Share Your Filters here!

[marisp]

Hello,

I'd like to post 3 scripts, which detect spam messages with the incorrect number and format of HTML tags. You can add those scripts to the Complex filters. Open the Complex filter and click Add button. Copy the 1st script and paste it to the Script Editor screen in the SpamCombat. Enter a filter name. Enter the Input Variable (click the right mouse button and select the field name):

Message_Body=
X_GSC_Size=

Click OK. Then click Add button again and add the 2nd script, then the 3rd script. At the result you will have 3 complex filters, which can be helpful in blocking spam emails.

1st script (filter name - Too many float : right)

Code: Select all

// Constants for result
// Set Result to 1  to say that this message is spam
// Set Result to 0  to say that this message is not spam
// Set Result to -1 to say that this message is not processed
// Reason in this string you can print additional information which will
// show in Status Column
//----------------
if X_GSC_Size < 5000
  then
   begin
    FloatCount := 0;
    source     := StrReplace(Message_Body, ' ', '', 1);
    source     := UpperCase(source);
    FTag       := 'FLOAT:RIGHT';
    FTagLength := Length(FTag);

    i := pos(FTag,source);

    while (i <> 0) and (Length(Source)> FTagLength) do
     begin
      source := copy(source, i+FTagLength, Length(source));
      inc(FloatCount);
      i := pos(FTag,source);
     end;

    if (FloatCount > 25)
     then
      begin
       Result := 1;
       Reason := 'Too many float : right: '+inttostr(FloatCount);
      end
     else
     Result := -1;
   end
  else
   Result := -1;

2nd script (filter name - Too many DIV in a small size message)

Code: Select all

// Constants for result
// Set Result to 1  to say that this message is spam
// Set Result to 0  to say that this message is not spam
// Set Result to -1 to say that this message is not processed
// Reason in this string you can print additional information which will
// show in Status Column
//----------------
if X_GSC_Size < 5000
  then
   begin
    DivCount := 0;
    source := UpperCase(Message_Body);
    FTag := 'DIV>';
    FTagLength := Length(FTag);

    i := pos(FTag,source);

    while (i <> 0) and (Length(Source)> FTagLength) do
     begin
      source := copy(source, i+FTagLength, Length(source));
      inc(DivCount);
      i := pos(FTag,source);
     end;

    if (DivCount > 50)
     then
      begin
       Result := 1;
       Reason := 'Too many DIV in a small size message: '+inttostr(DivCount);
      end
     else
      Result := -1;
   end
    else
     Result := -1;

3rd script (filter name - Too many single characters)

Code: Select all

// Constants for result
// Set Result to 1  to say that this message is spam
// Set Result to 0  to say that this message is not spam
// Set Result to -1 to say that this message is not processed
// Reason in this string you can print additional information which will
// show in Status Column
//----------------
if X_GSC_Size < 5000
  then
   begin
    CharCount := 0;
    source := UpperCase(Message_Body);
    FTag       := chr(13)+chr(10);
    FTagLength := Length(FTag);
    FLine      := '';

    i := pos(FTag,source);

    while (i <> 0) and (Length(Source)> FTagLength) do
     begin
      FLine := copy(source, 1, i);
      if Length(FLine) < 2
       then
        inc(CharCount);
     
      source := copy(source, i+FTagLength, Length(source));
      i := pos(FTag,source);
     end;
 
   if (CharCount > 40)
    then
     begin
      Result := 1;
      Reason := 'Too many single character line: '+inttostr(CharCount);
     end
    else
     Result := -1;
  end
   else
    Result := -1;

[Adam]

Hi there,
what kind a script or rule should I create to block generally emails which contains attachments with 'png' extension.
Thanks in advance for your reply

[marisp]

Hello Adam,

Please, open your blacklist and look for the "Suspicious attachment" filter (Field: X-GSC-Attachment:). There must be the regular expression, which catches the attachments with different file extenstions. You can simply add "png" to the range of file extensions:

Code: Select all

(?i)\.(png|hta|vb|vbe|vbs|wsh|reg|exe|pif|scr|bat|cmd|com|lnk|cpl)

As I remember we provide this filter within the blacklist by default. Butif you don't have such a filter, just add it. When done, click OK to save the blacklist.

[Adam]

thank you marisp

Hello Adam,

Please, open your blacklist and look for the "Suspicious attachment" filter (Field: X-GSC-Attachment:). There must be the regular expression, which catches the attachments with different file extenstions. You can simply add "png" to the range of file extensions:

Code: Select all

(?i)\.(png|hta|vb|vbe|vbs|wsh|reg|exe|pif|scr|bat|cmd|com|lnk|cpl)

As I remember we provide this filter within the blacklist by default. Butif you don't have such a filter, just add it. When done, click OK to save the blacklist.

[bradingram]

I have a requirement to check for certain words in the subject - but only for a given email address
i.e i need an IF within an IF (nested IFs), ive checked thru the complex filers in forums, and not found a similer procedure, and ive tried a few options with no luck - i guess its just down to the correct syntax - im looking for something along the lines of :

_To:= LowerCase(_To);
MyEmail := 'my_account@hotmail.com';

if pos(MyEmail,_To) <> 0 then

if word1 found OR
word2 found OR
word3 found
then
begin
Reason := 'banned words in myaccount@hotmail';
Result := 1;
end

end;






any suggestions greatfully accepted ...

[marisp]

Hello,

I'd like to share with you a filter that catches small size spam emails (that have less than 2 lines in the body). You can add this filter to the Complex filters in G-Lock SpamCombat.

Name: Small size emails

Input variables:

X_GSC_Size=
Viewable_HTML=
Message_Body=

Script:

Code: Select all

if X_GSC_Size < 5000

then
begin
if Trim(Viewable_HTML) = ''
then
source := Trim(Message_Body)
else

source := Trim(Viewable_HTML);

source := StrReplace(source,'</','',1);
source := StrReplace(source,'<','',1);
source := StrReplace(source,'>','',1);
source := Trim(Source);

if length(Source) = 0
then
  Source := Trim(Message_Body);

if Length(Source) < 200
then
  begin
Result := 1;
Reason := 'Too small size '+inttostr(Length(Source));
  end
else
Result := -1;
  end
else
Result := -1;

[markpud]

Hi all,

This blacklist filter catches "bounce" messages:

Field: Subject

Value:

(?i)(delivery status|delivery failure|automatically rejected|de estado de entrega|ihre mail an|failure notice|undeliverable|de remise|benachrichtung|returned mail|Benachrichtung|Returned Mail|delivery unsuccessful|mensagem automatica|mail could not be delivered|message not delivered|unable to deliver)

[pankajnagarkoti87]

However I did not mean any non-English character, but non-Western European characters (Asian, Arabic, Cyrillic...) because I cannot read them. The seven filters I suggested are very good in this job.

[marisp]

Here is a filter that catches the emails with non-English characters. You can add it to the Complex filters.

S_Subject := RegEx('[^\x00-\x80]+',Subject);
S_Body := RegEx('[^\x00-\x80]+',Message_Body);

if (S_Subject <> '') or (S_Body <> '')
then
begin
Result := 1;
Reason := 'non-English message';
// showMessage('Non Inglish')
end
else
begin
Result := -1;
// ShowMessage('English');
end;

Input variables:

Message_Body=
Subject=