Logout

Alt-N Discussion Groups > MDaemon Discussion Groups > MDaemon Content Filter > Help to configure a specific content filter

 [F] Alt-N Discussion Groups  / MDaemon Discussion Groups  / MDaemon Content Filter  /

Help to configure a specific content filter

[Johnston, Ian]
Ian Johnston
Newbie
Newbie
Posts: 6
Ian Johnston - 08:52am, Apr 17 2015

Hi,

I am getting a LOT of spam that seem to follow the same format in the message body.

So here are 3 examples, and what I would like to do is set up a content filter to delete messages in this format. Note the following:-

Line 1 = first 5 chars are within ascii 65 to 122
Line 2 = first 5 chars are outside of ascii 65 to 122
Line 3 = first 5 chars are within ascii 65 to 122
Line 4 = first 5 chars are outside of ascii 65 to 122
Line 5 = first 5 chars are within ascii 65 to 122
Line 6 = first 5 chars are outside of ascii 65 to 122

Any ideas if this can be filtered? I am guessing regular expressions would be a start!

Ian.

Example 1:-
Personal Record Investigation
--------------------------------------------------
Background # 22790292
############################################
Verify by Apr. 17, 2015
==========================================================

Example 2:-
University Memory Study
==========================================================
Now You Can Treat Memory-Loss
===========================================
Volume # 8157661
-------------------------------------------------------

Example 3:-
Adorable Japanese Ladies Looking for Single American Guys
_______________________________________________
Connect Free Today
#############################################
Invite: 12286839
===============================================

  All MessagesOldest ItemsOlder ItemsNewer ItemsNewest Items

Jay Tolbert - Apr 20, 2015 8:43 am (#1 Total: 1)  

 

Photo of Author
Jay Tolbert
Guru
Guru
Posts: 2813

MDaemon
RelayFax
SecurityPlus
WebAdmin
I created a spam filter as opposed to content filter rule but the
spammer's didn't cooperate and send me anything in that format over the
weekend.

The following is my spam filter rule:

rawbody MY_SIXLINESPAM
/.*\n[*!#_=+.-]*\n.*\n[*!#_=+.-]*\n.*\n[*!#_=+.-]*\n/
describe MY_SIXLINESPAM Has six line format
text-sep-text-sep-text-sep
score MY_SIXLINESPAM 0.1

You should be able to use the regular expression in the content filter.
I assume the content filter supplies the whole message body so the
newline checks will work.

Deciphering the regular expression:

/ - starts the expression
.* - match any string of any characters (odd lines)
\n - match a newline
[*!#_=+.-]* - match a string of any length of characters in between [
and ] (even lines), note the - (dash/hyphen) must be last (or first) or
it gets interpreted as a range separator and not a literal character
\n - another newline
repeat the above from the second line twice more for lines 3-6
/ - ends the expression

Based on online regular expression tester https://regex101.com/ the
above matches the message bodies you are seeing.

Jay Tolbert
Dickerson Engineering, Inc.

On 4/17/2015 8:52 AM, Ian Johnston wrote:
> Hi,
>
> I am getting a LOT of spam that seem to follow the same format in the
> message body.
>
> So here are 3 examples, and what I would like to do is set up a
> content filter to delete messages in this format. Note the following:-
>
> Line 1 = first 5 chars are within ascii 65 to 122
> Line 2 = first 5 chars are outside of ascii 65 to 122
> Line 3 = first 5 chars are within ascii 65 to 122
> Line 4 = first 5 chars are outside of ascii 65 to 122
> Line 5 = first 5 chars are within ascii 65 to 122
> Line 6 = first 5 chars are outside of ascii 65 to 122
>
> Any ideas if this can be filtered? I am guessing regular expressions
> would be a start!
>
> Ian.
>
> Example 1:-
> Personal Record Investigation
> --------------------------------------------------
> Background # 22790292
> ############################################
> Verify by Apr. 17, 2015
> ==========================================================
>
> Example 2:-
> University Memory Study
> ==========================================================
> Now You Can Treat Memory-Loss
> ===========================================
> Volume # 8157661
> -------------------------------------------------------
>
> Example 3:-
> Adorable Japanese Ladies Looking for Single American Guys
> _______________________________________________
> Connect Free Today
> #############################################
> Invite: 12286839
> ===============================================




  All MessagesOldest ItemsOlder ItemsNewer ItemsNewest Items



 Content:

Read New | Search

 Guest:

Email to Admin



You are visiting as a Guest user.