Yes you are correct. Sorry that I did not mention that the real MAILFROM
line is from the envelope and not the D file From: which can easily be
forged this is why the MAILFROM always checks the Declude-Sender Line:
Chuck had asked to match Viagra if he had asked Viagra and variations then I
would have given a different response. In which case:
MAILFROM 5 PCRE
(?i:.*(?i:v.{0,2}[|li1í!].{0,2}[a@/\\].{0,2}[gq].{0,2}r.{0,2}[a@/\\]).*@)
Agreed Matt, it will not catch every variation but it will catch quite a
few.
The disadvantage of using this in the MAILFROM is that email addresses do
have invalid words and names that may match the expression.
David
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck,
Andrew
Sent: Friday, February 08, 2008 5:06 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?
(another country heard from)
David... Chuck... the MAILFROM is going to filter based on the
server-side conversation (i.e. for IMail users, it will be the value
from the Q*.smd file, not any text in the D*.smd file).
The example that Chuck gave is going to be the From: line in the message
header, which is not the same.
Also, "vigara" is not equal to "viagra" so Dave's first example PCRE
filter doesn't match the text that Chuck supplied.
So that would be two reasons why it didn't work.
Andrew.
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
> Behalf Of David Barker
> Sent: Friday, February 08, 2008 1:40 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
>
> This is what Chuck requested.
>
> "Now the declude sender is [EMAIL PROTECTED] but I want to filter
> the sender name
> of "vigara". "
>
> If you show me what you trying to do in the headers perhaps I
> can help ?
>
> David B
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
> Behalf Of John
> Shacklett
> Sent: Friday, February 08, 2008 4:36 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> Isn't the mailfrom in this case [EMAIL PROTECTED] and not the
> vigara part? Chuck
> is looking for a way to filter based on the "name" attached
> to the address
> and not the specific address proper, isn't that right Chuck?
>
> I'm butting in here because I'm trying to capture something
> similar using
> the same logic, and using a "headers" specification in the
> filter is too
> broad for what I'm trying to do.
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
> Behalf Of David
> Barker
> Sent: Friday, 08 February 2008 3:56 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> How so, can you show the X-Declude-Sender line that it did
> not work on ?
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
> Behalf Of Chuck
> Schick
> Sent: Friday, February 08, 2008 3:50 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> David:
>
> The first one does not work.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
> Behalf Of David
> Barker
> Sent: Wednesday, February 06, 2008 12:25 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> Chuck you have several options:
>
>
> MAILFROM 5 STARTSWITH Viagra
> MAILFROM 5 CONTAINS Viagra
> MAILFROM 5 PCRE (?i:.*viagra.*@)
>
>
> David Barker
> VP Operations Declude
> Your Email security is our business
> 978.499.2933 x 7007 office
> 978.988.1311 fax
> [EMAIL PROTECTED]
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
> Behalf Of Chuck
> Schick
> Sent: Wednesday, February 06, 2008 2:17 PM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] How can I filter this...?
>
> Spam email is sent and the from line is
>
> "vigara" <[EMAIL PROTECTED]>
>
> Now the declude sender is [EMAIL PROTECTED] but I want to filter
> the sender name
> of "vigara". Seems like it should be simple but it is eluding me.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail". The archives can be found at
> http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail". The archives can be found at
> http://www.mail-archive.com.
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail". The archives can be found at
> http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail". The archives can be found at
> http://www.mail-archive.com.
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
>
>
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
