Try these couple of lines in a Filter.
HEADERS 5 PCRE
(?im:From:.*(?i:v.{0,2}[|li1í!].{0,2}[a@/\\].{0,2}[gq].{0,2}r.{0,2}[a@/\\]).
*@)
HEADERS 5 PCRE (?im:From:.*
(?i:(v{1,}i{1,}a{1,}g{1,}r{1,}a{1,}).*@))
Let us know how it works.
David B
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Friday, February 08, 2008 7:11 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?
That may be but since I have a client that is seeing about 20 of these a day
all spelled the same he thinks I should be able to block it.
I want to know how to filter on the From line.
I never asked how many ways to spell the word.
Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Friday, February 08, 2008 4:15 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] How can I filter this...?
There are 1,300,925,111,156,286,160,896 ways to spell Viagra (see the update
at the bottom).
http://cockeyed.com/lessons/viagra/viagra.html
Going after the word is not the way to target the spam.
Matt
Chuck Schick wrote:
> Here is the From line.
>
> From: "viagra" <[EMAIL PROTECTED]>
>
> The X-declude Sender line is:
>
> X-Declude-Sender: [EMAIL PROTECTED] [190.172.162.107]
>
> Sorry, I was not clearer.
>
> We are getting tons of these with varying spellings of the viagra and
> the email address is always different.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
> David Barker
> Sent: Friday, February 08, 2008 1:56 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> How so, can you show the X-Declude-Sender line that it did not work on ?
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
> Chuck Schick
> Sent: Friday, February 08, 2008 3:50 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> David:
>
> The first one does not work.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
> David Barker
> Sent: Wednesday, February 06, 2008 12:25 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> Chuck you have several options:
>
>
> MAILFROM 5 STARTSWITH Viagra
> MAILFROM 5 CONTAINS Viagra
> MAILFROM 5 PCRE (?i:.*viagra.*@)
>
>
> David Barker
> VP Operations Declude
> Your Email security is our business
> 978.499.2933 x 7007 office
> 978.988.1311 fax
> [EMAIL PROTECTED]
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
> Chuck Schick
> Sent: Wednesday, February 06, 2008 2:17 PM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] How can I filter this...?
>
> Spam email is sent and the from line is
>
> "vigara" <[EMAIL PROTECTED]>
>
> Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender
> name of "vigara". Seems like it should be simple but it is eluding me.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail". The archives can be found at
> http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail". The archives can be found at
> http://www.mail-archive.com.
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail". The archives can be found at
> http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail". The archives can be found at
> http://www.mail-archive.com.
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail". The archives can be found at
> http://www.mail-archive.com.
>
>
>
---
This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
