Help with filter
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7008
Printed Date: 27 December 2024 at 8:59am
Topic: Help with filter
Posted By: amsummer
Subject: Help with filter
Date Posted: 08 February 2012 at 12:19pm
|
Hello! I've got a couple of folks receiving a lot of spam being sent through PHP mailers. Its not being blocked from RDNS, or the MAPS or SURBL servers, or the SPF Fail, or SFDB fail. The subject is not always consistent, and I hesitate to block anything with our company (The Office Place) in the subject as that runs the potential of being legit. Anyone have any ideas how I might block these? I'd appreciate your suggestions  !X-Antivirus: AVG for E-mail Received: from <mailserver> (<local IP>) by <mailserver>(<local IP>) with Microsoft SMTP Server id 8.1.340.0; Thu, 2 Feb 2012 01:43:31 -0500 Subject: The Office Place: Drug Errors In Health Care To: dickd@theofficeplace.com Date: Thu, 2 Feb 2012 01:43:31 -0500 Return-Path: rireVakeglive@expressbuy2011.info From: BoulaFror <rireVakeglive@expressbuy2011.info> Message-ID: <dc802a660ceda51292322a2a3409a077@www.theofficeplace.com> X-Priority: 3 X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.4] MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" X-Antivirus: AVG for E-mail Received: from <mailserver> (<local IP>) by <mailserver>(<local IP>) with Microsoft SMTP Server id 8.1.340.0; Wed, 1 Feb 2012 15:46:40 -0500 Subject: The Office Place: Walgreen Discount Drugs To: dickd@theofficeplace.com Date: Wed, 1 Feb 2012 15:46:40 -0500 Return-Path: accunnife@climbing-dancing.info From: arrophady <accunnife@climbing-dancing.info> Message-ID: <0dbb7f9f16b82715e92d1494824f0f3c@www.theofficeplace.com> X-Priority: 3 X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.4] MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" |
Replies:
Posted By: jerbo128
Date Posted: 08 February 2012 at 10:58pm
|
I would suggest writing a regex keyword that matches exactly [the office place: somemoretext]
If you include the colon, the space following the colon, and require that there be at least one more text string after the space, that should make for specific enough keyword that it would be accurate.
|
Posted By: amsummer
Date Posted: 14 February 2012 at 11:12am
|
That's a good suggestion. As someone who has not written RegEx for this program before...and for that matter is 10 years from my last RegEx in any program...would you be so kind as to craft this for me? I'd really appreciate it. Thanks! |