Body filtering
From CastleCopsWiki
|
MailWasher Pro Index
|
[edit] Strategies for body filtering
There are many strategies for body filtering, some are very simple to implement and are basically cut and paste from the incoming message body. This class of filter works best for legitimate e-mail or for e-mail that contains simple spammer errors.
Filter Syntax is explained at this link.
You can exit MWP and copy these filters directly into your filters.txt file using notepad or another plain ASCII editor. The filters.txt file can be found by clicking on Help, then About and then the link near the bottom of the box.
[edit] Detecting typical Spam errors
This first example identifies messages based on common errors spammers make in configuring their spam generating software.
It is [enabled],
the filter name is: "Spammer Tags",
the status message is "Spammer Tags",
the status message will display with the color 8388863, color_code_explained
the conditions below will be ORed
the message is set to be deleted "Delete",
it is looking for any of the text below in the body of the message:
- Get a capable html e-mailer
- %RND_TXT[3-6]
- %MAKE_TXT[3-6]
- your mailer do not support HTML
- %RND_INTRO
[enabled],"Spammer Tags","Spammer Tags",8388863,OR,Delete,Body,contains,==
=="Get a capable html e-mailer",Body,contains,%RND_TXT[3-6],Body,contains,==
==%MAKE_TXT[3-6],Body,contains,"Your mailer do not support HTML ",==
==Body,contains,%RND_INTRO
This one is a bit more complex only because the search is on a regular expression instead of text. In this case the regular expression is ".........." which translated to English is any ten letters, numbers or spaces. So this filter will fire on any message that has less than 10 letters in the subject AND the body has less than 10 letters
[enabled],"Body and Subject does not contain more than 10 letters",==
=="Less than 10 letters",7289541,AND,Delete,noreport,==
==Body,doesn'tContainRE,..........,Subject,doesn'tContainRE,..........
[edit] Encoded Message
Back to Filter Strategies
