Spam Filter ISP Forums : filtering from addresses with : in them https://www.logsat.com/spamfilter/forums/ Wed, 13 May 2026 19:01:58 +0000 Thu, 05 Feb 2015 17:08:16 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=7104 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[filtering from addresses with : in them : E X C E L L E N T idea, thumbs...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14706&title=filtering-from-addresses-with-in-them#14706 Author: LogSat
Subject: 7104
Posted: 05 February 2015 at 5:08pm

E X C E L L E N T  idea, thumbs up for coming up with it - a great workaround!]]> Thu, 05 Feb 2015 17:08:16 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14706&title=filtering-from-addresses-with-in-them#14706 <![CDATA[filtering from addresses with : in them : AH! I did it. In real, not in...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14705&title=filtering-from-addresses-with-in-them#14705 Author: yapadu
Subject: 7104
Posted: 05 February 2015 at 1:38am

AH!  I did it.  In real, not in testing I managed to get it working.  Here is what I ended up with.

from,((?im-s)^from:.*<.*\.rocks>),((?im-s)^to:.*<?.*\.com>?)

So the first from is just a placeholder, basically every message should have that.

Then I have two different regex that are separated with a comma.  The good news is that works!
]]> Thu, 05 Feb 2015 01:38:06 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14705&title=filtering-from-addresses-with-in-them#14705 <![CDATA[filtering from addresses with : in them : I have altered my regex, not like...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14704&title=filtering-from-addresses-with-in-them#14704 Author: yapadu
Subject: 7104
Posted: 05 February 2015 at 12:29am

I have altered my regex, not like your examples but a technique I used previously with spamfitler to mix regular keywords with regex.

I will report back if it works.
]]> Thu, 05 Feb 2015 00:29:09 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14704&title=filtering-from-addresses-with-in-them#14704 <![CDATA[filtering from addresses with : in them : I&#039;m at bit of a loss here....]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14703&title=filtering-from-addresses-with-in-them#14703 Author: LogSat
Subject: 7104
Posted: 04 February 2015 at 10:02pm

I'm at bit of a loss here. One part of the question is explainable. When SpamFilter see a "(" as the first character in a line containing keywords, it expects *everything* on that line to be a RegEx. So the comma "," you used trying to specify two separate RegEx expressions on the same line will not work as you intended. It won't tell SpamFilter to separate the two RegEx expressions, rather it is interpreted as part of the RegEx.

So you would need to use a single RegEx expression to perform your search. Assuming the "From" header is specified before the "To" header in an email, the RegEx to use would thus be:
((?ims)^from:.*<.*\.rocks>.*^to:.*<?.*\.com>)

and to cover the cases where the "From" header is specified after the "To" header, you would need to invert them:
((?ims)^to:.*<?.*\.coz>.*^from:.*<.*\.rockz>)

The problem I have is that neither of those two keywords are working correctly. In my RegEx tests the first keyword above should stopped an email with these headers:

Message-ID: <472a92d26bb9f7517d517a4c882c2291@sistema.optdatacrm.click>
From: "Claro Empresas" <emm@optdatacrm.rocks>
To: "LogSat" <test@logsat.com>
Reply-To: emm@optdatacrm.click
MIME-Version: 1.0

...but when using that keyword within SpamFilter it is not triggering it. I can't find anything obviously wrong with the implementation of RegEx in SpamFilter, yet it's not catching it.

I'll try looking into this again during the weekend.
]]> Wed, 04 Feb 2015 22:02:29 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14703&title=filtering-from-addresses-with-in-them#14703 <![CDATA[filtering from addresses with : in them : We have been able to get this...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14702&title=filtering-from-addresses-with-in-them#14702 Author: yapadu
Subject: 7104
Posted: 04 February 2015 at 7:47pm

We have been able to get this format to work:

(?im-s)^from:.*<.*\.rocks>

It is designed to find a sender address in the from header that ends with .rocks - that works.

