Stopping messages with the "Re: ??" Subject

[James Gray]

On 16/08/2006, at 1:27 PM, Chris Hammond wrote:

> The MailScanner server that I maintain get's hit with 3k-5k of of  
> these messages a day.  They are all spam and the subject is in the  
> form of the Re: with a space and two letters.  The first letter can  
> be any from a to z, while the second letter is either a e i o u or  
> y.  I created the following rule as a Postfix header check as I  
> want to flat out reject these messages.
>
> /^Subject: (Re: [a-z][aeiouy])/ REJECT Spam 30-25.    -    First  
> attempt
> /^Subject: Re: [a-z][aeiouy]/ REJECT Spam 30-25.      -    Second  
> attempt
> /^Subject: (Re:) [a-z][aeiouy]/ REJECT Spam 30-25.    -    Third  
> attemp
>
> The problem that I am having is that it doesn't stop after the two  
> letters.  If a word after Re: that matches one of the two letter  
> combinations comes up, it fires on that also.  What am I doing  
> wrong with the rule.  I only want it to fire on the Re: and the two  
> letters.  Nothing more.
>
> Thanks
> Chris

Have you tried anchoring the regex to match the end of the line:
/^Subject: Re: [a-z][aeiouy]$/ REJECT Spam 30-25

Or maybe even anchor after an arbitary amount of white space (and  
only white space):
/^Subject: Re: [a-z][aeiouy]\s*$/ REJECT Spam 30-25

"$" is a special character in both POSIX and Perl regex which means  
"end of line".

Maybe that will help?

Cheers,

James


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2440 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20060816/f0b43b82/smime.bin