The expression I gave you does match on (discount. Coupon) in 85% discount.
Coupon #zH5d
If it is not triggering you may have a different issue. As for the subject
you are describing I use the following:
SUBJECT 7 PCRE (?i:\d\d%.{0,10} discount.{0,10}#[a-z]{3,5})
BODY 5 PCRE (?i:google.{3,10}pagead/iclk)
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Monday, April 07, 2008 8:58 PM
To: [email protected]
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
David,
I implemented your regular expression in the filter and a spam skated right
through (filter did not trigger) with the following subject line:
85% discount. Coupon #zH5d
Dave
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
> Barker
> Sent: Monday, April 07, 2008 2:14 PM
> To: [email protected]
> Subject: RE: [Declude.JunkMail] Filters not triggering
>
> Spaces before the phrase are not used as the line is normalized. Also the
> regular CONTAINS is not case sensitive.
>
> It would be better to use
>
> SUBJECT 0 PCRE (?i:(discount|off).{0,2}Co(upon|de))
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
> Beckstrom
> Sent: Monday, April 07, 2008 2:42 PM
> To: [email protected]
> Subject: [Declude.JunkMail] Filters not triggering
>
> Hi Everyone.
>
> I have a filter set up to delete an email if the subject line contains the
> keyword in the filter. For some odd reason, the filter is not triggering
> and it really has me baffled. I could use some suggestions on this one.
>
> The filter is called: Filter_Subject_delete.txt
>
> Here are the relevant lines from the filter:
>
>
> SUBJECT 0 contains discount. Code
> SUBJECT 0 contains discount.Code
> SUBJECT 0 contains discount. coupon
> SUBJECT 0 contains discount. Coupon
> SUBJECT 0 contains discount.coupon
> SUBJECT 0 contains discount.Coupon
> SUBJECT 0 contains off .code
>
> As you can see, I added some filter lines to test to see if I was running
> into an issue with the filter not triggering due to case sensitivity. I
> didn't think the filters were case sensitive, but in trying to debug this
> problem I checked to see if that was an issue or not.
>
>
> My junkmail config has the following specifying to delete the spam:
>
> Filter_Subject_Delete DELETE
>
>
>
>
> Here are the headers from the spam that was not deleted:
>
>
>
>
>
> Return-Path: <[EMAIL PROTECTED]> Mon Apr 07 08:49:57 2008
> Received: from 224samana75.codetel.net.do [200.88.75.224] by my.server.com
> with SMTP;
> Mon, 7 Apr 2008 08:49:57 -0500
> Message-ID: <[EMAIL PROTECTED]>
> From: "brit luc" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Subject: [SPAM]- Score (11)81% discount. Coupon #2IJk
> Date: Mon, 07 Apr 2008 12:34:28 +0000
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="----=_NextPart_000_0007_01C898BA.05CF202E"
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook Express 6.00.2900.3138
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
> X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 4/7/2008 8:50:18 AM
> X-invURIBL-Weight: 0
> X-invURIBL-Range: CLEAN
> X-RBL-Warning: SPAMCOP: "Blocked - see
> http://www.spamcop.net/bl.shtml?200.88.75.224";
> X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
> X-RBL-Warning: Filter_Country: Message failed Filter_Country test (line
59,
> weight 3)
> X-Declude-RefID:
> X-Note: ========================================
> X-Note: Spam Score: [11]
> X-Note: Scan Time: 08:50:19 on 07 Apr 2008
> X-Note: Spool File: 35052863.eml
> X-Note: Server Name: 224samana75.codetel.net.do
> X-Note: SMTP Sender: [EMAIL PROTECTED]
> X-Note: Reverse DNS & IP: 224samana75.codetel.net.do [200.88.75.224]
> X-Note: Recipient(s): [EMAIL PROTECTED]
> X-Note: Country Chain: DOMINICAN REPUBLIC->destination
> X-Note: Failed Weights: SPAMCOP [7], SPFUNKNOWN [1], Filter_Country [3],
> WEIGHT10 [10]
> X-Note: ========================================
>
>
>
> Where it says my.server.com and my.address.com is where I edited info I
> didn't want posted to the list.
>
>
> Here is the Declude log entries from when the email was scanned:
>
>
> 04/07/2008 08:50:03.527 35052863.eml CFG: Bypassing IP 127.0.0.1.
> 04/07/2008 08:50:03.527 35052863.eml CFG: Set hop to 0.
> 04/07/2008 08:50:03.527 35052863.eml STOPPROCESSINGONFIRSTDELETE: Set to
> ON
>
>
> 04/07/2008 08:50:10.746 35052863 Last line of headers checking for
Recived:
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
> 04/07/2008 08:50:10.746 35052863 About to run spam tests
>
> 04/07/2008 08:50:18.980 35052863 JunkMailBase64 Start
> 04/07/2008 08:50:18.980 35052863 JunkMailBase64 Start
> 04/07/2008 08:50:18.980 35052863 DeHTML End: 495:367 ratio=0.425754
> 04/07/2008 08:50:19.011 35052863 Doing filter file
> D:\Apps\smartermail\Declude\CustomFilters\Filter_Subject_Delete.txt.
> 04/07/2008 08:50:19.011 35052863 Filter Filter_Subject_Delete: Not
skipping
> E-mail due to current weight of 11.
> 04/07/2008 08:50:19.011 35052863 SPAMCOP:7 SPFUNKNOWN:1 Filter_Country:3 .
> Total weight = 11.
>
>
> I edited some of the log text, but the above is the relevant stuff. We're
> running declude 4.3.46 on Smartermail 3.
>
> Any ideas on why that filter is not triggering?
>
> Thanks,
>
> Dave
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
