ScanMail for Exchange and Regular Expressions
There is a new spam that seems to be getting through both our spam blocking measures and is a bit annoying. It comes in a like a regular email and has a link in it with http://{random_characters}.blogspot.com We use TrendMicro’s ScanMail for Exchange as our anti-virus protection at the Exchange level and we do content filtering with this software also. Since the entire message is random other than the .blogspot.com portion I needed to come up with a way to key off that portion. ScanMail will not block just blogspot since it is inside of a string. Using regular expressions you can set it so it blocks these message with the following line in your content filter.
.REG. http:\/\/\w+\.blogspot\.com
Done and the spam goes bye bye now, so does any email that has a blogspot address. This is fine for us since there is a company policy against personal web surfing and blogspot has zero business purpose.