This must have been asked many times before, but I can't seem to find a satisfactory answer:

How does one filter to remove disguised words in the e-mail header like these:

ama<jerjtkelflgh>zing pr<rjrbryyi>ofit margin

I've concocted the following, but it seems rather clumsy.

(am.{2,16}ng|pr.{2,16}t margin).{1,10}(am.{2,16}ng|pr.{2,16}t margin)

Is there a better way of tackling this stuff?

TIA!

Sorry, that was me; I forgot to log in...

_________________
Tony CLSID List

I said "header" but I believe I meant "body" (or did I... )

_________________
Tony CLSID List

This has come up before, and the solution I came up would work in Perl but not MWP whose RegExp syntax is merely a subset of Perl's. Even so, the Perl solution was unwieldy because it required a RegExp with a list of all valid HTML tags.

One thing that might help is another type of filter that looks for the occurance of five or more consonants in a row, which Gary suggested a few weeks ago. The RegExp rule looks something like this (untested):
[bcdfghjklmnpqrstvwxz]{5,}

This is also an effective rule to apply to domain names and subjects.

Unfortunately, most invalid tags tend to be only a few characters long.

Please read the posts in this thread for more ideas.

HTH

What about a function like PHP's stip_tags? This will strip out all html tags (everything between < and >) and leave the rest as plain text. Any filter to be applied after stripping the tags.

Jerry

It seemed in the ones I was getting, all the crazy tags in the middle of words began with an exclaimation point. When I filter for "<!" it catches them.

But then you have to search for "<!", which is the beginning of a remark tag. In any html message this can happen. I want to filter out "viagra", which is hard when people write "v<blah>iagra" and "vi<blah>agra".

Jerry

Right, forgot the forum takes html tags...
I meant this: I want to filter out "viagra", which is hard when people write "v<blah>iagra" and "vi<blah>agra" and every other combination.

Jerry

Thanks for the suggestions, TimeGhost.

Much appreciated!

_________________
Tony CLSID List

Gary's HTML Tags filter also would help, as then you don't need to come up with an expression for every different keyword you want to filter for

So if the Body RegEx
((<![\w\s,\.\-]+>)([\w\s,\.\-]){1,10}){3,}
Delete/Bounce...whatever.....

Ask Gary though if you need an example of how this filter works, try as I might I get lost

You might want to try the whole "HTML Spam Tricks" filter. Here's the latest one I've been working with:

If Firetrust were to implement a scoring system, that might eliminate the need for your probability check.

Actually, that will be coming in the future in the form of Bayesian filtering!