| View previous topic :: View next topic |
| Author |
Message |
IP: 62.190.*.*
Guest
|
 Posted: Sun Dec 07, 2003 5:23 pm Post subject: Newbie: How do I filter Subject Lines containing "hi&qu |
|
|
Don't want to exlcude "high" or "higher" etc.
It's jsut that the number of Posts yelling "hi" is ridiculous.
Thanks
|
|
| Back to top |
|
 |
IP: 68.51.*.*
Guest
|
| Posted: Mon Dec 08, 2003 12:17 am Post subject: |
|
|
In the filter creation box just choose the field The 'Subject' field and then in the next field make sure contains is chosen, then in the next field type in hi.
As far as I know that should do it but the above I think would hit on any instance of Hi in the subject line. Now if you want to filter on just when Hi is the only word in the subject line then someone around here who is good with regular expressions will have to help you out.
|
|
| Back to top |
|
|
i-byron
Guest
IP: 12.72.*.*
|
| Posted: Wed Dec 10, 2003 1:31 am Post subject: rule for just "hi" on subject line |
|
|
-- To weed out emails with a subject of just "hi" --
filter the subject field, containing RegExp, as follows:
^hi$
because
^ = beginning of line
$ = end of line
-or variations like the one below to handle trailing junk or spaces:
^hi([\s\W]*)$
|
|
| Back to top |
|
|
denn988
Guest
IP: 66.44.*.*
|
| Posted: Wed Dec 10, 2003 2:14 am Post subject: |
|
|
I have noticed something about most SPAM that I receive that starts out with 'Hi' in the Subject.
That is the fact that most of them use ISO charator encoding.
If you look at the 'RAW TEXT' of these messages so that you can see the header, you might notice as I did that the SUBJECT line will begin:
| Code: | | Subject: =?ISO-8859- |
The above will be followed by gobbledegook. It is an encoding scheme that is used by Spammers to obfuscate the subject so that simple word filters cannot be used on the Subject line.
If you look at the Spam that you receive and see this kind of thing coming in, try the following filter:
If the entire header....
contains...
Subject: =?ISO-8859-
Mark message to be deleted.
If, after a while, you should determine that the filter is one that you can trust to have no false positives, you can mark it for auto-deletion.
Note:
I trap less than 5% of my incoming SPAM with this filter....but I consider it to be a HIREL (High Reliability) filter because there is not much reason for a legitimate message to use this method. It is pretty much only used by senders who want to get it past your filters.
Also...
The filter cannot be setup to look at the 'Subject field' in MWP...it must look into the entire (untranslated) header.
|
|
| Back to top |
|
|
Ghol
Trooper
Joined: Dec 14, 2003
Posts: 14
Location: Germany
|
| Posted: Tue Dec 16, 2003 6:05 pm Post subject: |
|
|
| denn988 wrote: |
That is the fact that most of them use ISO charator encoding.
...
It is an encoding scheme that is used by Spammers to obfuscate the subject so that simple word filters cannot be used on the Subject line. |
Not as simple as that – not just a matter of "obfuscation": I live in Germany and so get mails with ISO characters in the subject line!!
So be warned: if there is any possibility that someone might send you a header with an ISO character (e.g. German umlauts), you'd need to add a filter to exclude those emails from being deleted!!
|
|
| Back to top |
|
|
denn988
Guest
IP: 66.44.*.*
|
| Posted: Tue Dec 16, 2003 6:34 pm Post subject: |
|
|
Ghol,
I am always willing to listen to objections and concerns raised by others.
When you get those messages with non-standard text (German umlauts)...does the RAW Subject line in the header begin with =?ISO-8859- ....or do they use individual charactor codes such as ä ( & #228; - without the space between the & #)???
That would make a big difference...
Send yourself a test message using the umlauts and see what the RAW header looks like on the 'Subject;' line of the header....then post your findings here..
|
|
| Back to top |
|
|
Ghol
Trooper
Joined: Dec 14, 2003
Posts: 14
Location: Germany
|
| Posted: Tue Dec 16, 2003 6:47 pm Post subject: |
|
|
OK. This was the mail (header excerpt) that arrived from a customer called Jürgen, the other word is "Änderungen":
Date: Tue, 16 Dec 2003 18:25:06 +0100
Subject: 2 people... kleine =?ISO-8859-1?B?xA==?=nderungen
From: J=?ISO-8859-1?B?/A==?=rgen Sxxxxxxxxxx <mail@domain.de>
After working on the file, I "replied", and this was the subject in the header (I sent myself a copy to test).
