>\d\s+(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d\d\d\d\s+\d\d:\d\d(:\d\d)?\s+[+\-]\d\d[6-9]\d
>
>which matches:
>
>Received: from exchange.sender.local ([173.193.xxx.xxx]
> helo=AFC-exchange.sender.local) by assp.myserver.com with ESMTP
> (ASSP 1.9); 22 Apr 2014 10:14:32 -0700
No, this will not match!
it will match, for example
22 Apr 2014 10:14:32 -0760
22 Apr 2014 10:14:32 -0770
22 Apr 2014 10:14:32 -0780
22 Apr 2014 10:14:32 -0790
Thomas
Von: aklist <aklist_e...@enigmedia.com>
An: assp-user@lists.sourceforge.net,
Datum: 24.04.2014 15:05
Betreff: [Assp-user] Bomb Regex in Header matching date string
Hi All: I have an implementation of ASSP (1.9.3.4 (1.0.0.4)) that
someone preconfigured with some "starter rules".
In my Regex / Bombs section, there's the following regex in the "Rgex to
Identify Spam in Header Part" section:
\d\s+(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d\d\d\d\s+\d\d:\d\d(:\d\d)?\s+[+\-]\d\d[6-9]\d
which matches:
Received: from exchange.sender.local ([173.193.xxx.xxx]
helo=AFC-exchange.sender.local) by assp.myserver.com with ESMTP
(ASSP 1.9); 22 Apr 2014 10:14:32 -0700
The above header was from a legitimate email, where the additional
points from the regex match were enough to push it into the spam pile.
I'm just wondering if this regex is necessary, given that legitimate
email frequently has a date in the received header?
I realize I can change the rule from "score" to "monitor" and see how
often it occurs, but I see this date-matching regex also appears in the
bombsubjectre file and bombre file.
Thanks for any insights!
------------------------------------------------------------------------------
Start Your Social Network Today - Download eXo Platform
Build your Enterprise Intranet with eXo Platform Software
Java Based Open Source Intranet - Social, Extensible, Cloud Ready
Get Started Now And Turn Your Intranet Into A Collaboration Platform
http://p.sf.net/sfu/ExoPlatform
_______________________________________________
Assp-user mailing list
Assp-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-user
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally
privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
------------------------------------------------------------------------------
Start Your Social Network Today - Download eXo Platform
Build your Enterprise Intranet with eXo Platform Software
Java Based Open Source Intranet - Social, Extensible, Cloud Ready
Get Started Now And Turn Your Intranet Into A Collaboration Platform
http://p.sf.net/sfu/ExoPlatform
_______________________________________________
Assp-user mailing list
Assp-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-user
