Page 1 of 1

Regular Expression Question

Posted: Mon Nov 13, 2006 12:32 pm
by aspong
Hi,

First a short paste from my rules log:

12/11/2006 17:03:20 SPAM noMXXR Anthony Tomlinson <deborahymczqushywq@cairo.sl.slb.com> Anthony
12/11/2006 17:33:18 SPAM noMXXR Coleen Richards <deborahshore@cameronmanagement.com> Coleen
12/11/2006 17:33:19 SPAM noMXXR Lana Mcdowell <deborahmullin@burrells.com> Lana

There is a spate of spams which use the first name of the sender's display name in the subject. For example, in the first entry above, the display name 'Anthony Tomlinson' has the subject 'Anthony'.

At the moment I've got all messages from sender containing 'debora' marked as spam, rather than deleting from the server, just in case I get real email from a deborah. And as is the way with spam, 'debora' won't cover all mutations.

It would be good if I could write an expression which says something like:

IF from Contains %subject% THEN delete from server.

That way if 'from' (Anthony Tomlinson) contains 'subject' (Anthony) then the email will be deleted. I can't see any occasion where a genuine email would be titled with just the sender's first name.

1. Is there a regular expression for the 'subject' of an email? And if yes, how would you write the expression?
2. Is there an alternative suggestion for this specific spam?

Thanks,
Andrew

Posted: Mon Nov 13, 2006 3:14 pm
by KY Dave
AFAIK- I don't think you can use a MACRO to COMPARE to one of the RULEs' AREAS.

Posted: Wed Nov 15, 2006 8:14 am
by Renier
Maybe it's possible with a clever regexp on the header, but that is beyond my regexp skills.

Re: Regular Expression Question

Posted: Sun Oct 21, 2007 4:49 am
by lemming
This would be possible with a regex, specifically a Lookahead or Lookbehind assertion. However, these are quite advanced and would be near the limits of my regex skills. Plus I've never gotten spam as you described.

So, perhaps you could post the actual spam headers (not log entry), and I'll take a stab at the problem.

-Lemming.


aspong wrote: ...
That way if 'from' (Anthony Tomlinson) contains 'subject' (Anthony) then the email will be deleted. I can't see any occasion where a genuine email would be titled with just the sender's first name.

1. Is there a regular expression for the 'subject' of an email? And if yes, how would you write the expression?
2. Is there an alternative suggestion for this specific spam?

Thanks,
Andrew