Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Subject RegEx
  FAQ FAQ  Forum Search   Register Register  Login Login

Subject RegEx

 Post Reply Post Reply
Author
Henrique View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Henrique Quote  Post ReplyReply Direct Link To This Post Topic: Subject RegEx
    Posted: 05 February 2004 at 2:46pm

Hi folks!

I'm trying to build a RegEx to block some e-mails infected by the worm MY_DOOM.A

My idea is to block e-mails wich have the words hi, hello, test or error in his subject.

I made some RegEx like:

- (Subject:\x20(hi|Hi|HI|hello|Hello|HELLO|error|Error|ERROR|test|Test|TEST))

- (subject:\x20(test$|hi|hello$|error$))

- (Subject:(hi$|hello$|test$|error$))

None of them work!!!

Someone can give me a clue?

Thanks everyone and sorry about my bad english, that's not my natural language.

Henrique

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 06 February 2004 at 7:45pm

What Build of SpamFilter are you running?  The "Subject:" filtering only was added recently.

Dan S.

 

Back to Top
Henrique View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Henrique Quote  Post ReplyReply Direct Link To This Post Posted: 07 February 2004 at 8:01am

I have two mx servers.

One of them with the 1.2.0.212 build and the other with the 1.2.0.178 build.

 

[]'s

Henrique

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 07 February 2004 at 5:20pm

The "Subject" RegEx matching was not available until version 2 build 211 (or there abouts).

Regards,

Dan S.

Back to Top
GJ View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote GJ Quote  Post ReplyReply Direct Link To This Post Posted: 09 February 2004 at 11:14am

I'm having the same issue (the "Subject:" search isn't working).  Per the release notes and bug fixes on the 'Download' page...(the third items shows that version 1.2.0.212 now has the new "Subject:" word search...

// New to VersionNumber = '1.2.0.212';
{TODO -cNew : Add ini option to allow MAIL FROM command without 1st HELO command}
{TODO -cNew : Incoming connections are dropped immediately when the DATA stream exceeds the max message size, before the entire email was received before being rejected}
{TODO -cNew : Subject lines are now prefixed with the words "Subject:", allowing RegEx searches to be more specific by limiting them to the subject line only}

I upgraded to this version, but my "Subject:" keyword searches are not working.

Any help would be greatly appreciated, I too am trying to stop the MyDoom virus in it's tracks by searching the email subjects

Thanks!

GJ

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 09 February 2004 at 11:19am

Can you please post an example of what your keyword entry for the "subject" keyword looks like?

Regards,

Dan S.

 

Back to Top
GJ View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote GJ Quote  Post ReplyReply Direct Link To This Post Posted: 09 February 2004 at 11:53am

Sure Dan, thanks for the quick initial response!

Here is what I have in my Keywords Filter area to filter any emails with a subject of "hi" (without the quotes)...

Subject: hi
Subject: (?i)hi
"Subject:" (hi)

All three of these don't work!  I've sent an inbound email from three seperate email accounts that I have on the internet, with the subject of "hi" (without the quotes), and SpamFilter isn't trapping it.

I just re-verified my version on the spamfilter.exe and spamfiltersvc.exe, and they are both: 1.2.0.212.

Thanks!

GJ

Back to Top
Trinidad View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Trinidad Quote  Post ReplyReply Direct Link To This Post Posted: 09 February 2004 at 12:01pm

Hey Dan whats going on?

I emailed SF support to contact you about your latest regex and no one has responded

Any chance i can get it direct for you

my email address is btrinidad at atx dot com

Thanks

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 09 February 2004 at 12:51pm

Hmmm ... all of a sudden my Subject RegEx is not working ... but it did.  I am running a private beta that may have an issue though ..  I will check on that.

Dan S.

Back to Top
Brian View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Brian Quote  Post ReplyReply Direct Link To This Post Posted: 09 February 2004 at 7:24pm

I too have found the Subject line not working correctly with RegEx, but I think I found out why.

My issue is that I have found a lot of spam mail that does not get caught have Subject lines like this =?ISO-8859-1?B?UmU6QSBNdXN0IHJlYWQgb24gSGVhbHRo?= inside the header Subject line.

The convertion does show up though in the subject line that the user normally sees.  The above unicode converts to Re:A Must read on Health.

My guess here is that SF picks up on the subject line AFTER the unicode is converted.  If this is the case, then using a regex such as ((?i)Subject:\s=.+?=) to filter out the unicode-encoded line above will not work.

Another popular one I get a lot is when the message comes in with the subject line hi and the subject line in the header shows up as unicode, my usual regex that blocks hi will not work.  I'm not sure as to the solution to this, but this is where I see the problems coming from when it comes to filtering based on the subject line. If the subject line in both the header and 'what the user normally sees subject field' match then the regex will work as advertised.

 

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 10 February 2004 at 5:24am

All,

The following examples do, in fact, work but I have no stats on false blocking yet.  After one hour, I got "hits" on 2 out of 3 of them and nailed 23 messages.

((?i)Subject:((re:hit)|((\.){1})|((\w){0,3}(dont wait\!))))

((?i)Subject:(.){3,15}("confirmation n))

((?i)Subject:(at last).{20,})

Any comments on what is wrong with these PLEASE!

Regards,

Dan S.

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 10 February 2004 at 6:07am

However,  Check my sanity but the following seems to work:

((?i)Subject:=\?ISO\-\d*\-\1?,*?.*_.*_.*)

PLEASE SHOOT IT DOWN! I have no idea if I am creating a disaster just waiting to happen!

Regards,

Dan S.

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 10 February 2004 at 6:27am

Nix the post above ... too many false positives.

I changed it to ((?i)Subject:=\?ISO\-\d*\-\1?.*?better_)  For the moment.

Dan S.

Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.109 seconds.