Print Page | Close Window

Regex Keyword Filter on Subject

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5568
Printed Date: 23 October 2017 at 4:07am


Topic: Regex Keyword Filter on Subject
Posted By: caratking
Subject: Regex Keyword Filter on Subject
Date Posted: 03 April 2006 at 12:40am

These home loan, and chase bank emails are really getting to me.

I started doing some regex keywords to stop these, and found some samples for subject keyword filters on this forum.

My test messages get stopped, but the real spam do not.

For example, this one just got past:

From: "Hubert Hendrix" < mailto:brian_schlessinger@time-inc.com - brian_schlessinger@time-inc.com >
MIME-Version: 1.0
Subject: Looking to ReFi or a Home Equity Loan?

This filter should have caught it, right?

((?i)Subject:(.*?)(equity)(.*?)(loan)(.*?))

I don't see what I'm doing wrong, any help would be appreciated. I'm assuming the (?i) makes it case insensitive.




Replies:
Posted By: Desperado
Date Posted: 04 April 2006 at 1:27pm

caratking,

If you are trying to block that subject, I would have done:

((?i)Subject:.*equity.*loan)

But it is not much different than yours.  (?i) forces no case checking with the glitch that I believe case is determined by your servers "locale" settings so if you are using a non standard locale, there *may* be some very obscure issue (not that I can think of any).



-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com



Posted By: caratking
Date Posted: 05 April 2006 at 7:26pm

I just can't get this subject filtering to work... 

I changed the filters to try and simplify things, this is a sample one:

((?i)Subject:.*(mortag|mortgage)(.*?)(approv|rate))

The SPAM just keep coming through, here is an example of one (of hundreds) that slipped past overnight.

Microsoft Mail Internet Headers Version 2.0
x-fsavag4mse-ts: 82436ceb892a1995
Received: from webs3.webserver.server.com ([192.168.30.103]) by nospam.hbi.com with Microsoft SMTPSVC(5.0.2195.6713); Thu, 6 Apr 2006 05:06:07 +0900
Received: from webs3 ([127.0.0.1]) by webs3.webserver.server.com with Microsoft SMTPSVC(5.0.2195.6713); Thu, 6 Apr 2006 05:06:07 +0900
Content-Transfer-Encoding: 8bit
Received: from 201.13.11.175 by nospam20.hbi.com (LogSat Software SMTP Server) Thu, 6 Apr 2006 05:06:06 +0900
Received: (from mailto:tomcat@localhost - tomcat@localhost ) by 201.13.11.175 (8.12.8/8.12.8/Submit) id j3CHmn0V755004 for mailto:forum@hbi.com - forum@hbi.com ; Wed, 05 Apr 2006 15:05:51 -0600
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1506
Message-ID: < mailto:170m690m.3591989@211.123.156.23 - 170m690m.3591989@211.123.156.23 >
Date: Wed, 05 Apr 2006 15:05:51 -0600
From: "Ignacio Wells" < mailto:support@caswellplating.com - support@caswellplating.com >
X-Mailer: MIME-tools 5.494 (Entity 5.289)
MIME-Version: 1.0
To: < mailto:forum@hbi.com - forum@hbi.com >
Cc: < mailto:jteditor@hbi.com - jteditor@hbi.com >
X-Spam-Score:  (-2.705) BAYES_00
X-Scanned-By: MIMEDefang 2.52 on 201.13.11.175
X-Scanned-By: SpamAssassin 3.103692, File::Scan 0.05, Archive::Zip 1.66
X-Recipient: < mailto:forum@hbi.com - forum@hbi.com >
Subject: Mortagge ratee approvedd
Content-Type: multipart/related;
 boundary="------------AttPart_86833495==.OLA"
X-Server: LogSat Software SMTP Server - Unlicensed Evaluation Copy
X-SF-RX-Return-Path: < mailto:support@caswellplating.com - support@caswellplating.com >
X-SF-HELO-Domain: 201-13-11-175.dsl.telesp.net.br
X-SF-WhiteListedReason: Whitelisted EMail Address To
Return-Path: < mailto:support@caswellplating.com - support@caswellplating.com >
X-OriginalArrivalTime: 05 Apr 2006 20:06:07.0097 (UTC) FILETIME=[5FE46E90:01C658EC]

--------------AttPart_86833495==.OLA
Content-Type: text/html;
 charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit

--------------AttPart_86833495==.OLA
Content-Type: image/gif;
 name="guanine.6.gif"
Content-Transfer-Encoding: base64
Content-ID: < mailto:3.0.0.65.0.53095026998546.61989080@bruit.msn.com.6 - 3.0.0.65.0.53095026998546.61989080@bruit.msn.com.6 >
Content-Disposition: inline;
 filename="guanine.6.gif"


--------------AttPart_86833495==.OLA--

 



Posted By: Desperado
Date Posted: 05 April 2006 at 7:30pm

Hmmm .. do you have ScanReceivedHeaders=1 in your ini file?



-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com



Posted By: caratking
Date Posted: 05 April 2006 at 7:32pm

I believe I have found the problem, it is not specifically related to the keyword filters.

After pasting the above header, I noticed Spam Filter ISP inserted this:

X-SF-WhiteListedReason: Whitelisted EMail Address To

The above SPAM was sent to two people, forum & jteditor.  The jteditor account is whitelisted (they were complaining about false positives - so they get whitelisted). 

Problem is, the forum email goes through because one of the people the message was for is whitelisted.

If someone sends the spam to 5 users, and one of them is whitelisted the other four people will get the message.

This seems like a possible bug to me.

This explains why my test messages were getting blocked, and the real spam gets through...



Posted By: sgeorge
Date Posted: 06 April 2006 at 4:47pm
caratking, I agree with you, I think that one whitelisted recipient shouldn't make everyone else receive the email as well.  While that is a problem, I found a work-around that should provide the correct functionality:
  • Add the following line to your AutoWhiteListForceDelivery.txt file and save:
    *|jteditor@yourdomain.com
  • remove jteditor's email address from the "Unfiltered Emails" tab in Spam
As I test this on version 2.7.1.532 (Unregistered), this work-around gives me the result that you were expecting from it.

Thanks again for your help with AuthTo lists,

Stephen




Print Page | Close Window