Dan,

We have been trying your RegEx for keywords (even though you cautioned against it). Seems to help nicely. If you are interested in any spam that slips through, is there some way to comunicate with you so we can try to add these additional bad guys to the RegEx list of keywords?

John

I am trying to create a way to work, collectivly, on RegEx's without publicly posting my address.  I also feel that if we come up with anything "super inovative", the rest of the users should benifit ... fighting Spam should not be some sort of "gaurded secret" which is why I have posted what I have worked on so far.

At the moment, I am in the process of preparing to upgrade our Border Router and have a deadline of Friday at 8:00PM so I doubt I will come up with anything prior to that.  If you have any thoughts, please let me know.

Dan S.

BTW ... Which "version" of my filter lists are you trying out?  And are you using the "fromEmail" list?   Are you attempting to check for false positives?

Dan S.

Dan,

Here is the list we are trying.

We check the quaranteen log for false positives (sometimes).

BTW, can you offer some explaination of the 1st RexEx expression?  (Just got Mastering Regular Expressions Book yesterday. Very good book!)

========================================

(<[!--]+[\x20]{0,1}[a-zA-Z0-9]{10,}[\x20]{0,1}[!--])

(href=" < http://+/" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://+" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://+ [\d>< undefined" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - / - http://+>" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://+> [\d])

( < http://.{0,10}/" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://.{0,10}" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://.{0,10} %[\d>< undefined" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - / - http://.{0,10}>" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://.{0,10}> %[\d])

(<[!--]+[a-zA-Z0-9]{2}(-->))

((<font color="#ffffff">.*){3,8})

((\|.*){11,})

(content\-type:\x20text/html\r\ncontent-transfer\-encoding:\x20base64\r\n)

( < http://www../" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.." CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.. *.(com|net|org)@www>< undefined" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - / - http://www..>" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www..> *.(com|net|org)@www)

((limited time (special|offer)))

pro2ware.biz

text-decoration: blink

98207.biz

herbalpillsonline

pillsavings

red.ecablenetwork.com

horfinc.com

click here to start

thousands of other email providers

gsc-100

img src=3D"< undefined" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - / - http://>" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://>

is a one time mailing

your privacy is extremely important to us

one of our member sites

 

John

Here is from my previous post:

• <                    look for an open tag start character, immediately followed by...
•  [!--]+            looks for 1 or more  !-- characters indicating an html comment, immediately followed by...
• [\x20]{0,1}    looks for 0 or 1 space (hex 20) followed by ....
• [a-zA-Z0-9]{10,} 10 or more alphanumeric characters   (*** see note below)
• [\x20]{0,1}    looks for 0 or 1 space (hex 20) followed by ....
• [!--]               Any one of these characters should indicate that the tag is being closed