ally is running and not being END'ed before that
line is encountered?
Andrew.
From: Scott Fisher [mailto:sfis...@farmprogress.com]
Sent: Wednesday, November 16, 2011 9:49 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] PCRE help
Sub
Your PCRE should trigger on:
=?KOI8-U?B?
Subject: [Possible SPAM]=?KOI8-U?B?y8/OxqbExc7DpsrOpiDVx8/EyQ==?=
From: Scott Fisher [mailto:sfis...@farmprogress.com]
Sent: Wednesday, November 16, 2011 12:49 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] PCRE help
Subject
Subject: [Possible SPAM]=?KOI8-U?B?y8/OxqbExc7DpsrOpiDVx8/EyQ==?=
I am trying to catch the a spam with above subject listed with the below
line:
ANYWHERE 25 PCRE
(?i:((charset|content|lang)=.{0,2}koi8-(r|t|u|ru))|(=\?koi8-(r|t|u|ru)\?[bq]
\?))
Can anyone see what I'm doing wron
: declude.junkmail
Subject: [Declude.JunkMail] PCRE information
Where can I find information on PCRE formatting including what characthers have
to be escaped?
John T
eServices For You
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
Where can I find information on PCRE formatting including what characthers have
to be escaped?John T
eServices For You
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can
Thanks David.John T
eServices For You
-Original Message-
From: "David Barker" <[EMAIL PROTECTED]>
Sent 5/23/2008 8:22:11 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE check(?i:allen.{0,6}\.info) All
expressions must be in parenthesis ?i: no
PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
Sent: Friday, May 23, 2008 11:07 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] PCRE check
I am taking my first stab at regular expressions.
Trying to write a line to catch all of the @ allen info xx . info from
addresses.
So
May 2008 17:07
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] PCRE check
I am taking my first stab at regular expressions.
Trying to write a line to catch all of the @ allen info xx . info from
addresses.
So far, I have "mailfrom 10 PCRE @allen(*{0,6}).info"
Is tha
I am taking my first stab at regular expressions.
Trying to write a line to catch all of the @ allen info xx . info from
addresses.
So far, I have "mailfrom 10 PCRE @allen(*{0,6}).info"
Is that to broad or not efficient? (I think that means look for any 6
characters between @allen and .info is a
: [Declude.JunkMail] PCRE and NOTCONTAINS
Is there any way to make a PCRE work like a NOTCONTAINS
I have this filter line:
MAILFROM END NOTCONTAINS @aim.
I also need to add @aol.com to that.
Obviously two notcontains wont work. Is there a way to work the NOT into a
PCRE expression
Is there any way to make a PCRE work like a NOTCONTAINS.
I have this filter line:
MAILFROM END NOTCONTAINS @aim.
I also need to add @aol.com to that.
Obviously two notcontains won't work. Is there a way to work the NOT into a
PCRE expression?
Scott Fisher
Director of IT
F
Does the PCRE support extended characters?
For instance would this detect all lower case characters?
SUBJECT END PCRE
([a-zàáâãäçåéèêëìíîïñòóôõöùúûüýÿ])
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTE
Monday, July 09, 2007 7:47 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Hi Todd,
A couple of suggestions
(?i:receive.*(postcard|greeting|ecard|e-card))
could also be written as:
(?i:receive.{0,50}(postcard|greeting|e.?card))
As you are checking anywhere y
t like (?i:\bERMX\b)
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 12:15 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
UGGH, it always takes sending something to a LOT of
OK, it's working. Sorry for the false alarm!
Todd
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 11:15 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
UGGH, it always
n more common on the Subject.
Let me change that and report back!
Todd
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 10:59 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Hi
Yeah, just checked - it's there. :)
Todd
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Friday, July 06, 2007 10:53 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Also make sure there is the
July 06, 2007 10:18 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Todd,
Ensure you have version 4.3.46 of Declude. The format of an expression is:
LOCATIONWEIGHT PCRE(EXPRESSION)
Eg.
