Your PCRE should trigger on:
=?KOI8-U?B? Subject: [Possible SPAM]=?KOI8-U?B?y8/OxqbExc7DpsrOpiDVx8/EyQ==?= From: Scott Fisher [mailto:sfis...@farmprogress.com] Sent: Wednesday, November 16, 2011 12:49 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] PCRE help Subject: [Possible SPAM]=?KOI8-U?B?y8/OxqbExc7DpsrOpiDVx8/EyQ==?= I am trying to catch the a spam with above subject listed with the below line: ANYWHERE 25 PCRE (?i:((charset|content|lang)=.{0,2}koi8-(r|t|u|ru))|(=\?koi8-(r|t|u|ru)\?[bq]\?)) Can anyone see what I’m doing wrong? Scott Fisher | IT Director FARM PROGRESS COMPANIES | 255 38th Avenue, Suite P | St. Charles, IL 60174-5410 630/462-2323 | Fax 630/462-2957 | <mailto:sfis...@farmprogress.com> sfis...@farmprogress.com <http://www.farmprogress.com/> www.FarmProgress.com This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. Although Farm Progress Companies has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
<<image001.gif>>
