Page 1 of 1
Date Spoofing
Posted: Thu Nov 21, 2019 12:34 am
by Roy124
Last few days I have received a new spam format. The message has a future date stamp of 31 Dec 2100. This immediately puts it at the top of any email listing with newest first. I haven't yet explored the spam functions in MW yet.
Any others seen this or suggest a good filter process?
Re: Date Spoofing
Posted: Thu Nov 21, 2019 1:02 am
by rusticdog
We don't look at the date for learning if I recall correctly.
You could try and filter on the year in the Date: field. This should work in theory.
If the HEADER, CONTAINS, REGEX
The
^Date: is looking for a line in the header that starts with Date:
The
.+ is looking for pretty much anything except a newline, this takes care of mentions of day, month etc..
The
\s2[1-9]\d\d\s is where \s looks for a space, followed by a 2, followed by any number not 0, followed by any two numbers \d, ending with a space.
Should match any year that isn't 20XX