I am not sure why the filter did not trigger as the expression matches the following strings in your email.
=?koi8-r?B? =?koi8-r?B? charset="koi8-r"; We would have to see a debug log to understand why this did not trigger. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell Ard Sent: Tuesday, June 24, 2008 8:09 AM To: [email protected] Subject: Re: [Declude.JunkMail] blocking certain character sets - koi8 Importance: Low David I finally got another "koi8" that my character-filter missed. My character filter is ANYWHERE 30 PCRE (?i:(charset=.{0,2}koi8-[ur].{0,2})|(=\?koi8-[ur]\?b\?)) The email that got thru (headers) are below. Thanks for your help Ferrell Ard ==================================================== Received: from WWW-2F5A4495117 [120.34.72.24] by mail.beicorporate.net with ESMTP (SMTPD-9.10) id AC7C0980; Mon, 23 Jun 2008 23:39:40 -0400 Received: from [120.34.72.24] by farmsmtp.idiglobal.com; Tue, 24 Jun 2008 11:39:44 +0800 Message-ID: <[EMAIL PROTECTED]> From: =?koi8-r?B?68HU0Q==?= <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: =?koi8-r?B?68HexdPU188g19nbxSwg3sXNIMPFzsEu?= Date: Tue, 24 Jun 2008 11:39:44 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="koi8-r"; reply-type=original Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1478 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1478 X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command. X-RBL-Warning: HELOBOGUS: Domain WWW-2F5A4495117 returns a server failure for MX or A records. X-RBL-Warning: NONENGLISH: Non-English text found in E-mail. X-RBL-Warning: SNIFFER: Message failed SNIFFER: 60. X-RBL-Warning: WEIGHT10: Weight of 24 reaches or exceeds the limit of 10. X-RBL-Warning: WEIGHT14: Weight of 24 reaches or exceeds the limit of 14. X-RBL-Warning: WEIGHT20: Weight of 24 reaches or exceeds the limit of 20. X-Declude-Sender: [EMAIL PROTECTED] [120.34.72.24] X-Declude-Spoolname: D6c79018300001908.smd X-Declude-RefID: X-Declude-Note: B - Scanned by Declude 4.4.0 "http://www.declude.com/x-note.htm"; X-Declude-Scan: Incoming Score [24] at 23:39:55 on 23 Jun 2008 X-Declude-Tests-Failed: CMDSPACE [8], HELOBOGUS [7], NONENGLISH [8], SNIFFER [7], WEIGHT10 [10], WEIGHT14 [14], WEIGHT20 [20] X-Country-Chain: [IANA Reserved]->destination X-Declude-Code: e X-HELO: WWW-2F5A4495117 X-Identity: 120.34.72.24 | 24.72.34.120.board.ly.fj.dynamic.163data.com.cn | dqbiz.net X-RCPT-TO: <[EMAIL PROTECTED]> Status: X-UIDL: 499838735 X-IMail-ThreadID: 6c79018300001908 ----- Original Message ----- From: David Barker <mailto:[EMAIL PROTECTED]> To: [email protected] Sent: Friday, May 16, 2008 8:39 AM Subject: RE: [Declude.JunkMail] blocking certain character sets Ferrell, It would be interesting to get a copy of the email line that the filter did not work on - that way we can look at adjusting the expression David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell Ard Sent: Friday, May 16, 2008 11:34 AM To: [email protected] Subject: Re: [Declude.JunkMail] blocking certain character sets When I added to my global.cfg BANCHARSET koi8-r it did not do anything ( emails continued to come in with this character set) Putting it into a Filter DID work. ANYWHERE 30 PCRE (?i:(charset=.{0,2}koi8-[ur].{0,2})|(=\?koi8-[ur]\?b\?)) (most of the time - but not all the time). The advantage - for me - for the Filter is that it applies to all 400 Post Offices that we host on the server. Whereas the rules.ima would have to be set up for each mailbox. Ferrell ----- Original Message ----- From: "Imail Admin" < <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED]> To: < <mailto:[email protected]> [email protected]> Sent: Thursday, May 15, 2008 3:56 PM Subject: Re: [Declude.JunkMail] blocking certain character sets > Hi, > > I have a question of strategy. Per David's message below, one can setup a > filter for a character set (such as Russian). Alternative, one could use > BANCHARSET. For a third alternative, one could use rules.ima within IMail > itself. So what are the pros and cons of these three approaches? Which > would likely have the least CPU