Print Page | Close Window

keywords skipped sometimes koi8-r

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6434
Printed Date: 22 October 2017 at 6:19am


Topic: keywords skipped sometimes koi8-r
Posted By: rudaf
Subject: keywords skipped sometimes koi8-r
Date Posted: 12 March 2008 at 5:53am
SF std edition - rel 4.0.0.772
DB Sql Server 2000 std ed.
 
Keywords check doesn't work sometimes
 
In order to stop spam in cirillinc font we included the charset "koi8-r" among keywords blacklist.
 
This solution solved greatly the issue but now, after the 4.0.0.772 update, some mail pass the check.
 
here below the source code of a mail which as no be checked:
 
(IP in not in white list, and Keyword is in keywords blacklist (bold one))
 
[...]
Received: from 77.122.212.137 by xxxxx.xxxxxx.net (LogSat Software SMTP Server); Wed, 12 Mar 2008 09:12:25 +0100
Message-ID: <000601c88418$04f7293d$c66c5aa4@btymy>
From: "Tina" <dotyk@qwest.com>
To: <xxxxx@xxxxxxx.net>
Subject: =?koi8-r?B?68/HzyDT1cTR1D8=?=
Date: Wed, 12 Mar 2008 06:24:36 +0000
MIME-Version: 1.0
Content-Type: text/plain;
charset="koi8-r"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <dotyk@qwest.com>
X-SF-HELO-Domain: handlerless.best.volia.net
X-SF-Originating-IP: 77.122.212.137
 

 
Any idea?



Replies:
Posted By: LogSat
Date Posted: 12 March 2008 at 4:09pm
Possibly. SpamFilter does not scan for keywords the subject of an email. To also scan the subject line of emails, the keyword must begin with the prefix Subject:
So to look for the keyword "koi8-r" in an email, you will need the following two keyword entries in the keyword file:

koi8-r
subject:koi8-r




-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: rudaf
Date Posted: 13 March 2008 at 5:29am
Thank You Roberto,
 
we will try.
 
 
regards


Posted By: rudaf
Date Posted: 13 March 2008 at 10:40am
Test failed.
 
with keyword:  "Subject: =?koi8-r?" a few mails pass the filter.
 (anyway the major part of filtered mail that maches the keywords has "koi8-r" in the subject. That's exclude the regular skipping of the subject.
 
here below a mail passed the filter after updating keyword list upon your suggestion
 
Received: from 78.106.95.167 by xxxx.xxxx.net (LogSat Software SMTP Server); Thu, 13 Mar 2008 10:50:25 +0100
Message-ID: <000801c8854b$02ae5043$8f4ff6b4@xaeee>
From: =?koi8-r?B?9MnOwQ==?= <kcoxreal@pacbell.net>
To: <xxxxx.xxxx.net>
Subject: =?koi8-r?B?7c/Wzs8gzMnL18nEydLP18HU2D8=?=
Date: Thu, 13 Mar 2008 19:02:33 +0000
MIME-Version: 1.0
Content-Type: text/plain;
charset="koi8-r"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <kcoxreal@pacbell.net>
X-SF-HELO-Domain: 78-106-95-167.broadband.corbina.ru
X-SF-Originating-IP: 78.106.95.167


Posted By: Desperado
Date Posted: 13 March 2008 at 3:36pm
rudaf,
 
Can you try the following keywords?
 
((?i)charset=("){0,1}.*((windows-1251)|(koi8-r)|(2022-jp)))
((?i)subject:.*koi8-r)


-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com



Posted By: LogSat
Date Posted: 13 March 2008 at 3:52pm
rudaf,

Desperado is correct. I myself just realized that the keywords support the use of MSDOS-like style wildcards. As the "?" and "*" are considered wildcards, you can't use them with standard searches. You will thus need to use a RegEx to specify them.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: rudaf
Date Posted: 14 March 2008 at 5:15am

...uhm...we are trying as suggested by desperado (thank you, by the way).

 
Anyway the original question was:
 
1) we had koi8-r (exaclty as you read it) in keywords.
 
2) in that way SF filters 90% of cirillic mail with such a keyword in subject as well as in body
 
Why for the 10% it skips the check?
 
I don't think it is a reg ex syntax problem, since as i showed above there's no reg ex issue in my first question.
 
We are testing the desperado's suggestion.
 
I will report the results.
 
Regards
 
 
 
 


Posted By: Desperado
Date Posted: 14 March 2008 at 9:31am
rudaf,
 
If a message get through with the new keywords, please contact me by PM.  I will want to see the headers and source to see if there is some other thing I can do to improve the regular expression.


-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com



Posted By: rudaf
Date Posted: 09 April 2008 at 6:32am
Hi Desperado,
 
your reg ex expression for Koi8r are doing its job! No more cirillic spam in almost a month hard testing.
 
Thank you!


Posted By: Desperado
Date Posted: 09 April 2008 at 2:22pm
Glad to hear it and glad to help when I can!

-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com



Posted By: whansen02
Date Posted: 24 June 2008 at 5:11pm
Here are a couple recent articles that may help in understanding a few angles of internet marketing ...
http://www.adgooroo.com/how_keyword_length_and_ad_posi.php - How keyword length and ad position impact CTR and CPC on Google AdWords
http://www.adgooroo.com/google_gains_advertiser_share.php - Q1 2008 Search Engine Advertiser Report
Will


-------------
http://www.adgooroo.com/adgooroo_research_library.php - keyword suggestion tool


Posted By: Patrick van Loon
Date Posted: 29 October 2008 at 9:47am
Hello,

To filter Cyrillic spam, do I need to copy this text into the Keywords Filter window and save it?

((?i)charset=("){0,1}.*((windows-1251)|(koi8-r)|(2022-jp)))
((?i)subject:.*koi8-r)

Is that all? I'm a bit confused about where to place it. Thanks.



Print Page | Close Window