BODY5 PCRE(?i:Hello World)
Po
Also make sure there is the pcre3.dll in your imail folder.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, July 06, 2007 10:18 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Todd,
Ensure you
-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 11:08 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] PCRE tests
Is there anything special that I need to have "turned on" to take advantage
of this? I've been play
Is there anything special that I need to have "turned on" to take advantage
of this? I've been playing around with it, and really like what it can do.
Being a complete newbie to regex, I've been using Regex Buddy to test the
expressions before putting them into "production". However, I'm not seei
Of Scott
Fisher
Sent: Thursday, June 21, 2007 11:19 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] pcre code
Does any one have any PCRE code that will detect empty HTML like:
Scott Fisher
Dir of IT
Farm Progress Companies
191 S Gary Ave
Carol Stream, IL 60188
Does any one have any PCRE code that will detect empty HTML like:
Scott Fisher
Dir of IT
Farm Progress Companies
191 S Gary Ave
Carol Stream, IL 60188
Tel: 630-462-2323
This email message, including any attachments, is for the sole use of the
intended recipient(s) and may con
Fisher
Sent: Tuesday, June 19, 2007 10:03 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE and REVDNS
OK, now you have me thinking could I use PCRE to replace tons of body
searches for my 419/Lottery filter...
What is the maximum line length for a line in a filter
: Re: [Declude.JunkMail] PCRE and REVDNS
How about adding it to the downloads section? That seems easier than
dealing with a lot of individual requests.
Darin.
- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, June 19, 2007 10:4
How about adding it to the downloads section? That seems easier than
dealing with a lot of individual requests.
Darin.
- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, June 19, 2007 10:42 AM
Subject: RE: [Declude.JunkMail] PCRE and R
Email me directly [EMAIL PROTECTED] as to keep the lists relevant
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark
Reimer
Sent: Tuesday, June 19, 2007 10:35 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE and REVDNS
David,
I
: 978.988.1311
E: [EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Tuesday, June 19, 2007 10:03 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE and REVDNS
OK, now you have me thinking could I use
: [EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Tuesday, June 19, 2007 10:03 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE and REVDNS
OK, now you have me thinking could I use PCRE to replace
12:54 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] PCRE and REVDNS
Just a quick tutorial. As PCRE is much quicker than using regular line
matching I use the following when checking against REVDNS within filters:
Regular Filter line:
---
REVDNS -5
Just a quick tutorial. As PCRE is much quicker than using regular line
matching I use the following when checking against REVDNS within filters:
Regular Filter line:
---
REVDNS -5 ENDSWITH.bigfootinteractive.com
REVDNS -5 ENDSWITH
an get a stable
product soon, we'll be very happy despite the wait.
Darin.
- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To:
Sent: Thursday, May 10, 2007 3:05 PM
Subject: RE: [Declude.JunkMail] PCRE
Phew! For a moment there I thought Declude was th
s our business
Office: 978.499.2933 x7008
Toll Free: 1-866.332.5833 x7008
Fax: 978.334.0700
Email: [EMAIL PROTECTED]
- Original Message -
From: "John T (lists)" <[EMAIL PROTECTED]>
To:
Sent: Thursday, May 10, 2007 2:08 PM
Subject: RE: [Declude.JunkMail] PCRE
> Linda, thank
007 11:59 AM
> To: declude.junkmail@declude.com
> Subject: Re: [Declude.JunkMail] PCRE
>
> I'm here with you David. No need to feel alone :)
>
> If you have any further questions, please do not hesitate to contact me
> either by email or call Toll free 1-866-332-5833 Ext.7008
>
ailto:[EMAIL PROTECTED] On Behalf Of Darin
Cox
Sent: Thursday, May 10, 2007 2:59 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE
For those on IMail, the focus right now is probably on getting a stable and
fully functional mail server again. IMail 2006.21 preview 1 was
This will match the case exactly note that the phrase is in parentheses.
This specific example would match if URGENT ASSISTANCE was to be found
anywhere in the SUBJECT line match Case:
SUBJECT 8 PCRE(URGENT ASSISTANCE)
This would match regardless of the character case. This specific exa
[EMAIL PROTECTED]>
To:
Sent: Thursday, May 10, 2007 2:28 PM
Subject: [Declude.JunkMail] PCRE
Ok, either everyone has left or everyone is very happy because it is kind of
quite. So I thought I would post something:
Using PCRE here is an expression that will only match a valid IP address.