To: <ghol@mycooldomain.de>
Subject: =?iso-8859-1?Q?WG:_2_people..._kleine_=C4nderungen?=
Date: Tue, 16 Dec 2003 18:53:42 +0100
What I found interesting was that the position of the _ISO_ had changed automatically. By the way,
"WG:" is German for "FW:" and the word again is an "Änderungen".
And the code for the umlaut changes.
|
|
| Back to top |
|
|
Ghol
Trooper
Joined: Dec 14, 2003
Posts: 14
Location: Germany
|
| Posted: Tue Dec 16, 2003 8:09 pm Post subject: |
|
|
I just wrote myself a mail. With a new mail the ISO bit is obviously at the beginning of the line. Even in German mails it only appears in the subject if there is an ISO character in the line. Thought I would show you the body too:
From: "ghol" <ghol@mydomain.de>
To: <ghol@samedomain.de>
Subject: =?iso-8859-1?Q?=D6ffnen_des_angeh=E4ngten_Dokumentes?=...
...
...
...
This is a multi-part message in MIME format.
------=_NextPart_000_008B_01C3C411. ...
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Sehr geehrter Herr M=FCller,=20
=20
Mit freundlichen Gr=FC=DFen
=20
Ihr Herr M=F6ller=20
------=_NextPart_000_008B_01C3C411. ......
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<TITLE>Nachricht</TITLE>
<META content=3D"MSHTML 6.00.2800.1276" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D078580819-16122003><FONT size=3D2>Sehr geehrter Herr =
M=FCller,=20
</FONT></SPAN></DIV>
<DIV><SPAN class=3D078580819-16122003><FONT =
size=3D2></FONT></SPAN>&</DIV>
<DIV><SPAN class=3D078580819-16122003><FONT size=3D2>Mit freundlichen=20
Gr=FC=DFen</FONT></SPAN></DIV>
<DIV><SPAN class=3D078580819-16122003><FONT =
size=3D2></FONT></SPAN>&</DIV>
<DIV><SPAN class=3D078580819-16122003><FONT size=3D2>Ihr Herr=20
M=F6ller</FONT>&</SPAN></DIV></BODY></HTML>
[/quote]
|
|
| Back to top |
|
|
denn988
Guest
IP: 66.44.*.*
|
|
| Back to top |
|
|
Ikeb
Special Response Team
Forums Admin
Joined: Apr 20, 2003
Posts: 16509
|
| Posted: Wed Dec 17, 2003 7:32 am Post subject: |
|
|
What would be the solution to exclude a vaid Unicode-encoded Subject?
|
|
| Back to top |
|
|
denn988
Guest
IP: 66.44.*.*
|
| Posted: Wed Dec 17, 2003 1:32 pm Post subject: |
|
|
| Ikeb wrote: | | What would be the solution to exclude a vaid Unicode-encoded Subject? |
Ikeb,
It would be the same exept there would be four Hex digits instead of two, and the digits would be enclosed in {}.
| Code: | | [\x{nnnn}-\x{nnnn}] |
|
|
| Back to top |
|
|
Ghol
Trooper
Joined: Dec 14, 2003
Posts: 14
Location: Germany
|
| Posted: Wed Dec 17, 2003 1:49 pm Post subject: |
|
|
@Denn998: yes, it works (so far). Thank you for that addition. And the link is useful. So now I could even specify exactly which German characters I accept, but that's hardly necessary, and there are more pressing filters to sort out.
|
|
| Back to top |
|
|
Ikeb
Special Response Team
Forums Admin
Joined: Apr 20, 2003
Posts: 16509
|
| Posted: Wed Dec 17, 2003 4:21 pm Post subject: |
|
|
| denn988 wrote: | | Ikeb wrote: | | What would be the solution to exclude a vaid Unicode-encoded Subject? |
Ikeb,
It would be the same exept there would be four Hex digits instead of two, and the digits would be enclosed in {}.
| Code: | | [\x{nnnn}-\x{nnnn}] |
|
But what i'm wondering is what the valid characters would be. Also does the ISO reference remain unchanged as well?
|
|
| Back to top |
|
|
denn988
Guest
IP: 66.44.*.*
|
| Posted: Wed Dec 17, 2003 5:55 pm Post subject: |
|
|
Ikeb,
I was nice to you once and posted a few colors for you. Please don't think that because I did that, that I am going to create a post that contains all 65536 possible charactors available with UNICODE.
If you want to see what the charactors might consist of, please follow the links on this page.
|
|
| Back to top |
|
|
Ikeb
Special Response Team
Forums Admin
Joined: Apr 20, 2003
Posts: 16509
|
|
| Back to top |
|
|
|
|
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
It does seem like it would be a huge task. 