creating rules

[Philip Hachey]

I use the following rules myself for the same purpose:

header   PJH_BRK_NUM Subject =~ /^(re)*\s*\[\d*\]/i
describe PJH_BRK_NUM Subject begins with a bracketed number
score    PJH_BRK_NUM 3.0

This matches the handful of permutations I've seen of this sort of spam: a 
subject line beginning with (or without) any number of (case insensitive) 
"re", followed by zero or more spaces, followed by "[", followed by zero 
or more digits, followed by "]".  This effectively matches subject lines 
starting with things like "[1]", "re [1]", "Re[1]", "reRe     [324]", etc.

The asterisk means "zero or more occurrences of the preceding pattern". 
The combination ".*" effectively matches anything.

----------------------------------
Philip J. Hachey, BCS(High Hons)
Programmer-Analyst
City of Cornwall

----- Message from Jon Miller <jlmiller at MMTNETWORKS.COM.AU> on Thu, 29 Sep 
2005 06:26:01 +0800 -----
Subject:
creating rules
I need to create a rule where if the subject has Re[1]: or any number 
between the [] that it is picked up as spam.  How do I create the header 
so that it's a single entry yet works for any number from a blank [] to 
any character? 
Does the * works and means anything?

ex:
# 15 Subject: Re[1]:
header PROLO_GSPAM15 Subject =~ /Re[*]:/i
score PROLO_GSPAM15 8
describe PROLO_GSPAM15 Spam - custom rule set

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!