Hi,
I would like to set some filters to look at the subject line of an email. I
have found some codes on a spam assassin webpage and would like to know where I would
paste them in to the mimedefang filter (that's if they are in the correct format to
work).
Code:
###################################################################################
Subject #####
header Y_SUBJ_RE_RANDOM_TEXT Subject =~ /Re: [A-Z]{2,},(?: [a-z]+!?)+/
describe Y_SUBJ_RE_RANDOM_TEXT Fishy subject Re: CAPS, lowercase nonsense
header Y_SUBJ_PRIVATE_DOT Subject =~ /^Private\.$/
describe Y_SUBJ_PRIVATE_DOT Subject is `Private.'
header Y_SUBJ_ONLY_BUCKS Subject =~ /\bonly \$[0-9]+/i
describe Y_SUBJ_ONLY_BUCKS Subject contains `only $nnn'
header Y_SUBJ_PARIS_HILTON Subject =~ /\bparis hilton\b/
describe Y_SUBJ_PARIS_HILTON Subject contains `paris hilton'
header Y_SUBJ_EMPTY Subject =~ /^\s*$/
describe Y_SUBJ_EMPTY Subject is empty
header Y_SUBJ_EMPTY_RE Subject =~ /^Re:\s*$/i
describe Y_SUBJ_EMPTY_RE Subject is empty Re:
header Y_SUBJ_WEIGHT_OBF Subject =~ /\bwe;ght\b/
describe Y_SUBJ_WEIGHT_OBF Subject contains obfuscated `weight'
header Y_SUBJ_VIAGRA_OBF Subject =~ /\bV[l|;[EMAIL PROTECTED]@]/i
describe Y_SUBJ_VIAGRA_OBF Subject contains possibly obfuscated `Viagra'
header Y_SUBJ_XANAX_OBF Subject =~ /\bX(a|@|\(a\))[EMAIL PROTECTED]/i
describe Y_SUBJ_XANAX_OBF Subject contains possibly obfuscated `Xanax'
# XXX: doesn't work, it's decoded by sa
# anyway, we need a check for any encoded subject that is in fact ascii
#header Y_SUBJ_LATIN1_B64 Subject =~ /^=\?iso-8859-1\?b\?[^=]+=*\?=$/i
#describe Y_SUBJ_LATIN1_B64 Subject is BASE64 encoded ISO-8859-1
# vim: set ts=8 sw=8 noet :
so what do you think? Will this work in the mimedefang filter? And where in the filter
would I paste it in?
cheers
andi
_______________________________________________
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
