Subject: [Possible SPAM]=?KOI8-U?B?y8/OxqbExc7DpsrOpiDVx8/EyQ==?=
I am trying to catch the a spam with above subject listed with the below
line:
ANYWHERE 25 PCRE
(?i:((charset|content|lang)=.{0,2}koi8-(r|t|u|ru))|(=\?koi8-(r|t|u|ru)\?[bq]
\?))
Can anyone see what I'm doing
Your PCRE should trigger on:
=?KOI8-U?B?
Subject: [Possible SPAM]=?KOI8-U?B?y8/OxqbExc7DpsrOpiDVx8/EyQ==?=
From: Scott Fisher [mailto:sfis...@farmprogress.com]
Sent: Wednesday, November 16, 2011 12:49 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] PCRE help
Subject
and not being END'ed before that
line is encountered?
Andrew.
From: Scott Fisher [mailto:sfis...@farmprogress.com]
Sent: Wednesday, November 16, 2011 9:49 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] PCRE help
Subject: [Possible SPAM]=?KOI8
Where can I find information on PCRE formatting including what characthers have
to be escaped?John T
eServices For You
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can
To: declude.junkmail
Subject: [Declude.JunkMail] PCRE information
Where can I find information on PCRE formatting including what characthers have
to be escaped?
John T
eServices For You
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
I am taking my first stab at regular expressions.
Trying to write a line to catch all of the @ allen info xx . info from
addresses.
So far, I have mailfrom 10 PCRE @allen(*{0,6}).info
Is that to broad or not efficient? (I think that means look for any 6
characters between @allen and .info is a
May 2008 17:07
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] PCRE check
I am taking my first stab at regular expressions.
Trying to write a line to catch all of the @ allen info xx . info from
addresses.
So far, I have mailfrom 10 PCRE @allen(*{0,6}).info
Is that to broad
PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
Sent: Friday, May 23, 2008 11:07 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] PCRE check
I am taking my first stab at regular expressions.
Trying to write a line to catch all of the @ allen info xx . info from
addresses.
So
Thanks David.John T
eServices For You
-Original Message-
From: David Barker [EMAIL PROTECTED]
Sent 5/23/2008 8:22:11 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE check(?i:allen.{0,6}\.info) All
expressions must be in parenthesis ?i: non case sensitive
Is there any way to make a PCRE work like a NOTCONTAINS.
I have this filter line:
MAILFROM END NOTCONTAINS @aim.
I also need to add @aol.com to that.
Obviously two notcontains won't work. Is there a way to work the NOT into a
PCRE expression?
Scott Fisher
Director of IT
: [Declude.JunkMail] PCRE and NOTCONTAINS
Is there any way to make a PCRE work like a NOTCONTAINS
I have this filter line:
MAILFROM END NOTCONTAINS @aim.
I also need to add @aol.com to that.
Obviously two notcontains wont work. Is there a way to work the NOT into a
PCRE expression
Does the PCRE support extended characters?
For instance would this detect all lower case characters?
SUBJECT END PCRE
([a-zàáâãäçåéèêëìíîïñòóôõöùúûüýÿ])
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
:\bERMX\b)
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 12:15 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
UGGH, it always takes sending something to a LOT of people for you
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Hi Todd,
A couple of suggestions
(?i:receive.*(postcard|greeting|ecard|e-card))
could also be written as:
(?i:receive.{0,50}(postcard|greeting|e.?card))
As you are checking anywhere you want to limit the amount
Is there anything special that I need to have turned on to take advantage
of this? I've been playing around with it, and really like what it can do.
Being a complete newbie to regex, I've been using Regex Buddy to test the
expressions before putting them into production. However, I'm not seeing
-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 11:08 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] PCRE tests
Is there anything special that I need to have turned on to take advantage
of this? I've been playing around
Yeah, just checked - it's there. :)
Todd
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Friday, July 06, 2007 10:53 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Also make sure there is the pcre3
.
Let me change that and report back!
Todd
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 10:59 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Hi David -
Yes, I just confirmed
Also make sure there is the pcre3.dll in your imail folder.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, July 06, 2007 10:18 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Todd,
Ensure you
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Todd,
Ensure you have version 4.3.46 of Declude. The format of an expression is:
LOCATIONWEIGHT PCRE(EXPRESSION)
Eg.
BODY5 PCRE(?i:Hello World)
Post some examples that you
OK, it's working. Sorry for the false alarm!
Todd
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 11:15 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
UGGH, it always takes
Does any one have any PCRE code that will detect empty HTML like:
BODY
/BODY
Scott Fisher
Dir of IT
Farm Progress Companies
191 S Gary Ave
Carol Stream, IL 60188
Tel: 630-462-2323
This email message, including any attachments, is for the sole use of the
intended recipient(s)
] On Behalf Of Scott
Fisher
Sent: Thursday, June 21, 2007 11:19 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] pcre code
Does any one have any PCRE code that will detect empty HTML like:
BODY
/BODY
Scott Fisher
Dir of IT
Farm Progress Companies
191 S Gary Ave
Fisher
Sent: Tuesday, June 19, 2007 10:03 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE and REVDNS
OK, now you have me thinking could I use PCRE to replace tons of body
searches for my 419/Lottery filter...
What is the maximum line length for a line in a filter
12:54 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] PCRE and REVDNS
Just a quick tutorial. As PCRE is much quicker than using regular line
matching I use the following when checking against REVDNS within filters:
Regular Filter line:
---
REVDNS -5
: [EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Tuesday, June 19, 2007 10:03 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE and REVDNS
OK, now you have me thinking could I use PCRE to replace
: 978.988.1311
E: [EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Tuesday, June 19, 2007 10:03 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE and REVDNS
OK, now you have me thinking could I use
Email me directly [EMAIL PROTECTED] as to keep the lists relevant
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark
Reimer
Sent: Tuesday, June 19, 2007 10:35 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE and REVDNS
David,
I
How about adding it to the downloads section? That seems easier than
dealing with a lot of individual requests.
