Spam Filter ISP Forums : Help with a filter https://www.logsat.com/spamfilter/forums/ Sat, 16 May 2026 01:14:29 +0000 Fri, 17 Aug 2007 15:53:29 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6199 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Help with a filter : Here&#039;s one I use. If what...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10748&title=help-with-a-filter#10748 Author: sgeorge
Subject: 6199
Posted: 17 August 2007 at 3:53pm

Here's one I use.  If what looks like an i.p.-based url is preceded by "card" anywhere in the message (including a different line), this will match.

[code]((?is)card.*https?://\d\d)[code]

On the plus side, this should hopefully reduce the likelihood of matching URLs within mail-headers.

I realize spammers may possible drift in here to learn some of our techniques, but I think that this discussion still helps more than it hurts.

Stephen

p.s. Thanks Dan, for thinking about https too - I added that after the fact Smile


Edited by sgeorge - 17 August 2007 at 3:54pm]]> Fri, 17 Aug 2007 15:53:29 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10748&title=help-with-a-filter#10748 <![CDATA[Help with a filter : Thanks for the headsup Dan. I...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10745&title=help-with-a-filter#10745 Author: IKILLSPAM1
Subject: 6199
Posted: 16 August 2007 at 2:43pm

Thanks for the headsup Dan. I will keep an eye out for that.]]> Thu, 16 Aug 2007 14:43:35 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10745&title=help-with-a-filter#10745 <![CDATA[Help with a filter : All, One issue I have with...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10740&title=help-with-a-filter#10740 Author: Desperado
Subject: 6199
Posted: 16 August 2007 at 11:29am

All,
 
One issue I have with the above RegEx's (which I use and get thousands of blocks) is that I also scan headers and Barracudas put a screwy header in which causes a block.  Example:
X-Barracuda-URL: http://198.136.134.18:8000/cgi-bin/mark.cgi
I have yet to understand *why* the header is even added.
]]> Thu, 16 Aug 2007 11:29:30 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10740&title=help-with-a-filter#10740 <![CDATA[Help with a filter : Ive also recently put in some...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10739&title=help-with-a-filter#10739 Author: IKILLSPAM1
Subject: 6199
Posted: 16 August 2007 at 10:11am

Ive also recently put in some regex to block emails with numeric hyperlinks in them. every little bit helps i guess. its blocked about 15 emails since yesterday.
 
I wish I had the time and will power to learn regex as well. I was trying to find a good regex to deal with the pdf crap but wasnt able to. Im seeing people like to keep their regex's safe from spammer eyes. If anyone wants to share their regex's id be honored!
 
 
]]> Thu, 16 Aug 2007 10:11:54 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10739&title=help-with-a-filter#10739 <![CDATA[Help with a filter : You could also modify it as below...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10737&title=help-with-a-filter#10737 Author: Desperado
Subject: 6199
Posted: 15 August 2007 at 5:02pm

You could also modify it as below in case the Spam Site in NOT on port 80
((?i)http(s?)://(\d{1,3}\.){3}\d{1,3}(:|/))
OR ... just leave the last part off and any http request to an IP address will also get wacked.
]]> Wed, 15 Aug 2007 17:02:33 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10737&title=help-with-a-filter#10737 <![CDATA[Help with a filter : I see. I&#039;ve just asked to...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10736&title=help-with-a-filter#10736 Author: Roman
Subject: 6199
Posted: 15 August 2007 at 4:53pm

I see. I've just asked to be sure I'm not missing something.]]> Wed, 15 Aug 2007 16:53:33 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10736&title=help-with-a-filter#10736 <![CDATA[Help with a filter : Old habbits die hard! I tend to...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10735&title=help-with-a-filter#10735 Author: Desperado
Subject: 6199
Posted: 15 August 2007 at 4:37pm

Old habbits die hard!  I tend to program in Perl and often to go cross-platform, I need to get VERY picky.  As the horrible saying goes ... "there is more than one way to skin a cat".  (I hope the ASPCA doesn't read this)]]> Wed, 15 Aug 2007 16:37:50 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10735&title=help-with-a-filter#10735 <![CDATA[Help with a filter : m-m-m, recursion :) but why &#034;[]&#034;...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10734&title=help-with-a-filter#10734 Author: Roman
Subject: 6199
Posted: 15 August 2007 at 4:21pm

m-m-m, recursion :)
but why "[]" and "+", isn't

((?i)http(s?)://(\d{1,3}\.){3}\d{1,3}/)

enough?]]> Wed, 15 Aug 2007 16:21:39 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10734&title=help-with-a-filter#10734 <![CDATA[Help with a filter : That did it, Thanks.I have to...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10733&title=help-with-a-filter#10733 Author: Thermo
Subject: 6199
Posted: 15 August 2007 at 4:13pm

That did it, Thanks.

I have to learn RegEx.
]]> Wed, 15 Aug 2007 16:13:31 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10733&title=help-with-a-filter#10733 <![CDATA[Help with a filter : Hmmm ... My 2 cents ((?i)http(s?)://({1,3}){3}{1,3}/)...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10732&title=help-with-a-filter#10732 Author: Desperado
Subject: 6199
Posted: 15 August 2007 at 4:05pm

Hmmm ... My 2 cents
((?i)http(s?)://([\d]{1,3}[\.+]){3}[\d]{1,3}/)
]]> Wed, 15 Aug 2007 16:05:25 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6199&PID=10732&title=help-with-a-filter#10732