Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Connect » Need a regular expression for a spam rule
  •  
brandon@technico.us

Messages: 27
Karma: 0
Send a private message to this user
Does anyone know how to create a regular expression for 3+ rows of one periods?

I'm getting this wave of spam, and each message in the wave has lines like this in the body:

.
.
.
.
.
.
.

Thanks for any advice.
  •  
MarkK

Messages: 454
Karma: 46
Send a private message to this user
I believe that this should work:
\.\r\n\.\r\n\.\r\n

That should be a "." followed by a newline.

Put a rule in place and send a test message to see if it hits.
  •  
brandon@technico.us

Messages: 27
Karma: 0
Send a private message to this user
Thanks MarkK, I gave that a try -- sure seems like it should work, but the spam with the dots still comes right through, and the rule appears as "Unused" in the "Last Used Before" column.
  •  
MarkK

Messages: 454
Karma: 46
Send a private message to this user
These work in Spam Assassin's rule sets, so the logic in the regex expression is correct now.

As long as the message comes through as an HTML one

rawbody lcl_testdots /(\<br\>\.\<br\>\.\<br\>\.\<br\>)/i
score lcl_testdots 0.1


This one works for messages that are plain text

rawbody lcl_testdots /(\.\n\.\n\.)/i
score lcl_testdots 0.1
  •  
brandon@technico.us

Messages: 27
Karma: 0
Send a private message to this user

Success!

These messages were hitting me as plain text, and your second regular expression above is catching them.

Thanks so much!
  •  
MarkK

Messages: 454
Karma: 46
Send a private message to this user
Your welcome... I guess. Now I'M getting the spams with the dots in it. Going to have to implement this rule myself.
  •  
brandon@technico.us

Messages: 27
Karma: 0
Send a private message to this user

Oh no!

Well, at least you had a head start on the solution.

Thanks again,
Previous Topic: since upgrade to 8.5.2 mail web content not responding
Next Topic: Email from Microsoft Office 2013
Goto Forum:
  


Disclaimer:
Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Wed Aug 23 00:38:26 CEST 2017

Total time taken to generate the page: 0.00443 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.