[Mailman-Users] Regex for spam

[Mark Sapiro]

On 09/18/2014 07:21 AM, James Nightly wrote:
> There used to be a nice set of regex for some common spam on the old
> server that we had, but that crashed and I wasn't able to recover the
> settings/regex. Would somebody be willing to share their regex?
> 
> If not, I wonder if this work if I add it to header_filter_rules:
> 
> ambien (?i)[a@/]+\\?.?m+.?[b8]+.?[i:1!\|]+.?[e3€]+.?n+\b


Assuming you want to look for some varient of ambien in the message
Subject: header, You want something like

^Subject:.*[a@/]+\\?.?m+.?[b8]+.?[i:1!\|]+.?[e3€]+.?n+\b

at least assuming that's the regexp you want. You don't need (?i)
because these regexps are matched case insensitively.

Of course, you could just use

[a@/]+\\?.?m+.?[b8]+.?[i:1!\|]+.?[e3€]+.?n+\b

as the regexp if you want to look for it anywhere in the messages headers.

...
> src=3D"cid: src=3D"cid:
> src="cid: src="cid:

These look like you want to match something in an HTML body part.
header_filter_rules looks only at headers. Maybe content filtering is
something you want here or maybe matching on something in a
Content-Type: header


> X-Spam-Level: ******** X-Spam-Level:\s\*{8,30}

And this one should probably be

^X-Spam-Level:\s\*{8,30}

or just

^X-Spam-Level:\s\*{8,}

if you don't want to miss >30 stars


> **** SPAM **** (?i)\*{1,6}spam\*{1,6}

maybe

\*{1,6}\s*spam\s*\*{1,6}

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan