scanning $subject for multiple occurrences of a character

[Sergio]

Hi,

I just wanted to know if it is possible to use the GUI to check for a character threshold greater than one in the subject header.

We are seeing subjects like: this_is_a_hundred_percent_spam_header

and would want to block this kind of messages.

Any idea?

thank you,

SergioC

[kluu_ironport]

Can you clarify on what you mean by "character threshold greater than one in the subject header" ?

when you say mulitple occurrence of a character, do you mean a repeat like "testssss" where the "s" is repeating?

What is it about this subject, " this_is_a_hundred_percent_spam_header
" that you're trying to match?

Hi,

I just wanted to know if it is possible to use the GUI to check for a character threshold greater than one in the subject header.

We are seeing subjects like: this_is_a_hundred_percent_spam_header

and would want to block this kind of messages.

Any idea?

thank you,

SergioC

[aharkin11]

I'm not sure how to do it, but I'm guessing he's looking to look through the subjects for a certain number of underscores.

[jackytime_ironport]

I think regular expression can filter such subjects:
([a-zA-Z0-9]_){3,}
to match 3 or more occurrences of letter_.

Usually I put these rules in a dictionary badsubj, use message filter below:

        badsubj: if subject-dictionary-match("badsubj", 1) {
             quarantine ("Policy");
             deliver();
         }