That last regex:
(?:[a-z0-9]+_){5}
is SO simple, but appears to do what I'd need, at least until the spammers
change the tactics and start using other separators.
I'm all for finding another way to block these. The problem is that they
often come via public email servers like gmail or yahoo. It's not from a
whitelisted user, but the rest of the content and the ip info is fine. Any
ideas? I just don't know what ASSP would see about being bad about these
emails if we don't att the regex.
Thanks so much for taking the time again!
On Thu, Jul 21, 2011 at 1:55 AM, Thomas Eckardt
<Thomas.Eckardt@...:
> Ken,
>
> I think there is no easy way to get a regex that will catch all of these.
>
> (?ms-i:(?:[a-z0-9_\?+\-\$\%][A-Z][^\s]*?){4}[a-z0-9_\?+\-\$\%][A-Z])=>0.95
> or
> (?ms-i:(?:[a-z0-9_\?+\-\$\%][A-Z].*?){4}[a-z0-9_\?+\-\$\%][A-Z])=>0.95
>
> (the {4} marks the occurence) - the second variant will also match if
> there are somewhere spaces in the text - this could possibly match some
> good words (don't know!)
> The regexes are matching:
>
> HaveWordsWithNoSpacesInThem
> An_Example_For_5_Times_Your's_Truly
>
> But
>
> An_Example_is_a_word_Like_this
>
> has too less upper case characters for the regex above or is simply too
> short
>
> (?:[a-z0-9]+_){5}
>
> should do it. This will match anything like this :
> thIs_is_thE_way_it_g0e5_in_9miles where any character could be upper or
> lower case (the default in assp)
>
> How ever, I think you should try to find another way to catch these mails.
> It is too easy to break the regexes.
>
> Thomas
>
>
>
> Von: K Post <nntp.post@...>
> An: ASSP development mailing list <assp-test@...>
> Datum: 20.07.2011 17:58
> Betreff: [Assp-test] Regex Help to capture underscores replacing
> spaces
>
>
>
>
> I currently have a regex (coursey of this list) like this:
>
>
> (?ms-i:[a-z][A-Z].*?[a-z][A-Z].*?[a-z][A-Z].*?[a-z][A-Z].*?[a-z][A-Z].*?[a-z][A-Z])=>0.95
> which catches those irritating emails that HaveWordsWithNoSpacesInThem
> that
> try to get around filters.
>
> Now I'm getting mails with underscores insted of spaces:
> An_Example_is_a_word_Like_this
>
> and sometimes they've got numbers or other non-letter characters
> An_Example_For_5_Times_Your's_Truly
>
> I was thinking of changing the above regext to but could use advice...
>
> Thanks
>
> ------------------------------------------------------------------------------
> 10 Tips for Better Web Security
> Learn 10 ways to better secure your business today. Topics covered
> include:
> Web security, SSL, hacker attacks & Denial of Service (DoS), private keys,
> security Microsoft Exchange, secure Instant Messaging, and much more.
> http://www.accelacomm.com/jaw/sfnl/114/51426210/
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test
>
>
>
>
> DISCLAIMER:
> *******************************************************
> This email and any files transmitted with it may be confidential, legally
> privileged and protected in law and are intended solely for the use of the
>
> individual to whom it is addressed.
> This email was multiple times scanned for viruses. There should be no
> known virus in this email!
> *******************************************************
>
>
>
>
> ------------------------------------------------------------------------------
> 5 Ways to Improve & Secure Unified Communications
> Unified Communications promises greater efficiencies for business. UC can
> improve internal communications as well as offer faster, more efficient
> ways
> to interact with customers and streamline customer service. Learn more!
> http://www.accelacomm.com/jaw/sfnl/114/51426253/
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test
>
>
|