PDA

View Full Version : Content filter - Viagra



ICEWARP_BRAZIL
03-07-2011, 09:36 AM
This is an interesting filter. Using Regex, it detects message that have viagra written in an abnormal way, such as v1agra in subject or body. If written in correct way it doesnt filter, after all, anyone has the right to buy viagra or talk about it, hehe :)

The conditions are set to Regex. Its important for "Where message is less then 32 kbytes" to be the first item in the filter.

* Filter description

Where Message is < 32 kB
and (Where Subject: message header matches [vV][1lyY][aA@][gG69][rR][aA@]
or Where Message body matches [vV][1lyY][aA@][gG69][rR][aA@])
Stop processing more rules
and Forward to viagra-control@mydomain.com
and Edit message header (add x-viagra to header...)

* Code for importing

<FILTER>
<ACTIVE>0</ACTIVE>
<TITLE>Viagra</TITLE>
<READONLY>0</READONLY>
<CONDITION>
<AND>1</AND>
<LOGICALNOT>0</LOGICALNOT>
<EXPRESSION>2</EXPRESSION>
<CONTAINTYPE>8</CONTAINTYPE>
<MESSAGESIZESMALLER>1</MESSAGESIZESMALLER>
<MESSAGESIZE>32768</MESSAGESIZE>
</CONDITION>
<CONDITION>
<AND>1</AND>
<LOGICALNOT>0</LOGICALNOT>
<BRACKETSLEFT>1</BRACKETSLEFT>
<HEADERTYPE>2</HEADERTYPE>
<CONTAINTYPE>10</CONTAINTYPE>
<CONTAIN>[vV][1lyY][aA@][gG69][rR][aA@]</CONTAIN>
<MESSAGESIZESMALLER>0</MESSAGESIZESMALLER>
</CONDITION>
<CONDITION>
<AND>0</AND>
<LOGICALNOT>0</LOGICALNOT>
<BRACKETSRIGHT>1</BRACKETSRIGHT>
<HEADERTYPE>6</HEADERTYPE>
<CONTAINTYPE>10</CONTAINTYPE>
<CONTAIN>[vV][1lyY][aA@][gG69][rR][aA@]</CONTAIN>
<MESSAGESIZESMALLER>0</MESSAGESIZESMALLER>
</CONDITION>
<ACCEPT>0</ACCEPT>
<REJECT>0</REJECT>
<DELETE>0</DELETE>
<ENCRYPT>0</ENCRYPT>
<PRIORITY>0</PRIORITY>
<FLAGS>0</FLAGS>
<SCORE>0</SCORE>
<MARKSPAM>0</MARKSPAM>
<STOP>1</STOP>
<EXECUTE>0</EXECUTE>
<FORWARD>viagra-control@mydomain.com</FORWARD>
<TARPITSENDER>0</TARPITSENDER>
<FIXRFC822>0</FIXRFC822>
<SMTPRESPONSE>0</SMTPRESPONSE>
<STRIPALL>0</STRIPALL>
<HEADER>
<VAL>0F-Viagra
</VAL>
</HEADER>
</FILTER>

All the best,
Flvio