scanning $subject for multiple occurrences of a character

Sergio · ‎06-01-2008

Hi,

I just wanted to know if it is possible to use the GUI to check for a character threshold greater than one in the subject header.

We are seeing subjects like: this_is_a_hundred_percent_spam_header

and would want to block this kind of messages.

Any idea?

thank you,

SergioC

kluu_ironport · ‎06-02-2008

Can you clarify on what you mean by "character threshold greater than one in the subject header" ?

when you say mulitple occurrence of a character, do you mean a repeat like "testssss" where the "s" is repeating?

What is it about this subject, " this_is_a_hundred_percent_spam_header
" that you're trying to match?

Hi,

I just wanted to know if it is possible to use the GUI to check for a character threshold greater than one in the subject header.

We are seeing subjects like: this_is_a_hundred_percent_spam_header

and would want to block this kind of messages.

Any idea?

thank you,

SergioC

aharkin11 · ‎06-03-2008

I'm not sure how to do it, but I'm guessing he's looking to look through the subjects for a certain number of underscores.

jackytime_ironport · ‎06-04-2008

I think regular expression can filter such subjects:
([a-zA-Z0-9]_){3,}
to match 3 or more occurrences of letter_.

Usually I put these rules in a dictionary badsubj, use message filter below:


        badsubj: if subject-dictionary-match("badsubj", 1) {
             quarantine ("Policy");
             deliver();
         }