[Mimedefang] filters for subject content

Andrew Jayes andrew.jayes at visitheartofengland.com
Mon Feb 9 10:54:48 EST 2004


Hi,
	I would like to set some filters to look at the subject line of an email. I have found some codes on a spam assassin webpage and would like to know where I would paste them in to the mimedefang filter (that's if they are in the correct format to work).

Code:

################################################################################### Subject #####
header Y_SUBJ_RE_RANDOM_TEXT	Subject =~ /Re: [A-Z]{2,},(?: [a-z]+!?)+/
describe Y_SUBJ_RE_RANDOM_TEXT	Fishy subject Re: CAPS, lowercase nonsense

header Y_SUBJ_PRIVATE_DOT	Subject =~ /^Private\.$/
describe Y_SUBJ_PRIVATE_DOT	Subject is `Private.'

header Y_SUBJ_ONLY_BUCKS	Subject =~ /\bonly \$[0-9]+/i
describe Y_SUBJ_ONLY_BUCKS	Subject contains `only $nnn'

header Y_SUBJ_PARIS_HILTON	Subject =~ /\bparis hilton\b/
describe Y_SUBJ_PARIS_HILTON	Subject contains `paris hilton'

header Y_SUBJ_EMPTY		Subject =~ /^\s*$/
describe Y_SUBJ_EMPTY		Subject is empty

header Y_SUBJ_EMPTY_RE		Subject =~ /^Re:\s*$/i
describe Y_SUBJ_EMPTY_RE	Subject is empty Re:

header Y_SUBJ_WEIGHT_OBF	Subject =~ /\bwe;ght\b/
describe Y_SUBJ_WEIGHT_OBF	Subject contains obfuscated `weight'

header Y_SUBJ_VIAGRA_OBF	Subject =~ /\bV[l|;ií!].?[aáä@]g.?r.?[aáä@]/i
describe Y_SUBJ_VIAGRA_OBF	Subject contains possibly obfuscated `Viagra'

header Y_SUBJ_XANAX_OBF		Subject =~ /\bX(a|@|\(a\))n[a@]x/i
describe Y_SUBJ_XANAX_OBF	Subject contains possibly obfuscated `Xanax'

# XXX: doesn't work, it's decoded by sa
# anyway, we need a check for any encoded subject that is in fact ascii
#header Y_SUBJ_LATIN1_B64	Subject =~ /^=\?iso-8859-1\?b\?[^=]+=*\?=$/i
#describe Y_SUBJ_LATIN1_B64	Subject is BASE64 encoded ISO-8859-1

# vim: set ts=8 sw=8 noet :



so what do you think? Will this work in the mimedefang filter? And where in the filter would I paste it in?

cheers

andi



More information about the MIMEDefang mailing list