Re: One-line URI body spam

2011-10-21 Thread Alex
Hi, body            __BODY_URI      m{https?://.{1,50}$} That will match any email that ends with http:// followed by 1 to 50 characters of anythings, including spaces and other stuff not part of the url.  $ is not I want stuff to stop matching here.  It's the end. Either of the line, or

proper rule writing for N

2011-10-21 Thread R - elists
as you know, some emailing companies have multiple domains for mail serving mailengine1.com mailengine2.com mailengine3.com . . . mailengineN.com among other domains... what is the proper way to write a single rule to deal with N series combinations? header __LOCAL_MAILENGINE1 ALL =~

Re: proper rule writing for N

2011-10-21 Thread Bowie Bailey
On 10/21/2011 11:56 AM, R - elists wrote: as you know, some emailing companies have multiple domains for mail serving mailengine1.com mailengine2.com mailengine3.com . . . mailengineN.com among other domains... what is the proper way to write a single rule to deal with N series

RE: proper rule writing for N

2011-10-21 Thread R - elists
There are a couple of ways to do it. If you know that the numbers are 1-9, you could do this: header __LOCAL_MAILENGINE ALL =~ /mailengine[1-9]\.com/i (this is matching a single character. You could NOT do [1-12]) If you just want to allow for a number, you could do this:

Re: proper rule writing for N

2011-10-21 Thread Bret Miller
You could say header __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/i to match anything between mailengine and .com. Bret Miller Manager, Information Technology Grace Communion International On 10/21/2011 9:13 AM, R - elists wrote: There are a couple of ways to do it. If you know that the

Re: proper rule writing for N

2011-10-21 Thread Bowie Bailey
On 10/21/2011 12:13 PM, R - elists wrote: There are a couple of ways to do it. If you know that the numbers are 1-9, you could do this: header __LOCAL_MAILENGINE ALL =~ /mailengine[1-9]\.com/i (this is matching a single character. You could NOT do [1-12]) If you just want to allow

Re: proper rule writing for N

2011-10-21 Thread Bowie Bailey
On 10/21/2011 12:16 PM, Bret Miller wrote: You could say header __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/i to match anything between mailengine and .com. The problem there is that this would match something like mailengineblah.aol.com. This may or may not cause any issues, but it is

Re: proper rule writing for N

2011-10-21 Thread Daniel McDonald
On 10/21/11 11:21 AM, Bowie Bailey bowie_bai...@buc.com wrote: On 10/21/2011 12:16 PM, Bret Miller wrote: You could say header __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/I Indeterminate length matches are almost never good. How about something like: header __LOCAL_MAILENGINE ALL =~

Re: proper rule writing for N

2011-10-21 Thread John Hardin
On Fri, 21 Oct 2011, Daniel McDonald wrote: On 10/21/11 11:21 AM, Bowie Bailey bowie_bai...@buc.com wrote: On 10/21/2011 12:16 PM, Bret Miller wrote: You could say header __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/I Indeterminate length matches are almost never good. You can be a

Re: proper rule writing for N

2011-10-21 Thread Bowie Bailey
On 10/21/2011 12:35 PM, Daniel McDonald wrote: On 10/21/11 11:21 AM, Bowie Bailey bowie_bai...@buc.com wrote: On 10/21/2011 12:16 PM, Bret Miller wrote: You could say header __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/I Indeterminate length matches are almost never good. How about

Re: proper rule writing for N

2011-10-21 Thread RW
On Fri, 21 Oct 2011 12:21:35 -0400 Bowie Bailey wrote: On 10/21/2011 12:16 PM, Bret Miller wrote: You could say header __LOCAL_MAILENGINE ALL =~ /mailengine.+\.com/i to match anything between mailengine and .com. The problem there is that this would match something like

Re: all spam emails from mailengine1.com servers

2011-10-21 Thread Karsten Bräckelmann
This doesn't seem to deliberately be an off-list reply to sender, bouncing back to the list. On Fri, 2011-10-21 at 12:57 -0400, dar...@chaosreigns.com wrote: On 10/21, Karsten Bräckelmann wrote: header MAILENGINE1 Received =~ /mailengine1\.com/i And in either case, do add some anchoring

Re: all spam emails from mailengine1.com servers

2011-10-21 Thread Chip M.
R - elists wrote: does anyone get legit emails that come from the mailengine1.com email marketing servers? Yes, I've seen a trickle of ham, so did some data mining for you... The IP ranges I have for them are: 66.59.0.0 - 66.59.31.255 72.19.192.0 - 72.19.255.255 Does anyone