Regex Keyword Filter on Subject
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5568
Printed Date: 12 March 2025 at 6:53am
Topic: Regex Keyword Filter on Subject
Posted By: caratking
Subject: Regex Keyword Filter on Subject
Date Posted: 03 April 2006 at 12:40am
|
These home loan, and chase bank emails are really getting to me. I started doing some regex keywords to stop these, and found some samples for subject keyword filters on this forum. My test messages get stopped, but the real spam do not. For example, this one just got past: From: "Hubert Hendrix" < mailto:brian_schlessinger@time-inc.com - brian_schlessinger@time-inc.com > This filter should have caught it, right? ((?i)Subject:(.*?)(equity)(.*?)(loan)(.*?)) I don't see what I'm doing wrong, any help would be appreciated. I'm assuming the (?i) makes it case insensitive. |
Replies:
Posted By: Desperado
Date Posted: 04 April 2006 at 1:27pm
|
caratking, If you are trying to block that subject, I would have done: ((?i)Subject:.*equity.*loan) But it is not much different than yours. (?i) forces no case checking with the glitch that I believe case is determined by your servers "locale" settings so if you are using a non standard locale, there *may* be some very obscure issue (not that I can think of any). ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
Posted By: caratking
Date Posted: 05 April 2006 at 7:26pm
|
I just can't get this subject filtering to work... I changed the filters to try and simplify things, this is a sample one: ((?i)Subject:.*(mortag|mortgage)(.*?)(approv|rate)) The SPAM just keep coming through, here is an example of one (of hundreds) that slipped past overnight. Microsoft Mail Internet Headers Version 2.0 --------------AttPart_86833495==.OLA --------------AttPart_86833495==.OLA
|
Posted By: Desperado
Date Posted: 05 April 2006 at 7:30pm
|
Hmmm .. do you have ScanReceivedHeaders=1 in your ini file? ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
Posted By: caratking
Date Posted: 05 April 2006 at 7:32pm
|
I believe I have found the problem, it is not specifically related to the keyword filters. After pasting the above header, I noticed Spam Filter ISP inserted this: X-SF-WhiteListedReason: Whitelisted EMail Address To The above SPAM was sent to two people, forum & jteditor. The jteditor account is whitelisted (they were complaining about false positives - so they get whitelisted). Problem is, the forum email goes through because one of the people the message was for is whitelisted. If someone sends the spam to 5 users, and one of them is whitelisted the other four people will get the message. This seems like a possible bug to me. This explains why my test messages were getting blocked, and the real spam gets through... |
Posted By: sgeorge
Date Posted: 06 April 2006 at 4:47pm
caratking, I agree with you, I think that one whitelisted recipient shouldn't make everyone else receive the email as well. While that is a problem, I found a work-around that should provide the correct functionality:
Thanks again for your help with AuthTo lists, Stephen |