We then try taking it a step further, say to any recipient at a .com address so we came up with this.

((?im-s)^from:.*<.*\.rocks>),((?im-s)^to:.*<?.*\.com>?)

Individually these two regex would trigger, but we have not been able to see the combo of using both trigger.  Is the problem related to the bug regarding to the , or should we be able to do multiple regex separated with a comma?

]]> Wed, 04 Feb 2015 19:47:58 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14702&title=filtering-from-addresses-with-in-them#14702 <![CDATA[filtering from addresses with : in them : Ok, I think I&#039;ve got my problem...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14701&title=filtering-from-addresses-with-in-them#14701 Author: yapadu
Subject: 7104
Posted: 24 January 2015 at 11:20pm

Ok, I think I've got my problem sorted out.  I ran these two:

((?im)^from:.*<.*\.rocks>)
((?im)^from:.*<.*\.click>)

I have been surprised how little they have picked up (your two tests and a couple others).  The 'others' it picked up were not what I wanted.  It triggered on an email with a from: in the headers and an email ending with .rocks much further down (it was a bounce message).

I want the from to be at the start of the line (which I get with the m option) but I do not want the scanning to span more than one line, so the entire match must be on the single line to prevent false positives.  Playing around I found I need to disable the singleline option as well.  So I currently have:

(?im-s)^from:.*<.*\.rocks>
(?im-s)^from:.*<.*\.click>

I'm going to run those and see if I capture what I expect.

]]> Sat, 24 Jan 2015 23:20:33 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14701&title=filtering-from-addresses-with-in-them#14701 <![CDATA[filtering from addresses with : in them : I think it is this:;Setting DoNotSendNDROnQuarantine...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14700&title=filtering-from-addresses-with-in-them#14700 Author: yapadu
Subject: 7104
Posted: 24 January 2015 at 10:04am

I think it is this:

;Setting DoNotSendNDROnQuarantine to 1 will prevent generation of NDR when email are quarantined by causing SpamFilter *not* to send an error code when quarantining emails
DoNotSendNDROnQuarantine=1
]]> Sat, 24 Jan 2015 10:04:29 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14700&title=filtering-from-addresses-with-in-them#14700 <![CDATA[filtering from addresses with : in them : No, or it would not have been...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14699&title=filtering-from-addresses-with-in-them#14699 Author: yapadu
Subject: 7104
Posted: 24 January 2015 at 10:03am

No, or it would not have been in my quarantine  Wink

However, I do think we have some option enabled where if we 'accept' the message but the destination is quarantine then we do not send back a rejection notice...  I think, that was some option in the .ini file but I have no idea what it was.

When we report the message as rejected, the number of calls/email messages we get for support just go through the roof. 
]]> Sat, 24 Jan 2015 10:03:47 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14699&title=filtering-from-addresses-with-in-them#14699 <![CDATA[filtering from addresses with : in them : I had received the 250 OK after...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14698&title=filtering-from-addresses-with-in-them#14698 Author: LogSat
Subject: 7104
Posted: 24 January 2015 at 9:59am

I had received the 250 OK after sending the email, so it looked as they were delivered. Do you have the option to "send to null" (::NULL suffix) for the keyword? ]]> Sat, 24 Jan 2015 09:59:22 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14698&title=filtering-from-addresses-with-in-them#14698 <![CDATA[filtering from addresses with : in them : Actually, I just checked my quarantine...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14697&title=filtering-from-addresses-with-in-them#14697 Author: yapadu
Subject: 7104
Posted: 24 January 2015 at 9:42am

Actually, I just checked my quarantine - and there are two messages there from you!  Triggered by a .click rule, this one:

Found Keywords: [((?im)^from:.*<.*\.click>)]
]]> Sat, 24 Jan 2015 09:42:15 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7104&PID=14697&title=filtering-from-addresses-with-in-them#14697