There used to be a nice set of regex for some common spam on the old server that we had, but that crashed and I wasn't able to recover the settings/regex. Would somebody be willing to share their regex?
If not, I wonder if this work if I add it to header_filter_rules:
ambien (?i)[a@/]+\\?.?m+.?[b8]+.?[i:1!\|]+.?[e3€]+.?n+\b anal (?i)\banal\b bulgary (?i)\b[b8].?[uv].?[li17\|].?[gq].?[a@/][\\]?r.?[yi1!:\|]? cheapest pills (?i)cheapest\spills cialis (?i)\bc.?[i1!:\|].?[a@/][\\]?.?[li17\|].?[i1!:\|].?[s235$] credit (?i)\bc.?r.?[e3€].?d.?[i1!:\|].?[t\+] discount (?i)\bd.?[i1!:\|].?[s235$].?c.?[oQ0].?[uv].?n.?[t\+]? ejaculation (?i)ejaculation enlargement (?i)enlargement levitra \b[LlIi17\|].?[Ee3].?[Vv\\][/]?.?[Ii1!:\|].?[Tt\+].?[Rr].?[Aa@/]?[\\]? (v nicht optional!) money (?i)\bm.?[oQ0].?n.?[e3€].?y mortgage \b[Mm].?[OoQ0].?[Rr].?[Tt\+].?[Ggq].?[Aa@/][\\]?.?[Ggq].?[Ee3€]? natural weight loss (?i)(natural\s)?weight(\s)?loss omega \b[OoQ0].?[Mm].?[Ee3€].?[Ggq].?[Aa@/][\\]? online pharmacy (?i)online\spharmacy penis (?i)\bp+.?[e3€]+.?n+.?[i1!:\|]+.?[s5$]+\b pharmaceuticals (?i)pharmaceuticals porno (?i)\bp.?[oQ0].?r.?n.?[oQ0]? premature (?i)premature prescription (?i)prescription refinance \b[Rr].?[Ee3€].?[Ff].?[Ii1!:\|].?[Nn].?[Aa@/][\\]?.?[Nn].?[CcZz].?[Ee3€]? rolex \b[Rr].?[OoQ0].?[LlIi17\|].?[Ee3€].?[Xx] sex \b[Ss25$].?[Ee3€].?[Xx].?[Yy]?\b soma [Ss25$].?[OoQ0].?[Mm].?[Aa]?\b oder \b[Ss25$].?[OoQ0].?[Mm].?[Aa/][\\]?\b src=3D"cid: src=3D"cid: src="cid: src="cid: valium (?i)[v\\]+/?.?[a@/]+\\?.?[li17\|]+.?[il1!:\|]+.?[uv]+.?m+\b xanax \b[Xx].?[Aa@/][\\]?.?[Nn].?[Aa@/][\\]?.?[Xx]? X-Spam-Level: ******** X-Spam-Level:\s\*{8,30} **** SPAM **** (?i)\*{1,6}spam\*{1,6}
On 09/18/2014 07:21 AM, James Nightly wrote:
There used to be a nice set of regex for some common spam on the old server that we had, but that crashed and I wasn't able to recover the settings/regex. Would somebody be willing to share their regex?
If not, I wonder if this work if I add it to header_filter_rules:
ambien (?i)[a@/]+\\?.?m+.?[b8]+.?[i:1!\|]+.?[e3€]+.?n+\b
Assuming you want to look for some varient of ambien in the message Subject: header, You want something like
^Subject:.*[a@/]+\\?.?m+.?[b8]+.?[i:1!\|]+.?[e3€]+.?n+\b
at least assuming that's the regexp you want. You don't need (?i) because these regexps are matched case insensitively.
Of course, you could just use
[a@/]+\\?.?m+.?[b8]+.?[i:1!\|]+.?[e3€]+.?n+\b
as the regexp if you want to look for it anywhere in the messages headers.
...
src=3D"cid: src=3D"cid: src="cid: src="cid:
These look like you want to match something in an HTML body part. header_filter_rules looks only at headers. Maybe content filtering is something you want here or maybe matching on something in a Content-Type: header
X-Spam-Level: ******** X-Spam-Level:\s\*{8,30}
And this one should probably be
^X-Spam-Level:\s\*{8,30}
or just
^X-Spam-Level:\s\*{8,}
if you don't want to miss >30 stars
**** SPAM **** (?i)\*{1,6}spam\*{1,6}
maybe
\*{1,6}\s*spam\s*\*{1,6}
-- Mark Sapiro mark@msapiro.net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
James Nightly wrote:
There used to be a nice set of regex for some common spam on the old server that we had, but that crashed and I wasn't able to recover the settings/regex. Would somebody be willing to share their regex?
It is generally much more effective to use tools like Spamassassin at the MTA level to stop spam from getting to Mailman in the first place.
It is also possible to invoke Spamassassin in the handler pipeline within Mailman. See https://bugs.launchpad.net/mailman/+bug/266588.
-- Mark Sapiro mark@msapiro.net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
participants (2)
-
James Nightly
-
Mark Sapiro