[Mimedefang] filters for subject content
Andrew Jayes
andrew.jayes at visitheartofengland.com
Mon Feb 9 10:54:48 EST 2004
Hi,
I would like to set some filters to look at the subject line of an email. I have found some codes on a spam assassin webpage and would like to know where I would paste them in to the mimedefang filter (that's if they are in the correct format to work).
Code:
################################################################################### Subject #####
header Y_SUBJ_RE_RANDOM_TEXT Subject =~ /Re: [A-Z]{2,},(?: [a-z]+!?)+/
describe Y_SUBJ_RE_RANDOM_TEXT Fishy subject Re: CAPS, lowercase nonsense
header Y_SUBJ_PRIVATE_DOT Subject =~ /^Private\.$/
describe Y_SUBJ_PRIVATE_DOT Subject is `Private.'
header Y_SUBJ_ONLY_BUCKS Subject =~ /\bonly \$[0-9]+/i
describe Y_SUBJ_ONLY_BUCKS Subject contains `only $nnn'
header Y_SUBJ_PARIS_HILTON Subject =~ /\bparis hilton\b/
describe Y_SUBJ_PARIS_HILTON Subject contains `paris hilton'
header Y_SUBJ_EMPTY Subject =~ /^\s*$/
describe Y_SUBJ_EMPTY Subject is empty
header Y_SUBJ_EMPTY_RE Subject =~ /^Re:\s*$/i
describe Y_SUBJ_EMPTY_RE Subject is empty Re:
header Y_SUBJ_WEIGHT_OBF Subject =~ /\bwe;ght\b/
describe Y_SUBJ_WEIGHT_OBF Subject contains obfuscated `weight'
header Y_SUBJ_VIAGRA_OBF Subject =~ /\bV[l|;ií!].?[aáä@]g.?r.?[aáä@]/i
describe Y_SUBJ_VIAGRA_OBF Subject contains possibly obfuscated `Viagra'
header Y_SUBJ_XANAX_OBF Subject =~ /\bX(a|@|\(a\))n[a@]x/i
describe Y_SUBJ_XANAX_OBF Subject contains possibly obfuscated `Xanax'
# XXX: doesn't work, it's decoded by sa
# anyway, we need a check for any encoded subject that is in fact ascii
#header Y_SUBJ_LATIN1_B64 Subject =~ /^=\?iso-8859-1\?b\?[^=]+=*\?=$/i
#describe Y_SUBJ_LATIN1_B64 Subject is BASE64 encoded ISO-8859-1
# vim: set ts=8 sw=8 noet :
so what do you think? Will this work in the mimedefang filter? And where in the filter would I paste it in?
cheers
andi
More information about the MIMEDefang
mailing list