Page 1 of 2

Regex / custom filter questions

Posted: Fri Oct 21, 2016 10:05 pm
by eddiex666
Hi,
I have some custom filters, that does not trigger.

I have feks: "donuts" as a subject check / text and when i send "donuts" it does not stop it.
(i testet "*donuts*" and "Do you want a donuts" and all comes thru).

(the sender is not in the whitelist domain, ip or emails)

So I tryed this:
created a custom reg.ex filter based on Subject: "[Dd]onuts.*" i also testet "[Dd]onuts*" and only "[Dd]onuts"
But this does not work eather...

is there any tips? :-)

Re: Regex / custom filter questions

Posted: Sat Oct 22, 2016 12:00 am
by eddiex666
maybe the sender is "valid" on the internet and get thru because the "Bayesian" or "RBL" is ok?
should'nt the custom filter "triggers" anyway?

Re: Regex / custom filter questions

Posted: Sun Oct 23, 2016 12:03 pm
by nick.bolton
You can't use * in regular expressions, instead use the syntax from the regular expression engine http://www.regexlab.com/en/deelx/

Re: Regex / custom filter questions

Posted: Mon Oct 24, 2016 10:01 pm
by eddiex666
I read this...
"Here I’ve setup a complex regular expression custom filter to catch certain Nigerian scam emails. Firetrust can provide a list of custom filters on request"

How can we get this list?

Eddie

Re: Regex / custom filter questions

Posted: Mon Oct 24, 2016 10:24 pm
by nick.bolton
See attached.
ChineseAndScams.xml
(13.51 KiB) Downloaded 544 times

Re: Regex / custom filter questions

Posted: Thu Oct 27, 2016 10:26 pm
by eddiex666
hi nick..

tnx for good help.
I tryed to look into the reg ex filter...

but i dont get it working...

I wounder. -


if I create a reg.ex "(?-i)\b[Dd]ildo\b"
will this reg.ex filter "Dildo" "dildo" "My dildo" "Dildo my xxx" etc et c??

in text *Dildo*

Re: Regex / custom filter questions

Posted: Thu Oct 27, 2016 10:46 pm
by eddiex666
or turn around my question..
I would like to make a custom "subject filter" for any subject that includes "Dildo"

whats the best practice filter?

Re: Regex / custom filter questions

Posted: Fri Oct 28, 2016 2:39 am
by eddiex666
what i notise is that my reg-ex does not trigger, so maybe. its something else.
for example.

I have a reg-ex rules.. simple...
"@myemaildomain.com" (without ")
search in SUBJECT

and if i send an email with subject "Hi user@myemaildomain.com, you have money in the bank"

I would prefered it to stop it.. but it does not, why?

Eddie

Re: Regex / custom filter questions

Posted: Fri Oct 28, 2016 8:29 am
by nick.bolton
If you look at the subject line in the it's raw format, does it still look the same (ascii) or is it in some other format like base64?

Re: Regex / custom filter questions

Posted: Fri Oct 28, 2016 10:39 pm
by eddiex666
arg..
I can see that the rex ex filter is not like Norwegian chars????

for example: Å Ø Æ
The word "LÅN" (Loan) does not work in reg.ex

The regex matcher says "ok", :-)

But maybe a rex ex to filter "[Ll].[Nn]" should take "Lån / LÅN / LÅn / lÅN / etc etc ????

Re: Regex / custom filter questions

Posted: Sat Oct 29, 2016 9:50 am
by nick.bolton
Ok, can you test it in the regex lab appliction and see if it works there http://www.regexlab.com/mtracer/

Re: Regex / custom filter questions

Posted: Sat Oct 29, 2016 7:10 pm
by eddiex666
Hi Nick

I did that and i can see that all my rules including Norwegian chars is working with "Regex Match Tracer - v3.0"
But not inside MWES.
(So thats why I am asking (so mutch) )

For example:
I have so far been able to use custom filter - reg.ex - "[Ll].n" to filter "LÅN". (including Norwegian chars is not working in MWES so I use " . " to filter ""any"" match in that chars.

I have also created other test inside Match Tracer that works, but dont works in MWES.
Its confusing at the moment...

I trying to use the customfilter you gave me and I imported it to see if there is anything inside it that I can use.
But I would like to see a "simple" list of filtring examples.

For example: would this custom filter - reg.ex - SUBJECT "[Dd]onu.s" check stop spam mail "donuts" "donugs" etc etc

:-)

Eddie

Re: Regex / custom filter questions

Posted: Sat Oct 29, 2016 9:32 pm
by nick.bolton
Hi Eddie

Ok, looks like we're not doing something right - might be Unicode or some other character class. I'll ask the developers and get back to you.

That custom filter would work for donuts etc. If you use the regex Match Tracer and press F3 to test, it will tell you if it matches.
Here's a better guide for regular expressions https://qntm.org/files/re/re.html

Re: Regex / custom filter questions

Posted: Fri Nov 04, 2016 11:11 pm
by eddiex666
Hi Nick,

Now I have a example...

we have a reg.ex custom rule
subject check - "[Ff]or [Mm]eg|[Oo][Mm] [Dd]eg|[Tt]il deg|[Tt]il meg"

And we get a mail with subject "I går kveld har stjernene åpenbart for meg om deg"

I get 2 matches inside this mail subject on reg.ex test, but the MWES lets it thru, why?
I tested whit rexex matcher and https://regex101.com/

what are we doing wrong?

Eddie

Re: Regex / custom filter questions

Posted: Sun Nov 06, 2016 2:40 pm
by nick.bolton
I'll need to come back to you on this - talk to developers again. We are using UTf8 so it's a bit of a mystery at this stage.