impact? > > Also, is BANCHARSET new? I have a slightly older version of Declude and I > don't recall it (of course, I can't find a manual for my version either). > > Thanks, > > Ben > > ----- Original Message ----- > From: "David Barker" < <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED]> > To: < <mailto:[email protected]> [email protected]> > Sent: Tuesday, May 06, 2008 8:14 AM > Subject: RE: [Declude.JunkMail] blocking certain character sets > > > For these char sets it is much easier - use the following: > > ANYWHERE 10 PCRE (?i:(iso-2022-jp|unicode-1-1-utf-7)) > > David B > > From: <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell > Ard > Sent: Tuesday, May 06, 2008 11:05 AM > To: <mailto:[email protected]> [email protected] > Subject: Re: [Declude.JunkMail] blocking certain character sets > > David > > Thank you for the filter for "koi8-r" > > Would you be willing to code me one for "unicode-1-1-utf-7" & > "ISO-2022-JP" > > (I deleted my example of unicode-1-1-utf-7) > > Subject: =?ISO-2022-JP?B?GyRCQXc/LiUoJWkhPBsoSg==?= > > Subject: X-IMail-SPAM DELIVERY FAILURE: > =?ISO-2022-JP?B?GyRCJWYhPCU2ITwbKEIgeG55cnd5ICh4bnlyd3lAc21iYy5jb20uaGs=?= > =?ISO-2022-JP?B?KSAbJEIkTxsoQiBEb21pbm8gGyRCJUclIyVsJS8lSCVqJEskTzgrGyhC?= > =?ISO-2022-JP?B?GyRCJEQkKyRqJF4kOyRzISMbKEI=?= > Thanks very much > > Ferrell > ----- Original Message ----- > From: David Barker > To: <mailto:[email protected]> [email protected] > Sent: Monday, April 21, 2008 10:21 AM > Subject: RE: [Declude.JunkMail] blocking certain character sets > > I am surprised that they are still coming through, I would think that should > have stopped it altogether. However add the following line to a junkmail > filter: > > #CYRILLIC > ANYWHERE 10 PCRE > (?i:(charset=.{0,2}koi8-[ur].{0,2})|(=\?koi8-[ur]\?b\?)) > > David > > From: <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell > Ard > Sent: Monday, April 21, 2008 7:55 AM > To: <mailto:[email protected]> [email protected] > Subject: Re: [Declude.JunkMail] blocking certain character sets > > David > > Thanks very much. > > I added to the Declude.cfg BANCHARSET koi8-r > after I upgraded to 4.4.0 > > They are still coming thru. > Is there anything else that I need to do? > > This is what I'm still getting > > From: =?koi8-r?B?58XOzsHEycog98HTyczYxdfJ3g==?= < <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED]> > Subject: X-IMail-SPAM =?koi8-r?B?58/S0d3JxSDQ1dTF18vJIQ==?= > Thanks very much > Ferrell Ard > ----- Original Message ----- > From: David Barker > To: <mailto:[email protected]> [email protected] > Sent: Tuesday, April 08, 2008 10:12 AM > Subject: RE: [Declude.JunkMail] Need help in setting up filter please > > You can use the settings in Declude.cfg to stop certain character sets. > > David B > > From: <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell > Ard > Sent: Tuesday, April 08, 2008 7:41 AM > To: Declude > Subject: [Declude.JunkMail] Need help in setting up filter please > > We are getting a lot of email that has the code for character set > in the "From" > > The from always starts with =?koi8-r? > > Does anyone have a filter that might help me eliminate these. > > From: =?koi8-r?B?8dLP08zB1yD30d7F08zB18/Xyd4=?= <xqs > > Thanks very much > Ferrell > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at <http://www.mail-archive.com> http://www.mail-archive.com. > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at <http://www.mail-archive.com> http://www.mail-archive.com. > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at <http://www.mail-archive.com> http://www.mail-archive.com. > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at <http://www.mail-archive.com> http://www.mail-archive.com. > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at <http://www.mail-archive.com> http://www.mail-archive.com. > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at <http://www.mail-archive.com> http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at <http://www.mail-archive.com> http://www.mail-archive.com. > > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
