Regex / custom filter questions

Anything else, but be polite...
eddiex666
Travelling Tuatara
Posts: 42
Joined: Fri Aug 05, 2016 12:30 am

Regex / custom filter questions

Fri Oct 21, 2016 10:05 pm

Hi,
I have some custom filters, that does not trigger.

I have feks: "donuts" as a subject check / text and when i send "donuts" it does not stop it.
(i testet "*donuts*" and "Do you want a donuts" and all comes thru).

(the sender is not in the whitelist domain, ip or emails)

So I tryed this:
created a custom reg.ex filter based on Subject: "[Dd]onuts.*" i also testet "[Dd]onuts*" and only "[Dd]onuts"
But this does not work eather...

is there any tips? :-)
eddiex666
Travelling Tuatara
Posts: 42
Joined: Fri Aug 05, 2016 12:30 am

Re: Regex / custom filter questions

Sat Oct 22, 2016 12:00 am

maybe the sender is "valid" on the internet and get thru because the "Bayesian" or "RBL" is ok?
should'nt the custom filter "triggers" anyway?
User avatar
nick.bolton
The Big Cheese
Posts: 2468
Joined: Thu Aug 28, 2008 4:02 pm

Re: Regex / custom filter questions

Sun Oct 23, 2016 12:03 pm

You can't use * in regular expressions, instead use the syntax from the regular expression engine http://www.regexlab.com/en/deelx/
eddiex666
Travelling Tuatara
Posts: 42
Joined: Fri Aug 05, 2016 12:30 am

Re: Regex / custom filter questions

Mon Oct 24, 2016 10:01 pm

I read this...
"Here I’ve setup a complex regular expression custom filter to catch certain Nigerian scam emails. Firetrust can provide a list of custom filters on request"

How can we get this list?

Eddie
User avatar
nick.bolton
The Big Cheese
Posts: 2468
Joined: Thu Aug 28, 2008 4:02 pm

Re: Regex / custom filter questions

Mon Oct 24, 2016 10:24 pm

See attached.
ChineseAndScams.xml
(13.51 KiB) Downloaded 545 times
eddiex666
Travelling Tuatara
Posts: 42
Joined: Fri Aug 05, 2016 12:30 am

Re: Regex / custom filter questions

Thu Oct 27, 2016 10:26 pm

hi nick..

tnx for good help.
I tryed to look into the reg ex filter...

but i dont get it working...

I wounder. -


if I create a reg.ex "(?-i)\b[Dd]ildo\b"
will this reg.ex filter "Dildo" "dildo" "My dildo" "Dildo my xxx" etc et c??

in text *Dildo*
eddiex666
Travelling Tuatara
Posts: 42
Joined: Fri Aug 05, 2016 12:30 am

Re: Regex / custom filter questions

Thu Oct 27, 2016 10:46 pm

or turn around my question..
I would like to make a custom "subject filter" for any subject that includes "Dildo"

whats the best practice filter?
eddiex666
Travelling Tuatara
Posts: 42
Joined: Fri Aug 05, 2016 12:30 am

Re: Regex / custom filter questions

Fri Oct 28, 2016 2:39 am

what i notise is that my reg-ex does not trigger, so maybe. its something else.
for example.

I have a reg-ex rules.. simple...
"@myemaildomain.com" (without ")
search in SUBJECT

and if i send an email with subject "Hi user@myemaildomain.com, you have money in the bank"

I would prefered it to stop it.. but it does not, why?

Eddie
User avatar
nick.bolton
The Big Cheese
Posts: 2468
Joined: Thu Aug 28, 2008 4:02 pm

Re: Regex / custom filter questions

Fri Oct 28, 2016 8:29 am

If you look at the subject line in the it's raw format, does it still look the same (ascii) or is it in some other format like base64?
eddiex666
Travelling Tuatara
Posts: 42
Joined: Fri Aug 05, 2016 12:30 am

Re: Regex / custom filter questions

Fri Oct 28, 2016 10:39 pm

arg..
I can see that the rex ex filter is not like Norwegian chars????

for example: Å Ø Æ
The word "LÅN" (Loan) does not work in reg.ex

The regex matcher says "ok", :-)

But maybe a rex ex to filter "[Ll].[Nn]" should take "Lån / LÅN / LÅn / lÅN / etc etc ????
User avatar
nick.bolton
The Big Cheese
Posts: 2468
Joined: Thu Aug 28, 2008 4:02 pm

Re: Regex / custom filter questions

Sat Oct 29, 2016 9:50 am

Ok, can you test it in the regex lab appliction and see if it works there http://www.regexlab.com/mtracer/
eddiex666
Travelling Tuatara
Posts: 42
Joined: Fri Aug 05, 2016 12:30 am

Re: Regex / custom filter questions

Sat Oct 29, 2016 7:10 pm

Hi Nick

I did that and i can see that all my rules including Norwegian chars is working with "Regex Match Tracer - v3.0"
But not inside MWES.
(So thats why I am asking (so mutch) )

For example:
I have so far been able to use custom filter - reg.ex - "[Ll].n" to filter "LÅN". (including Norwegian chars is not working in MWES so I use " . " to filter ""any"" match in that chars.

I have also created other test inside Match Tracer that works, but dont works in MWES.
Its confusing at the moment...

I trying to use the customfilter you gave me and I imported it to see if there is anything inside it that I can use.
But I would like to see a "simple" list of filtring examples.

For example: would this custom filter - reg.ex - SUBJECT "[Dd]onu.s" check stop spam mail "donuts" "donugs" etc etc

:-)

Eddie
User avatar
nick.bolton
The Big Cheese
Posts: 2468
Joined: Thu Aug 28, 2008 4:02 pm

Re: Regex / custom filter questions

Sat Oct 29, 2016 9:32 pm

Hi Eddie

Ok, looks like we're not doing something right - might be Unicode or some other character class. I'll ask the developers and get back to you.

That custom filter would work for donuts etc. If you use the regex Match Tracer and press F3 to test, it will tell you if it matches.
Here's a better guide for regular expressions https://qntm.org/files/re/re.html
eddiex666
Travelling Tuatara
Posts: 42
Joined: Fri Aug 05, 2016 12:30 am

Re: Regex / custom filter questions

Fri Nov 04, 2016 11:11 pm

Hi Nick,

Now I have a example...

we have a reg.ex custom rule
subject check - "[Ff]or [Mm]eg|[Oo][Mm] [Dd]eg|[Tt]il deg|[Tt]il meg"

And we get a mail with subject "I går kveld har stjernene åpenbart for meg om deg"

I get 2 matches inside this mail subject on reg.ex test, but the MWES lets it thru, why?
I tested whit rexex matcher and https://regex101.com/

what are we doing wrong?

Eddie
User avatar
nick.bolton
The Big Cheese
Posts: 2468
Joined: Thu Aug 28, 2008 4:02 pm

Re: Regex / custom filter questions

Sun Nov 06, 2016 2:40 pm

I'll need to come back to you on this - talk to developers again. We are using UTf8 so it's a bit of a mystery at this stage.

Return to “Miscellaneous”