Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Encoded subject not filtered
  FAQ FAQ  Forum Search   Register Register  Login Login

Encoded subject not filtered

 Post Reply Post Reply
Author
Alec Skelly View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Alec Skelly Quote  Post ReplyReply Direct Link To This Post Topic: Encoded subject not filtered
    Posted: 02 April 2004 at 6:42pm

I'm seeing a lot of spam with an encoded subject line.  Here's an example:

Subject: =?ISO-8859-1?b?VHJ5IFZpYWckcmE=?=

When decoded, it looks like this:

Subject: Try Viag$ra

Viag$ra should be caught by a regex I use (and I have used the regex test feature to verify that).  I thought maybe the message was being scanned before the subject was decoded, so I made a regex, ((?i)Subject:s?=?), to catch "Subject: =?" (and verified that it worked in the test window) but it didn't work.  I then upgraded to 1.2.0.212 because of this release note:

{TODO -cNew : Subject lines are now prefixed with the words "Subject:", allowing RegEx searches to be more specific by limiting them to the subject line only}

Unfortunately it still isn't working.  Any ideas?

Thanks

 

Back to Top
Alec Skelly View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Alec Skelly Quote  Post ReplyReply Direct Link To This Post Posted: 02 April 2004 at 8:37pm

The backslashes in the regex in the original post are not being displayed here.  It actually is a working regex despite appearances.

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4106
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 04 April 2004 at 12:39am

Alec,

Can you please either post and/or email us at support@logsat.com the exact regex expression you're using so we can duplicate (and hopefully fix) this?

Thanks,

Roberto F.
LogSat Software

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 05 April 2004 at 10:51am

Alec,

I believe I understand what you are trying to do and why it seems to be failing.  I have emailed Roberto directly on this issue and you should hear back from him if you have not already resolved this issue.  This is NOT a straight forward issue with the ISO encoding in the subject because not only is it used by Spammers to obscure the actual content but is can also be a valid foreign language subject so some compromises have to be made and the ramifications must be  understood.

Regards,

Dan S.

Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.281 seconds.