Regex question

[Craig Daters]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I am using a dynamic IP block list with SpamAssassin, but the baysian 
probability on these messages are so low that a negative score is being 
attached. When the score for the dynamic list is applied, it is below 
my threshold still, so I am trying to intercept these messages before 
they make it MailScanner. Or maybe I can Isolate these specifically and 
up the score for these specifically for anything that matches these 
expressions?

On Jun 27, 2005, at 3:02 PM, Rick Cooper wrote:

>> -----Original Message-----
>> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
>> Behalf Of Craig Daters
>> Sent: Monday, June 27, 2005 4:45 PM
>> To: MAILSCANNER at JISCMAIL.AC.UK
>> Subject: OT: Regex question
>>
>>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> My grasp of regex is very rudimentary at best, and I am trying to
>> construct an expression that will hit every instance of these kinds of
>> lines:
>>
>> pool-141-154-180-187.wma.east.verizon.net
>
> /^pool.*?\.verizon\.net/i
>
> Would catch "poolanythingatall.verizon.net"
> So would using a dynamic IP block list, IIRC pool-ipnumber is a verizon
> dialup
>
> Where are you trying to catch this? MTA level or something between MS 
> and
> the MTA?
>
> Rick
>
>>
>> So in this instance, I would like to know how to construct the 
>> instance
>> to find anything that starts with "pool" and ends with "verizon.net". 
>> I
>> don't care what everything else in between might be.
>>
>> Our users have been getting inundated with email purporting to be from
>> my companies "support" team (which is me, btw) informing them that
>> their email accounts are about to be suspended, or that their account
>> details have been updated, to "please verify the details contained in
>> the attached file."
>>
>> I am attempting to kludge together a means to capture these messages
>> before MailScanner processes them and issues warnings and just send
>> them to /dev/null or something similar. They are all coming from
>> Verizon's "pool".
>>
>>
>> - ---
>> Craig Daters (craig at westpress.com)
>> Systems Administrator
>>
>> West Press
>> 1663 West Grant Road
>> Tucson, Arizona 85745
>>
>> (520) 624-4939 x208
>> (520) 624-2715 fax
>> www.westpress.com
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: PGP 8.1
>>
>> iQA/AwUBQsBzZBBVT8XLuTbnEQIxGwCbB410oB02z0lDCRiGDTvxLHjeD5AAoMMP
>> RNMKYEFviqppzRnZ6xDv3Xtu
>> =z6b3
>> -----END PGP SIGNATURE-----
>>
>>
>> --
>> Please note: It is the policy of West Press that all e-mail
>> sent to and from any @westpress.com address may be recorded
>> and monitored. Unless it is West Press related business,
>> please do not send any material of a private, personal,
>> or confidential nature to this or any @westpress.com
>> e-mail address.
>>
>> This message has been scanned for UCE (spam), viruses,
>> and dangerous content, and is believed to be clean
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>> --
>> This message has been scanned for viruses and
>> dangerous content by MailScanner, and is
>> believed to be clean.
>>
>>
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>
- ---
Craig Daters (craig at westpress.com)
Systems Administrator

West Press
1663 West Grant Road
Tucson, Arizona 85745

(520) 624-4939 x208
(520) 624-2715 fax
www.westpress.com

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQsB6wRBVT8XLuTbnEQLMZwCgity+ABC3XctpAgcy/zUuqPreuM4AoJzi
g22pEWrZU8nWfrtEMluuqbrD
=Ht78
-----END PGP SIGNATURE-----


--
Please note: It is the policy of West Press that all e-mail
sent to and from any @westpress.com address may be recorded
and monitored. Unless it is West Press related business,
please do not send any material of a private, personal,
or confidential nature to this or any @westpress.com
e-mail address.

This message has been scanned for UCE (spam), viruses,
and dangerous content, and is believed to be clean 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!