Firetrust Support Forums

Neighbor is getting mail that shows as being FROM: h'u'lu and would like to mark such mail for deletion. He tells me that the apostrophes may be repeated (ex.: h''ul'u) and may occur following any of the letters h-u-l-u. But at least one of the four letters will have at least one following apostrophe.

The following regex was created to detect such occurrences (but allow 'hulu' with no apostrophes):

(?i)((h'+u'*l'*u'*)|(h'*u'+l'*u'*)|(h'*u'*l'+u'*)|(h'*u'*l'*u'+))

We have tested this regex using the RegexBuddy utility against the string 'h''uluhulu', and it appears to work OK - it matched the 'h''ulu' but not the following hulu. However, MailWasher does not get a match when an actual incoming email FROM: address of h''u'lu arrives.

Any guidance as to what's going on here?

As an update:

It appears that the MailWasher regex filter will the detect the bogus FROM address string if it's in the body of the message text, but it will not detect it when it's in whatever it displays as the FROM address.

That is, if the regex is (?i)a'b'c and the FROM string shows as a'b'c, the filter doesn't fire. However, if the same string (a'b'c) is in the text of the message, the filter does fire. (Note: Filter is defined to check Entire Message.)

I have not modified the filter to explicitly reference the FROM address - but will do that tomorrow.