CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

Filter Help!

 
Post new topic   Reply to topic       All -> FavForums -> Mailwasher - Troubleshooting / General [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
Web Dawg

Guest
IP: 209.250.*.*






PostPosted: Thu Dec 04, 2003 3:34 pm    Post subject: Filter Help!
Reply with quote

I know this was posted earlier, but I can't find it now.

I want to add ALL emails from addresses that start with a number, to my blacklist.

Anyone have the formula?

Thanks

Back to top
denn988

Guest
IP: 66.44.*.*






PostPosted: Thu Dec 04, 2003 5:42 pm    Post subject:
Reply with quote

Rather than having it placed on your blacklist, you might just want to filter it to be marked for deletion and NOT deleted automatically.

If, after time, you should find that you are getting no false positives on this, then yopu may want to have that filter auto-delete.

In the meantime...a filter that you could play with could be set up something like this:

The return path...
contains RegExpr...

Code:
<\d+[\w.]*?@


Mark mail to be deleted...
perform the action: on "Proccess mail" (recommended)

You may want to think about this before you auto-delete on this stratrgy. There is nothing that prevents a legitimate user from having an e-mail address that begins with a number. I have seen such legitimate addresses (for example..."1jewell@..."). Any filter that looks for such an address could result in false positives.

Back to top
Web Dawg

Guest
IP: 209.250.*.*






PostPosted: Thu Dec 04, 2003 6:14 pm    Post subject:
Reply with quote

Is this the correct way to enter the filter?

Rules:

The "From Field"
contains
<\d+[\w.]*?@

Back to top
Perry

Lieutenant
Lieutenant


Joined: Oct 19, 2003
Posts: 291
Location: USA

PostPosted: Thu Dec 04, 2003 9:20 pm    Post subject:
Reply with quote

denn988 wrote:
Rather than having it placed on your blacklist, you might just want to filter it to be marked for deletion and NOT deleted automatically.

If, after time, you should find that you are getting no false positives on this, then yopu may want to have that filter auto-delete.

In the meantime...a filter that you could play with could be set up something like this:

The return path...
contains RegExpr...
Code:
<\d+[\w.]*?@


Mark mail to be deleted...
perform the action: on "Proccess mail" (recommended)

You may want to think about this before you auto-delete on this stratrgy. There is nothing that prevents a legitimate user from having an e-mail address that begins with a number. I have seen such legitimate addresses (for example..."1jewell@..."). Any filter that looks for such an address could result in false positives.


You could use the auto delete by number and auto delete by letter if you include the second part of the address. Some providers do use numbers as the first part of the local part so if used such a filter and a second part of it included the domain then you would have an accurate filter. Likewise some providers do not use numbers at all or have trailing numbers in the local part. Doing a similar check on the domain would provide another accurate filter.

I would never autodelete using a singular filter for numbers, however I certainly would if I knew the formats of various providers for the local part of the address.

Perry

Back to top
View users profile Send private message Visit posters website
Web Dawg

Guest
IP: 209.250.*.*






PostPosted: Thu Dec 04, 2003 9:47 pm    Post subject:
Reply with quote

This formula
<\d+[\w.]*?@
fixed an email address like below

903xtijmc@yahoo.com

but......... I need a formula for emails when the user name is just numbers like 100984914005@mail2.ways-to-get-laid.com

Thanks for all your help.

Back to top
Web Dawg

Guest
IP: 209.250.*.*






PostPosted: Fri Dec 05, 2003 3:59 am    Post subject:
Reply with quote

bump

Thanks

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16542

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Fri Dec 05, 2003 4:53 am    Post subject:
Reply with quote

Web Dawg wrote:
This formula
<\d+[\w.]*?@
fixed an email address like below

903xtijmc@yahoo.com

but......... I need a formula for emails when the user name is just numbers like 100984914005@mail2.ways-to-get-laid.com

Thanks for all your help.

So only look for digits before the '@' sign. Something like
Code:
<\d*?@

should do it.

Back to top
View users profile Send private message
denn988

Guest
IP: 66.44.*.*






PostPosted: Fri Dec 05, 2003 1:21 pm    Post subject:
Reply with quote

Web Dawg wrote:
This formula
<\d+[\w.]*?@
fixed an email address like below

903xtijmc@yahoo.com

but......... I need a formula for emails when the user name is just numbers like 100984914005@mail2.ways-to-get-laid.com

Thanks for all your help.


Web Dawg,

The expression will work for all numbers as well. There is no need to use a different expression for the example you have given.

If, on the other hand, you need a filter that will only trigger on 'all numbers', use the filter variance that Ikeb posted (<\d*?@) , except change the * to a +. You would want to trigger on at least one numeral.

Back to top
Web Dawg

Guest
IP: 209.250.*.*






PostPosted: Fri Dec 05, 2003 1:40 pm    Post subject:
Reply with quote

Thanks everyone. I will give these a test.

Back to top
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Mailwasher - Troubleshooting / General All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer