Spam Filter ISP Forums : RegEx Versus KeyWords https://www.logsat.com/spamfilter/forums/ Sun, 14 Jun 2026 18:17:30 +0000 Tue, 02 Sep 2003 14:11:00 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=1244 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[RegEx Versus KeyWords : Dan, Getting some false positives...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1854&title=regex-versus-keywords#1854 Author: Guests
Subject: 1244
Posted: 02 September 2003 at 2:11pm

Dan,

Getting some false positives with this latest post.  I previously was using your regex from about a month ago, which I think was producing fewer false positives, yet letting more spam in.  Any ideas?

--Clator

]]> Tue, 02 Sep 2003 14:11:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1854&title=regex-versus-keywords#1854 <![CDATA[RegEx Versus KeyWords : Dean, The list I CURRENTLY use...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1828&title=regex-versus-keywords#1828 Author: Desperado
Subject: 1244
Posted: 30 August 2003 at 2:34am

Dean,

The list I CURRENTLY use is as below HOWEVER ..... my list blocks a bunch of "Lists" that use a lot of extra garbage in their messages so I also have included a list of "Excluded From Addresses"

KEYWORDS:

((http|3dhttp)://.{0,26}(((%.+%))|@|:)[(\d|\w)])
(http://+[\d]{1,3}\.{1}[\d]{1,3}\.{1}[\d]{1,3}\.{1}[\d]{1,3})
((<[!--]+[\x20]{0,1}[a-zA-Z0-9]{10,}[\x20]{0,1}[!--](.+)){2,})
(<[!--]+[a-zA-Z0-9]{2}(-->))
((http://http:/\w)|(<(\w){3,10}(\x20/>)|(\*http://w)))
(<(!-- )+[a-zA-Z0-9=]{28,}( -->))
(content\-type:\x20text/(html|plain)(;{0,1})\r\ncontent-transfer\-encoding:\x20base64\r\n)
((limited time (special|offer)))
(((arge your p)|(3 - 5 inches\!)|(herbalpillsonline)|(herbaltrials\.com)|(pillsavings)|(gsc\-100)))
((text\-decoration: blink)|(click here to start))
((your privacy is extremely important to us)|(this is not spam))
(http://www.(\w){1,20}(4u).(biz|com|net))
((application\.zip|details\.zip|document_9446\.zip|document_all\.zip|movie0045\.zip|thank_you\.zip|your_details\.zip|your_document\.zip|wicked_scr\.zip))
((re: )+(wicked screensaver|details|approved|thank you!|that movie|your application|re: my details))
(See the attached file for details)
(this email address will be expiring)
selectgroupmedia.com
getit4less.biz
generic viagra
Unsubscribe By Postal
debtelimination


Excluded From Addresses:

*@paypal.com
*@listproc.pcworld.com
*@industryweek.com
*@gpsadvantage.com
*@gwbakeries.com
*@peoples.com
*@*.lga2.nytimes.com
*@*.*.nytimes.com
*@softshare.com
*@regulusgroup.com
*.*@dell.com
*@e-news.fsonline.com
*@lists.n-email.net
*@lists.techtarget.com
*@lyris.stockupticks.com
*@multexinvestornetwork.com
*@newsletter.online.com
*@insightmedia.info
*@nhfairfield.com
*@newhorizons.com
*@rootsweb.com
*@*.rootsweb.com
*@returns.groups.yahoo.com
*@cygnuspub.com
*@*.classmates.com
*@listserv.usairways.com

Regards,

Dan S.

]]> Sat, 30 Aug 2003 02:34:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1828&title=regex-versus-keywords#1828 <![CDATA[RegEx Versus KeyWords : Hello, Could you please post...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1827&title=regex-versus-keywords#1827 Author: Guests
Subject: 1244
Posted: 30 August 2003 at 2:15am

Hello,

Could you please post a list of the regular expressions that you use so that I may implement them here? Any help would be greatly appreciated.

Dean

]]> Sat, 30 Aug 2003 02:15:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1827&title=regex-versus-keywords#1827 <![CDATA[RegEx Versus KeyWords : John, Actually, we have a primary...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1391&title=regex-versus-keywords#1391 Author: Desperado
Subject: 1244
Posted: 16 July 2003 at 4:56pm

John,

Actually, we have a primary and a secondary mail server.  The primary is "Bluto" and the secondary is "Raptor".  They are located in 2 separate locations but "report" to the same MS SQL server.

Dan S.

 

]]> Wed, 16 Jul 2003 16:56:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1391&title=regex-versus-keywords#1391 <![CDATA[RegEx Versus KeyWords : Dan, Reading your stats, what...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1389&title=regex-versus-keywords#1389 Author: Guests
Subject: 1244
Posted: 16 July 2003 at 2:53pm

Dan,

Reading your stats, what is "Bluto"? Also, presume Raptor is the firewall.