(25[0-5]|2[0
.2933 x7008
Toll Free: 1-866.332.5833 x7008
Fax: 978.334.0700
Email: [EMAIL PROTECTED]
- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To:
Sent: Thursday, May 10, 2007 1:28 PM
Subject: [Declude.JunkMail] PCRE
> Ok, either everyone has left or everyone is very
Ok, either everyone has left or everyone is very happy because it is kind of
quite. So I thought I would post something:
Using PCRE here is an expression that will only match a valid IP address.
(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]
?)\.(25[0-5]|2[0-4][0-9]|
> Hopefully at some point Declude will post a list of good examples on
> their web site.
I hope people aren't ignoring the ridiculously profuse SpamAssassin
Rules Emporium, SA built-in rules, etc.
--Sandy
Sanford Whiteman, Chief Technologist
Broadleaf Sys
good examples on their web
site.
Gary
Original Message
> From: John Olden <[EMAIL PROTECTED]>
> Sent: Friday, March 16, 2007 4:58 PM
> To: declude.junkmail@declude.com
> Subject: Re: [Declude.JunkMail] PCRE FILTERING
>
> Would anyone be willin
Would anyone be willing to share their regular expressions files (lines)
with the group?
I know this will be a valuable addition to Declude but most of us don't
want to (or know how to) re-invent the wheel.
Thanks.
--
John Olden - Technology Manager
Champaign Park District
---
This E-mail came
Just to clarify a bit on this, there is the conundrum regarding text or
HTML base64 encoded attachments and other types of attachments where you
want to search the text and HTML stuff in decoded format, but not the
image, application and other MIME types. It is however less common to
obfuscate
> > This was an old, old feature request/bug fix from back in the
> > Scott days, where it was desired not include encoded base64
>
> I requested this as a change long ago for two reasons:
>
> 1) To avoid false positives where search text matches the MIME or UUENCODE
> formatting
>
> 2) To provi
ext
against the representation of an executable, a specific virus, or the header of
a TIFF file.
Andrew.
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
> Behalf Of Matt
> Sent: Wednesday, March 14, 2007 9:21 AM
> To: declude.junkmail@decl
: [Declude.JunkMail] PCRE FILTERING
I'm seeing hits in the attachments too.
Triggered ANYWHERE PCRE filter REGEX-KEYWORDS : vHXAH51eG1ujzM (valium)
It would be real nice to be able to search the body without the attachments
like this.
BODYONLY 25 PCRE
(?i:v.{0,[EMAIL PROTECTED],2}[\|li1í\!].{0,2}[
with some sort of $ amount
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Wednesday, March 14, 2007 10:17 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE FILTERING
also:
Capital Firms
cycle ana
:15 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE FILTERING
I'm seeing hits in the attachments too.
Triggered ANYWHERE PCRE filter REGEX-KEYWORDS : vHXAH51eG1ujzM (valium)
It would be real nice to be able to search the body without the attachments
like this.
BODYON
also:
Capital Firms
cycle analysis
- Original Message -
From: "Nick Hayer" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, March 14, 2007 8:14 AM
Subject: Re: [Declude.JunkMail] PCRE FILTERING
fyi -
#CIALIS
ANYWHERE 3 PCRE
(?i:\bc.{0,2}[\|li1í\!].{0,[EMAIL PROTECTED],2
0,2}m)
Being able to search the body without the attachments would also be a time
saver on those BODY filters.
- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, March 13, 2007 11:24 AM
Subject: [Declude.JunkMail] PCRE FILTERING
Wanted to
security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick
Hayer
Sent: Wednesday, March 14, 2007 9:14 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE
fyi -
#CIALIS
ANYWHERE3 PCRE
(?i:\bc.{0,2}[\|li1í\!].{0,[EMAIL PROTECTED],2}[\|li1í\!].{0,2}[\|i1í\!].{0,2}s)
This one will false positive onclassifieds
-Nick
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
52 matches
Mail list logo