Darin.
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Tuesday, June 19, 2007 10:42 AM
Subject: RE: [Declude.JunkMail] PCRE
: Re: [Declude.JunkMail] PCRE and REVDNS
How about adding it to the downloads section? That seems easier than
dealing with a lot of individual requests.
Darin.
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Tuesday, June 19, 2007 10:42
Just a quick tutorial. As PCRE is much quicker than using regular line
matching I use the following when checking against REVDNS within filters:
Regular Filter line:
---
REVDNS -5 ENDSWITH.bigfootinteractive.com
REVDNS -5 ENDSWITH
Ok, either everyone has left or everyone is very happy because it is kind of
quite. So I thought I would post something:
Using PCRE here is an expression that will only match a valid IP address.
(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]
x7008
Toll Free: 1-866.332.5833 x7008
Fax: 978.334.0700
Email: [EMAIL PROTECTED]
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Thursday, May 10, 2007 1:28 PM
Subject: [Declude.JunkMail] PCRE
Ok, either everyone has left or everyone is very
@declude.com
Sent: Thursday, May 10, 2007 2:28 PM
Subject: [Declude.JunkMail] PCRE
Ok, either everyone has left or everyone is very happy because it is kind of
quite. So I thought I would post something:
Using PCRE here is an expression that will only match a valid IP address.
(25[0-5]|2[0-4][0-9
This will match the case exactly note that the phrase is in parentheses.
This specific example would match if URGENT ASSISTANCE was to be found
anywhere in the SUBJECT line match Case:
SUBJECT 8 PCRE(URGENT ASSISTANCE)
This would match regardless of the character case. This specific
:[EMAIL PROTECTED] On Behalf Of Darin
Cox
Sent: Thursday, May 10, 2007 2:59 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE
For those on IMail, the focus right now is probably on getting a stable and
fully functional mail server again. IMail 2006.21 preview 1 was just
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE
I'm here with you David. No need to feel alone :)
If you have any further questions, please do not hesitate to contact me
either by email or call Toll free 1-866-332-5833 Ext.7008
Linda Pagillo
Technical Support Engineer | Declude
business
Office: 978.499.2933 x7008
Toll Free: 1-866.332.5833 x7008
Fax: 978.334.0700
Email: [EMAIL PROTECTED]
- Original Message -
From: John T (lists) [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Thursday, May 10, 2007 2:08 PM
Subject: RE: [Declude.JunkMail] PCRE
Linda, thanks
product soon, we'll be very happy despite the wait.
Darin.
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Thursday, May 10, 2007 3:05 PM
Subject: RE: [Declude.JunkMail] PCRE
Phew! For a moment there I thought Declude was the only
Would anyone be willing to share their regular expressions files (lines)
with the group?
I know this will be a valuable addition to Declude but most of us don't
want to (or know how to) re-invent the wheel.
Thanks.
--
John Olden - Technology Manager
Champaign Park District
---
This E-mail
of good examples on their web
site.
Gary
Original Message
From: John Olden [EMAIL PROTECTED]
Sent: Friday, March 16, 2007 4:58 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE FILTERING
Would anyone be willing to share their regular expressions
Hopefully at some point Declude will post a list of good examples on
their web site.
I hope people aren't ignoring the ridiculously profuse SpamAssassin
Rules Emporium, SA built-in rules, etc.
--Sandy
Sanford Whiteman, Chief Technologist
Broadleaf
security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick
Hayer
Sent: Wednesday, March 14, 2007 9:14 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE
)
Being able to search the body without the attachments would also be a time
saver on those BODY filters.
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Tuesday, March 13, 2007 11:24 AM
Subject: [Declude.JunkMail] PCRE FILTERING
Wanted
also:
Capital Firms
cycle analysis
- Original Message -
From: Nick Hayer [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Wednesday, March 14, 2007 8:14 AM
Subject: Re: [Declude.JunkMail] PCRE FILTERING
fyi -
#CIALIS
ANYWHERE 3 PCRE
(?i:\bc.{0,2}[\|li1í\!].{0,[EMAIL
:15 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE FILTERING
I'm seeing hits in the attachments too.
Triggered ANYWHERE PCRE filter REGEX-KEYWORDS : vHXAH51eG1ujzM (valium)
It would be real nice to be able to search the body without the attachments
like this.
BODYONLY 25
with some sort of $ amount
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Wednesday, March 14, 2007 10:17 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE FILTERING
also:
Capital Firms
cycle analysis
: [Declude.JunkMail] PCRE FILTERING
I'm seeing hits in the attachments too.
Triggered ANYWHERE PCRE filter REGEX-KEYWORDS : vHXAH51eG1ujzM (valium)
It would be real nice to be able to search the body without the attachments
like this.
BODYONLY 25 PCRE
(?i:v.{0,[EMAIL PROTECTED],2}[\|li1í\!].{0,2}[\|i1í
of an executable, a specific virus, or the header of
a TIFF file.
Andrew.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Matt
Sent: Wednesday, March 14, 2007 9:21 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE FILTERING
This was an old, old feature request/bug fix from back in the
Scott days, where it was desired not include encoded base64
I requested this as a change long ago for two reasons:
1) To avoid false positives where search text matches the MIME or UUENCODE
formatting
2) To provide an
Just to clarify a bit on this, there is the conundrum regarding text or
HTML base64 encoded attachments and other types of attachments where you
want to search the text and HTML stuff in decoded format, but not the
image, application and other MIME types. It is however less common to
51 matches
Mail list logo
