Is it safe to block using this filter?

[mychrislo]

We regular see subject with

V|AGRA

or

Rep|icateWatch

Is it safe to use them in the simple subject filtering?

Do I have to escape the "|" which sometimes treated as "Or" in many regex case

e.g.

subject  == "(?i)V|AGRA"

Will I be dropping more than I anticipated?

[Tze Tai Mak]

Are you looking at catching spams?

If you enable IronPort antispam engine, most of the spams should be blocked/tagged/quarantined already. You can report the missing spams to spam@access.ironport.com and also follow the Knowledgebase on "IronPort Anti-spam efficacy checklist"

It is not effective to rely on keyword dictionary.

Your regular expression 'V|AGRA' will catch V and also AGRA. You should use 'V\|AGRA' instead. However, you may find that spammers will keep changing their wordings like ' V I A G R A', 'V!AGRA', etc. and then you need to update your keyword again.

You can test regular expression in http://www.regexlib.com/RETester.aspx and you can find the cheat sheet from the left column.