Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Regex question
  FAQ FAQ  Forum Search   Register Register  Login Login

Regex question

 Post Reply Post Reply
Author
kspare View Drop Down
Senior Member
Senior Member


Joined: 26 January 2005
Location: Canada
Status: Offline
Points: 334
Post Options Post Options   Thanks (0) Thanks(0)   Quote kspare Quote  Post ReplyReply Direct Link To This Post Topic: Regex question
    Posted: 08 July 2010 at 5:40pm
I'm using ((?i)Subject: .*(((Rolex)|(Beitling))))::Honeypot to get rid of messages with the subject

Rolex, Beitling, Bvlgari, Cartier, Chanel, Tag Heuer, and lots more!

but it's not going to the honey pot. What am I doing wrong here?
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 13 July 2010 at 9:32pm
kspare,

I'm not able to replicate this... When using the keyword line you posted:

((?i)Subject: .*(((Rolex)|(Beitling))))::Honeypot

And sending a test email with this subject:
Subject: Rolex, Beitling, Bvlgari, Cartier, Chanel, Tag Heuer, and lots more!

In SpamFilter's activity logfile I do see the following (and verified that the IP does indeed get added to the BL_HoneypotBlockedIPs.txt file):

07/13/10 21:21:49:359 -- (292) Connection from: 192.168.167.129  -  Originating country : N/A
07/13/10 21:21:50:531 -- (292) - Added 192.168.167.129 to honeypot blacklist
07/13/10 21:21:50:531 -- (292) Found Keywords: [((?i)Subject: .*(((Rolex)|(Beitling))))::Honeypot]
07/13/10 21:21:50:531 -- (292) EMail from test1@test.logsat.com to test2@test2.logsat.com matches content filter rules - rejected.

If you can please zip me the section of SpamFilter's activity logfile showing the incoming email (please include a few extra minutes before and after the email to be sure to capture all events), along with the to/from email addresses involved, and the BL_HoneypotBlockedIPs.txt file (if SpamFilter Enterprise, please ensure to provide the file relative to either "ALL DOMAINS", or, if the recipient's domain has been configured not to use the default settings, relative to the domain in question)?
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.175 seconds.