PMMail and filters - this one is not working...why?

[Dariusz Piatkowski]

So my very, very old email address has gone through cycles of SPAM...but this latest hit is a prolonged one and so I've decided to cook up some extra filters to deal with that challenge.

Luckily for me the vast majority of SPAM email addresses end with a couple of string patters. Here is an example of an email HEADER:

Code: [Select]

...
Date: Fri, 10 Jun 2022 16:04:45 -0400
From: Beth Buttler <beth_buttler@bunsonlinesz.click>
To:   <BLOCKED_FOR_MY_SANITY>
Subject: Your Home Depot Verification No.  #3232007
...

You will noticed the from email address ends with ".click", I am also getting a pile of ".xyz" as well, easy enough to spot!

So to deal with this I figured that I'd just "beef up" my existing filters by adding the following;

Code: [Select]

(h.fromid.-z = "click" | h.fromid.-z = "xyz")

...alas, this does NOT work, and I cannot figure out why???

That filter is supposed to tell PMMail to simply look for a "*click" or "*xyz" in the actual email address field itself.

So I'm curious, is anything jumping out at anyone here?

Thanks!

[Matt Walsh]

In PMMail 3.25 I just use the built in filter builder under account.
Quick and works for me.  Example attached.

[Doug Bissett]

So to deal with this I figured that I'd just "beef up" my existing filters by adding the following;

Code: [Select]

(h.fromid.-z = "click" | h.fromid.-z = "xyz")

...alas, this does NOT work, and I cannot figure out why???

Okay, it has been a LONG time since I tried complex filters, it is much easier to do as Matt suggests.

However:

I don't see "-z" documented. Do you mean something else?

I would expect that "h.fromid." should be "h.fromid" (without the trailing dot).

If that doesn't help, I suggest going to the PMMail user mail list, and ask where PMMail users hang out. You can subscribe (or unsubscribe) here: http://www.os2voice.org/mailinglists.html if needed.

[Dariusz Piatkowski]

Hi Matt,

In PMMail 3.25 I just use the built in filter builder under account.
Quick and works for me.  Example attached.

Yup, I've got a few "quick" filters as well...but in this case I already had the complex filters built because that way I can toss multiple "and if that also do this" cases into a single filter as opposed to building multiple ones.

[Dariusz Piatkowski]

Hi Doug,

So to deal with this I figured that I'd just "beef up" my existing filters by adding the following;

Code: [Select]

(h.fromid.-z = "click" | h.fromid.-z = "xyz")

...alas, this does NOT work, and I cannot figure out why???

...

I don't see "-z" documented. Do you mean something else?

I would expect that "h.fromid." should be "h.fromid" (without the trailing dot).

Oh yeah, its out there, just sort of burried inside the Help screens. This is supposed to provide wildcard match where the "xyz" occurs at the end of the string (that's the meaning behind "-z" option), so in effect you would be picking up stuff like "bad_player@spamer.xyz".

The result should be that I trap all email addresses that originate from the ".xyz" domain, or claim to be orginating there.

I am starting to wonder if the "Header" fields do NOT actually contain this (this being SPAM and all that), despite the fact that PMMail does actually show this when exposing the email Header info.

Worst case is that like Matt suggetsed, I default to building a quick filter.

For what it's worth, I probably have about 20-30 of these complex filters built (have had them for years) and while they do take a little bit of effort to initially create, they do work extremely well.

[Neil Waldhauer]

A few versions ago, my complex PMMail filter ran out of space (1024 char maximum). This was fixed. I don't recall what the max length is now, but longer than 1024.

[Doug Bissett]

Oh yeah, its out there, just sort of burried inside the Help screens. This is supposed to provide wildcard match where the "xyz" occurs at the end of the string (that's the meaning behind "-z" option), so in effect you would be picking up stuff like "bad_player@spamer.xyz".

I don't find it. What version of PMMail are you using? Way back, after VOICE got the code, it was discovered that a number of those things actually didn't do what they were supposed to do. That was fixed, but not necessarily according to what was happening, or what was described, in the previous versions of PMMail.

I would also suggest that this sort of SPAM filtering is very much better handled by the PMMail SPAM filter (BogoFilter), than by trying to manually build the type of filters that you are attempting to use. The SPAM filter does require some initial training (good, and bad), but once it is trained it will do a great job, and is easy to use. On going training will be required, but it is a lot easier than trying to figure out complex filters..

[Dariusz Piatkowski]

Doug,

I don't find it. What version of PMMail are you using? Way back, after VOICE got the code, it was discovered that a number of those things actually didn't do what they were supposed to do. That was fixed, but not necessarily according to what was happening, or what was described, in the previous versions of PMMail.

I'm on "3.25.00.1993 (32809) - Jul 25 2021 13:20:17 +0000 (GMT)".

Search for ".-z" in Help, for me it comes up under the "ICSL Help" section.

...I would also suggest that this sort of SPAM filtering is very much better handled by the PMMail SPAM filter (BogoFilter), than by trying to manually build the type of filters that you are attempting to use...

That is in fact what I started to do this past week.

I was aware of the functionality, however I just never took the time to investigate it further as my regular SPAM filter collection was working very well for me. However, as you pointed out, I am now using this functionality and it seems to be picking up the SPAM fairly well!

[Doug Bissett]

Search for ".-z" in Help, for me it comes up under the "ICSL Help" section.

So it does, Odd that I can't search for "-z" and find it. The docs say "-z", not ".-z" (could that be the problem?). This would seem to be some sort of a problem, that needs to be investigated. I will create a problem report. It could be the way that it is coded in the help file, or it could be a problem with searching in the help program.

I am now using this functionality and it seems to be picking up the SPAM fairly well!

Many years ago, I learned that BogoFilter is a very good way to filter SPAM. I still use it, but I am pretty sure that my ISP has a pretty good SPAM filter too, so I never see SPAM any more. That concerns me in two ways. One is that I don't know if the ISP is filtering out good messages, and two, I can't test that Bogofilter is still working.

One tip: Try to train equal amounts of good messages, and bad ones. If you get it unbalanced, it doesn't work as well.