* Noel Jones wrote :
> On 4/27/2011 6:17 AM, Troy Piggins wrote:
> >Hi there. I'm noticing lately most of the spam that gets through my
> >postgrey/postfix/amavis/spamassassin/procmail rules contains subject
> >lines that are extremely long strings with no spaces in them. eg:
> >
> >Subject:
> >DownloadLaetstMMiicrosoftAndAppleSotftawreAndSaveThouasadnds.ApprvoedLicecnseddS
> >
> >They do seem to have non-alnum chars such as ?-. etc. Just no
> >spaces.
> >
> >I'm thinking there must be a header check with pcre on Subject that
> >could catch these. Been googling but can't find anyone that seems
> >to mention this. Might be my poor search term selection?
> >
> >Any suggestions?
>
> regexp and pcre compatible expression:
>
> /^Subject: +[^[:space:]]{60}/ REJECT no spaces
Thanks mate. That works beautifully. One minor improvement. I
think your quantifier there matches /exactly/ 60 non whitespaces. I
added a comma after it to specify at least instead. I also reduced
the number to 40. I reckon it could come down even more to 20 or
so, but will start conservatively.
/^Subject: +[^[:space:]]{40,}/ REJECT no spaces
> matches Subject: followed by one or more spaces, followed by 60 or
> more non-space characters.
>
> Caution: this has not been tested for safety -- I have no idea of
> the likelihood of this matching legit mail. You might want to use
> WARN instead of REJECT for a while.
Thanks again. I did test first and works fine. Now implemented :)
--
Troy Piggins