John

]]> Wed, 16 Jul 2003 14:53:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1389&title=regex-versus-keywords#1389 <![CDATA[RegEx Versus KeyWords : No. I have written a complete...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1305&title=regex-versus-keywords#1305 Author: Desperado
Subject: 1244
Posted: 09 July 2003 at 12:30pm

No.  I have written a complete application in ASP for my customere, my "advanced" customers, and our internal Administrators.  The snapshot came from my advanced manager.  I see that the snapshot was "cut off" at the bottom.  I may put a link up of some sample screen shots to give users some ideas on what can be easily done to get some of this information out of the system.

Dan S.

]]> Wed, 09 Jul 2003 12:30:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1305&title=regex-versus-keywords#1305 <![CDATA[RegEx Versus KeyWords : Is that a snapshot of the asp...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1302&title=regex-versus-keywords#1302 Author: Guests
Subject: 1244
Posted: 09 July 2003 at 12:17pm

Is that a snapshot of the asp web pages provided by logsat? I haven't attempted to set it up yet but thats looks very cool.]]> Wed, 09 Jul 2003 12:17:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1302&title=regex-versus-keywords#1302 <![CDATA[RegEx Versus KeyWords : Dwight, Second question first...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1261&title=regex-versus-keywords#1261 Author: Guests
Subject: 1244
Posted: 06 July 2003 at 8:02pm

Dwight,

Second question first ... The stats were a copy from our administrator page so I can't really give access to the actual web site.  Only our admins have that.  What stats were you looking for?

First question:  I guess we have to define "False Positive" for that one.  As an ISP, we have taken the stance that there is no excuse for "dotted IP's" in a URL.  If you can't put a DNS host name in, and validate some traceable ownership of that IP, we view that as obfuscation. By our definition, that's Spam.  So, by our definition, we have no false positives.

We have had cases where perfectly valid email had dotted IP's in a url and our customer informed their sending party and they fixed it.

I am not sure that was what you wanted to hear but it is our policy.  Again, what stats are you looking for?  I can try to give you a "snapshot" of our stats but I can't give public access to the site itseld.

Dan S.

]]> Sun, 06 Jul 2003 20:02:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1261&title=regex-versus-keywords#1261 <![CDATA[RegEx Versus KeyWords : Thanks Dan! You have some good...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1259&title=regex-versus-keywords#1259 Author: dcook
Subject: 1244
Posted: 06 July 2003 at 3:48pm

Thanks Dan!

You have some good ideas.  I have put some into practice. Are you getting many false positives for dotted ip addresses?

I also wanted to ask if you could provide a link to your adminlogin.asp page for the stats.  That page is missing from your stats download post.

Dwight

 

 

]]> Sun, 06 Jul 2003 15:48:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1259&title=regex-versus-keywords#1259 <![CDATA[RegEx Versus KeyWords : Dwight, Now I am lazy ... here...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1254&title=regex-versus-keywords#1254 Author: Desperado
Subject: 1244
Posted: 05 July 2003 at 12:39pm

Dwight,
 
Now I am lazy ... here is a "not so detailed version of what I wrote the first time.
 
I am still working on my VERY short list and am also working on the order of things in my other lists.  When you look at my "Stats", you will see that relays.osirusoft.com has very few "hits" That is because I killed off all the messages that had been blocked by that list so I could see if it is even worth having now that I changed the order.  relays.osirusoft.com is a very good list but is slow to respond at times and other lists carry the same blocks.
 
Back on the topic:
 
(<[!--]+[a-zA-Z0-9]{11,})     >>>>> Roberto's (modified) "magic" html comment blocker

(http://\w{0,6}%[\d])     >>>>> Blocks href's to partially obscured URL's.  WARNING!  Until I work something out with my buddy at "PayPal"  (he is one of their developers), I had to add *@paypal.com to my allowed FROM list.

(href="http://+[\d])     >>>>> Blocks any href to "Dotted IP's"

(content-type: text/html\r\ncontent-transfer-encoding: base64)   >>>>>>  This one is supposed to block Base 64 encoded HTML that isn't tagged as an inline image.  It seems to work sometimes and not others.  I have not found the difference between the ones blocked and the ones not blocked yet.
 
The "Clear Text" keywords below are only in until I find the "Correct" pattern to us a RegEx.

Mobutu Sese Seko
banhi.com
text-decoration: blink
 
I am working on an SQL query that will run once every 24 hours to give me a breakdown on how many of each expression blocked in the 24 hour period.  This will help me determine if a keyword is even worth having in or not.
 
Here are my latest stats
 
]]> Sat, 05 Jul 2003 12:39:00 +0000https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1244&PID=1254&title=regex-versus-keywords#1254

Current Database Contents

Current Msg. total:362076Marked for deletion:0
No Reverse DNS:117088IP in MAPS B/L:139252
Email From B/L:254Exc'd max RCPT TO:1916
Banned Keywords:103535Email TO B/L:25
Domain B/L:7IP B/L:0
Blocked by Bluto:315470Blocked by Raptor:46607

Primary SMTP Statistics   (Last Cleared May 25 2003)

Total Inbound Conn.:1421750EMail Attempts:1423184
EMails Forwarded:443379EMails Blocked:1327058

Secondary SMTP Statistics   (Last Clear