Firetrust Support Forums

I have a class of email that I would like to filter, but I don't think I can write a filter.

The emails come from one of the large email providers like Hotmail or Yahoo, but I have also gotten then from smaller email services as well.

The subject is usually in the form of a question, but can be either just a statement or blank. If it is just a statement, it is always misspelled.

The body of the email is ALWAYS three lines. The first line contains a hyperlink of some kind, and some kind of text. The other two lines are text only.

The text is always nonsensical.

For instance one I just got had this in the body (I broke the link).

hxxp://rchjbyji.convenedworkingf.info/ When her first and easy to accomplish
Cried to him live with lieutenant butzow. Just now as possible to feel that
Both he whispered in surprise

The format of the body is the only consistent thing about these emails. The link is always different, and the text is always different. A couple times I recieved two emails from the same email address, but the link and the text was different.

Can anyone see of a way to write a filter for this kind of email?

Use Regex code to look for any three line message? If you need additional filtering you could look for the link too.

http://www.regexlab.com/en/deelx/introidx.htm

Just to be safe you'll want to check these carefully as a good mail with three lines is always possible.

I've got a bunch of these emails in a test account and I can't think of a legitimate way to filter them that won't cause false positives. However mine don't always have 3 lines of text.

It's a puzzler

If its not on your rfriends list you shouldn't be looking at it.

gbodave wrote:If its not on your rfriends list you shouldn't be looking at it.

Simplicity


Some folk though do prefer to create a set of their own custom filters to tag emails rather than relying on the Bayesian/Learning. These particular emails are difficult, as there isn't anything blatantly different.