Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - How do you filter this with keywords?
  FAQ FAQ  Forum Search   Register Register  Login Login

How do you filter this with keywords?

 Post Reply Post Reply
Author
jacksun View Drop Down
Newbie
Newbie


Joined: 24 February 2005
Status: Offline
Points: 31
Post Options Post Options   Thanks (0) Thanks(0)   Quote jacksun Quote  Post ReplyReply Direct Link To This Post Topic: How do you filter this with keywords?
    Posted: 27 February 2005 at 4:31pm

Hi, just having another issue on keyword filtering. We are receiving spam with a subject line of this:

Subject: re [1] :

And the number in the square brackets constantly changes, the highest I've seen is a 2 digit number. The body and everything else is basic with no common filterable keywords that would not result in huge false positives. Any that have been blocked have been caught by a blacklist.

Any help with a regex filter term would be greatly appreciated.

Regards,

Wayne

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4106
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 27 February 2005 at 5:45pm
Wayne,

You could try the following Regular Expression:

(Subject:.*\[\d{1,2}\])

It should catch all instances in the subject where you have either one or two digits between square brakets.


Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
jacksun View Drop Down
Newbie
Newbie


Joined: 24 February 2005
Status: Offline
Points: 31
Post Options Post Options   Thanks (0) Thanks(0)   Quote jacksun Quote  Post ReplyReply Direct Link To This Post Posted: 27 February 2005 at 10:31pm

Thanks Roberto, as always excellent support!!

 

Wayne

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 28 February 2005 at 1:01am

This is what I use:

((?i)subject:.*((re.{0,3}\[[\d]{1,3}\])))

Dan S.

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.301 seconds.