with .*\[184.22.* in the headers and stop. Then, add [hostnoc spam] to the subject of emails that match any of the following: Contains .*\[66.197.128.* in the headers Contains .*\[66.197.129.* in the headers Contains .*\[66.197.13* in the headers Contains .*\[66.197.14* in the headers Contains .*\[66.197.15* in the headers and stop. Then, add [hostnoc spam] to the subject of emails that match any of the following: Contains .*\[66.197.16* in the headers Contains .*\[66.197.17* in the headers Contains .*\[66.197.18* in the headers Contains .*\[66.197.19* in the headers Contains .*\[66.197.2* in the headers and stop. Then, add [hostnoc spam] to the subject of emails that match any of the following: Contains .*\[96.9.128.* in the headers Contains .*\[96.9.129.* in the headers Contains .*\[96.9.13* in the headers Contains .*\[96.9.14* in the headers Contains .*\[96.9.15* in the headers and stop. Finally, add [hostnoc spam] to the subject of emails that match all of the following: Contains .*\[96.9.16* in the headers Contains .*\[96.9.17* in the headers Contains .*\[96.9.18* in the headers Contains .*\[96.9.190* in the headers Contains .*\[96.9.191* in the headers and stop.

The header for this email was correctly tagged matching “[64.191.51.24]” on the 2nd rule:

X-Antivirus: AVG for E-mail Return-Path: <AmeliaSantiago@postoffice.raxmac.net> X-Original-To: mgiven@netdcon.com Delivered-To: x10595832@homiemail-mx19.g.dreamhost.com Received: from alc-junkmail-backend3.dreamhost.com (caiajhbdcaid.dreamhost.com [208.97.132.83]) by homiemail-mx19.g.dreamhost.com (Postfix) with ESMTP id 482AB28985A for <mgiven@netdcon.com>; Fri, 2 Aug 2013 07:38:58 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by alc-junkmail-backend3.dreamhost.com (Postfix) with ESMTP id 3FE5BA0C07A for <mgiven@netdcon.com>; Fri, 2 Aug 2013 07:38:58 -0700 (PDT) X-DH-Virus-Scanned: Debian amavisd-new at alc-junkmail-backend3.dreamhost.com X-Spam-Flag: NO X-Spam-Score: -1.532 X-Spam-Level: X-Spam-Status: No, score=-1.532 tagged_above=-999 required=999 tests=[RP_MATCHES_RCVD=-1.532] Received: from godfather.dreamhost.com ([208.97.132.5]) by localhost (alc-junkmail-backend3.dreamhost.com [208.97.132.104]) (amavisd-new, port 10024) with ESMTP id dh3kmLT8b+2F for <mgiven@netdcon.com>; Fri, 2 Aug 2013 07:38:57 -0700 (PDT) Received: from postoffice.raxmac.net (postoffice.raxmac.net [64.191.51.24]) by godfather.dreamhost.com (Postfix) with ESMTP id 9E7461B00AA for <mgiven@netdcon.com>; Fri, 2 Aug 2013 07:38:57 -0700 (PDT) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [hostnoc spam] iPhone or Android - What phone would you like to have From: Phone Guide <AmeliaSantiago@raxmac.net> To: <mgiven@netdcon.com> Date: Fri, 02 Aug 2013 07:38:57 -0700 Message-ID: <aa8476cc2c7b1ddf85d4dbe5aa5d05a5.20130801221712.56779.17543@postoffice.raxmac.net>

…ant yet a couple of octet bits away at “[64.191.51.10]”, the same rule seems to fail:

X-Antivirus: AVG for E-mail Return-Path: <AmberHarper@mail6.waghum.net> X-Original-To: mgiven@netdcon.com Delivered-To: x10595832@homiemail-mx16.g.dreamhost.com Received: from diehard.dreamhost.com (caiajhbdcbbj.dreamhost.com [208.97.132.119]) by homiemail-mx16.g.dreamhost.com (Postfix) with ESMTP id 5EBE04021E618 for <mgiven@netdcon.com>; Fri, 2 Aug 2013 06:03:24 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by diehard.dreamhost.com (Postfix) with ESMTP id 5C3EC17BCC4D for <mgiven@netdcon.com>; Fri, 2 Aug 2013 06:03:24 -0700 (PDT) X-DH-Virus-Scanned: Debian amavisd-new at diehard.dreamhost.com X-Spam-Flag: NO X-Spam-Score: -1.133 X-Spam-Level: X-Spam-Status: No, score=-1.133 tagged_above=-999 required=999 tests=[RP_MATCHES_RCVD=-1.133] autolearn=disabled Received: from connor.dreamhost.com ([208.97.132.145]) by localhost (diehard.dreamhost.com [208.97.132.157]) (amavisd-new, port 10024) with ESMTP id fQTevxo9I0mO for <mgiven@netdcon.com>; Fri, 2 Aug 2013 06:03:24 -0700 (PDT) Received: from mail6.waghum.net (mail6.waghum.net [64.191.51.10]) by connor.dreamhost.com (Postfix) with ESMTP id 9B8782CA801A for <mgiven@netdcon.com>; Fri, 2 Aug 2013 06:03:23 -0700 (PDT) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Date: Fri, 02 Aug 2013 06:03:23 -0700 Subject: Summer Surplus - Electronics marked-down 90% From: Summer Surplus <AmberHarper@waghum.net> To: <mgiven@netdcon.com> Message-ID: <20130801213335.45855.36887.20130801213335.45855.36887@mail6.waghum.net>

…or have I, the consummate dumbarse luser, failed?