Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - keywords skipped sometimes koi8-r
  FAQ FAQ  Forum Search   Register Register  Login Login

keywords skipped sometimes koi8-r

 Post Reply Post Reply
Author
rudaf View Drop Down
Newbie
Newbie


Joined: 04 July 2007
Location: Italy
Status: Offline
Points: 38
Post Options Post Options   Thanks (0) Thanks(0)   Quote rudaf Quote  Post ReplyReply Direct Link To This Post Topic: keywords skipped sometimes koi8-r
    Posted: 12 March 2008 at 5:53am
SF std edition - rel 4.0.0.772
DB Sql Server 2000 std ed.
 
Keywords check doesn't work sometimes
 
In order to stop spam in cirillinc font we included the charset "koi8-r" among keywords blacklist.
 
This solution solved greatly the issue but now, after the 4.0.0.772 update, some mail pass the check.
 
here below the source code of a mail which as no be checked:
 
(IP in not in white list, and Keyword is in keywords blacklist (bold one))
 
[...]
Received: from 77.122.212.137 by xxxxx.xxxxxx.net (LogSat Software SMTP Server); Wed, 12 Mar 2008 09:12:25 +0100
Message-ID: <000601c88418$04f7293d$c66c5aa4@btymy>
From: "Tina" <dotyk@qwest.com>
To: <xxxxx@xxxxxxx.net>
Subject: =?koi8-r?B?68/HzyDT1cTR1D8=?=
Date: Wed, 12 Mar 2008 06:24:36 +0000
MIME-Version: 1.0
Content-Type: text/plain;
charset="koi8-r"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <dotyk@qwest.com>
X-SF-HELO-Domain: handlerless.best.volia.net
X-SF-Originating-IP: 77.122.212.137
 

 
Any idea?
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 12 March 2008 at 4:09pm
Possibly. SpamFilter does not scan for keywords the subject of an email. To also scan the subject line of emails, the keyword must begin with the prefix Subject:
So to look for the keyword "koi8-r" in an email, you will need the following two keyword entries in the keyword file:

koi8-r
subject:koi8-r


Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
rudaf View Drop Down
Newbie
Newbie


Joined: 04 July 2007
Location: Italy
Status: Offline
Points: 38
Post Options Post Options   Thanks (0) Thanks(0)   Quote rudaf Quote  Post ReplyReply Direct Link To This Post Posted: 13 March 2008 at 5:29am
Thank You Roberto,
 
we will try.
 
 
regards
Back to Top
rudaf View Drop Down
Newbie
Newbie


Joined: 04 July 2007
Location: Italy
Status: Offline
Points: 38
Post Options Post Options   Thanks (0) Thanks(0)   Quote rudaf Quote  Post ReplyReply Direct Link To This Post Posted: 13 March 2008 at 10:40am
Test failed.
 
with keyword:  "Subject: =?koi8-r?" a few mails pass the filter.
 (anyway the major part of filtered mail that maches the keywords has "koi8-r" in the subject. That's exclude the regular skipping of the subject.
 
here below a mail passed the filter after updating keyword list upon your suggestion
 
Received: from 78.106.95.167 by xxxx.xxxx.net (LogSat Software SMTP Server); Thu, 13 Mar 2008 10:50:25 +0100
Message-ID: <000801c8854b$02ae5043$8f4ff6b4@xaeee>
From: =?koi8-r?B?9MnOwQ==?= <kcoxreal@pacbell.net>
To: <xxxxx.xxxx.net>
Subject: =?koi8-r?B?7c/Wzs8gzMnL18nEydLP18HU2D8=?=
Date: Thu, 13 Mar 2008 19:02:33 +0000
MIME-Version: 1.0
Content-Type: text/plain;
charset="koi8-r"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <kcoxreal@pacbell.net>
X-SF-HELO-Domain: 78-106-95-167.broadband.corbina.ru
X-SF-Originating-IP: 78.106.95.167
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 13 March 2008 at 3:36pm
rudaf,
 
Can you try the following keywords?
 
((?i)charset=("){0,1}.*((windows-1251)|(koi8-r)|(2022-jp)))
((?i)subject:.*koi8-r)
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 13 March 2008 at 3:52pm
rudaf,

Desperado is correct. I myself just realized that the keywords support the use of MSDOS-like style wildcards. As the "?" and "*" are considered wildcards, you can't use them with standard searches. You will thus need to use a RegEx to specify them.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
rudaf View Drop Down
Newbie
Newbie


Joined: 04 July 2007
Location: Italy
Status: Offline
Points: 38
Post Options Post Options   Thanks (0) Thanks(0)   Quote rudaf Quote  Post ReplyReply Direct Link To This Post Posted: 14 March 2008 at 5:15am

...uhm...we are trying as suggested by desperado (thank you, by the way).

 
Anyway the original question was:
 
1) we had koi8-r (exaclty as you read it) in keywords.
 
2) in that way SF filters 90% of cirillic mail with such a keyword in subject as well as in body
 
Why for the 10% it skips the check?
 
I don't think it is a reg ex syntax problem, since as i showed above there's no reg ex issue in my first question.
 
We are testing the desperado's suggestion.
 
I will report the results.
 
Regards
 
 
 
 
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 14 March 2008 at 9:31am
rudaf,
 
If a message get through with the new keywords, please contact me by PM.  I will want to see the headers and source to see if there is some other thing I can do to improve the regular expression.
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
rudaf View Drop Down
Newbie
Newbie


Joined: 04 July 2007
Location: Italy
Status: Offline
Points: 38
Post Options Post Options   Thanks (0) Thanks(0)   Quote rudaf Quote  Post ReplyReply Direct Link To This Post Posted: 09 April 2008 at 6:32am
Hi Desperado,
 
your reg ex expression for Koi8r are doing its job! No more cirillic spam in almost a month hard testing.
 
Thank you!
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 09 April 2008 at 2:22pm
Glad to hear it and glad to help when I can!
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
whansen02 View Drop Down
Newbie
Newbie
Avatar

Joined: 24 June 2008
Status: Offline
Points: 1
Post Options Post Options   Thanks (0) Thanks(0)   Quote whansen02 Quote  Post ReplyReply Direct Link To This Post Posted: 24 June 2008 at 5:11pm
Here are a couple recent articles that may help in understanding a few angles of internet marketing ...
How keyword length and ad position impact CTR and CPC on Google AdWords
Q1 2008 Search Engine Advertiser Report
Will
Back to Top
Patrick van Loon View Drop Down
Newbie
Newbie


Joined: 29 October 2008
Location: Eindhoven
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote Patrick van Loon Quote  Post ReplyReply Direct Link To This Post Posted: 29 October 2008 at 9:47am
Hello,

To filter Cyrillic spam, do I need to copy this text into the Keywords Filter window and save it?

((?i)charset=("){0,1}.*((windows-1251)|(koi8-r)|(2022-jp)))
((?i)subject:.*koi8-r)

Is that all? I'm a bit confused about where to place it. Thanks.
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.141 seconds.