Print Page | Close Window

Help with filter

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7008
Printed Date: 17 November 2017 at 11:38pm


Topic: Help with filter
Posted By: amsummer
Subject: Help with filter
Date Posted: 08 February 2012 at 12:19pm
Hello!

I've got a couple of folks receiving a lot of spam being sent through PHP mailers.  Its not being blocked from RDNS, or the MAPS or SURBL servers, or the SPF Fail, or SFDB fail.  The subject is not always consistent, and I hesitate to block anything with our company (The Office Place) in the subject as that runs the potential of being legit.  Anyone have any ideas how I might block these?  I'd appreciate your suggestions Smile!

X-Antivirus: AVG for E-mail
Received: from <mailserver> (<local IP>) by <mailserver>(<local IP>)
 with Microsoft SMTP Server id 8.1.340.0; Thu, 2 Feb 2012 01:43:31 -0500
Subject: The Office Place: Drug Errors In Health Care
To: dickd@theofficeplace.com
Date: Thu, 2 Feb 2012 01:43:31 -0500
Return-Path: rireVakeglive@expressbuy2011.info
From: BoulaFror <rireVakeglive@expressbuy2011.info>
Message-ID: <dc802a660ceda51292322a2a3409a077@www.theofficeplace.com>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.4]
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"
 

X-Antivirus: AVG for E-mail
Received: from <mailserver> (<local IP>) by <mailserver>(<local IP>)
 with Microsoft SMTP Server id 8.1.340.0; Wed, 1 Feb 2012 15:46:40 -0500
Subject: The Office Place: Walgreen Discount Drugs
To: dickd@theofficeplace.com
Date: Wed, 1 Feb 2012 15:46:40 -0500
Return-Path: accunnife@climbing-dancing.info
From: arrophady <accunnife@climbing-dancing.info>
Message-ID: <0dbb7f9f16b82715e92d1494824f0f3c@www.theofficeplace.com>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.4]
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"




Replies:
Posted By: jerbo128
Date Posted: 08 February 2012 at 10:58pm
I would suggest writing a regex keyword that matches exactly [the office place: somemoretext]
If you include the colon, the space following the colon, and require that there be at least one more text string after the space, that should make for specific enough keyword that it would be accurate.


Posted By: amsummer
Date Posted: 14 February 2012 at 11:12am
That's a good suggestion.  As someone who has not written RegEx for this program before...and for that matter is 10 years from my last RegEx in any program...would you be so kind as to craft this for me?  I'd really appreciate it.

Thanks!



Print Page | Close Window