Your PCRE should trigger on:
=?KOI8-U?B?
Subject: [Possible SPAM]=?KOI8-U?B?y8/OxqbExc7DpsrOpiDVx8/EyQ==?=
From: Scott Fisher [mailto:sfis...@farmprogress.com]
Sent: Wednesday, November 16, 2011 12:49 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] PCRE help
Subject:
I don't see anything wrong there, Scott.
When I run it through The Regex Coach, I did have to remove the spaces
at the end of the line in your email and then it did work. So, make sure
there is no whitespace at the end of the line in your test file? Make
sure the filter file really is running and
http://www.pcre.org/pcre.txt
http://www.tote-taste.de/X-Project/regex/syntax.html
I would suggest this tool http://www.regexbuddy.com/ makes it very easy to
learn.
David B
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
Sent: Monday, June 02, 2008 6:13 PM
To:
Hi John,
Keep us posted how you get on because I have no idea about regular expressions
and would like to see how you trun out.
:o)
Kindest Regards
Craig Edmonds
123 Marbella Internet
W: www.123marbella.net
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
Sent: 23
(?i:allen.{0,6}\.info)
All expressions must be in parenthesis
?i:non case sensitive
.* any character
{0,6} minimum 0 characters to a maximum of 6
\. Because . can mean any character a \. means specifically use .
Hope this helps.
David B
From: [EMAIL
Thanks David.John T
eServices For You
-Original Message-
From: David Barker [EMAIL PROTECTED]
Sent 5/23/2008 8:22:11 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE check(?i:allen.{0,6}\.info) All
expressions must be in parenthesis ?i: non case sensitive
Scott the only way I have done a NOT is in the following example where this
will match on the expression but NOT on levitra using (?!levitra)
(?i:(?!levitra)\bl.{0,2}e.{0,2}v.{0,2}[|li1í!].{0,2}t.{0,2}r.{0,[EMAIL
PROTECTED])
I have attempted to work this type of expression into
:\bERMX\b)
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 12:15 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
UGGH, it always takes sending something to a LOT of people for you
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Hi Todd,
A couple of suggestions
(?i:receive.*(postcard|greeting|ecard|e-card))
could also be written as:
(?i:receive.{0,50}(postcard|greeting|e.?card))
As you are checking anywhere you want to limit the amount
Todd,
Ensure you have version 4.3.46 of Declude. The format of an expression is:
LOCATIONWEIGHT PCRE(EXPRESSION)
Eg.
BODY5 PCRE(?i:Hello World)
Post some examples that you are using but not getting hits.
David
-Original Message-
Yeah, just checked - it's there. :)
Todd
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Friday, July 06, 2007 10:53 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Also make sure there is the pcre3
.
Let me change that and report back!
Todd
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 10:59 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Hi David -
Yes, I just confirmed
Also make sure there is the pcre3.dll in your imail folder.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, July 06, 2007 10:18 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Todd,
Ensure you
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Todd,
Ensure you have version 4.3.46 of Declude. The format of an expression is:
LOCATIONWEIGHT PCRE(EXPRESSION)
Eg.
BODY5 PCRE(?i:Hello World)
Post some examples that you
OK, it's working. Sorry for the false alarm!
Todd
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Friday, July 06, 2007 11:15 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
UGGH, it always takes
You would have to test this but try:
BODY 0 PCRE (\BODY\(\r|\s){0,}/BODY)
David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Fisher
Sent: Tuesday, June 19, 2007 10:03 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE and REVDNS
OK, now you have me thinking could I use PCRE to replace tons of body
searches for my 419/Lottery filter...
What is the maximum line length for a line in a filter
OK, now you have me thinking could I use PCRE to replace tons of body
searches for my 419/Lottery filter...
What is the maximum line length for a line in a filter?
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, June 18, 2007
: [EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Tuesday, June 19, 2007 10:03 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE and REVDNS
OK, now you have me thinking could I use PCRE to replace
: 978.988.1311
E: [EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Tuesday, June 19, 2007 10:03 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE and REVDNS
OK, now you have me thinking could I use
Email me directly [EMAIL PROTECTED] as to keep the lists relevant
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark
Reimer
Sent: Tuesday, June 19, 2007 10:35 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE and REVDNS
David,
I
How about adding it to the downloads section? That seems easier than
dealing with a lot of individual requests.
Darin.
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Tuesday, June 19, 2007 10:42 AM
Subject: RE: [Declude.JunkMail] PCRE
: Re: [Declude.JunkMail] PCRE and REVDNS
How about adding it to the downloads section? That seems easier than
dealing with a lot of individual requests.
Darin.
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Tuesday, June 19, 2007 10:42
I'm here with you David. No need to feel alone :)
If you have any further questions, please do not hesitate to contact me
either by email or call Toll free 1-866-332-5833 Ext.7008
Linda Pagillo
Technical Support Engineer | Declude
Your Email Security is our business
Office: 978.499.2933
For those on IMail, the focus right now is probably on getting a stable and
fully functional mail server again. IMail 2006.21 preview 1 was just
released to hopefully address most, if not all, of the problems with 2006,
but it was just posted that those with virtual domains should wait for
:[EMAIL PROTECTED] On Behalf Of Darin
Cox
Sent: Thursday, May 10, 2007 2:59 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE
For those on IMail, the focus right now is probably on getting a stable and
fully functional mail server again. IMail 2006.21 preview 1 was just
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE
I'm here with you David. No need to feel alone :)
If you have any further questions, please do not hesitate to contact me
either by email or call Toll free 1-866-332-5833 Ext.7008
Linda Pagillo
Technical Support Engineer | Declude
business
Office: 978.499.2933 x7008
Toll Free: 1-866.332.5833 x7008
Fax: 978.334.0700
Email: [EMAIL PROTECTED]
- Original Message -
From: John T (lists) [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Thursday, May 10, 2007 2:08 PM
Subject: RE: [Declude.JunkMail] PCRE
Linda, thanks
product soon, we'll be very happy despite the wait.
Darin.
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Thursday, May 10, 2007 3:05 PM
Subject: RE: [Declude.JunkMail] PCRE
Phew! For a moment there I thought Declude was the only
Would anyone be willing to share their regular expressions files (lines)
with the group?
I know this will be a valuable addition to Declude but most of us don't
want to (or know how to) re-invent the wheel.
Thanks.
--
John Olden - Technology Manager
Champaign Park District
---
This E-mail
of good examples on their web
site.
Gary
Original Message
From: John Olden [EMAIL PROTECTED]
Sent: Friday, March 16, 2007 4:58 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE FILTERING
Would anyone be willing to share their regular expressions
security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick
Hayer
Sent: Wednesday, March 14, 2007 9:14 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE
I'm seeing hits in the attachments too.
Triggered ANYWHERE PCRE filter REGEX-KEYWORDS : vHXAH51eG1ujzM (valium)
It would be real nice to be able to search the body without the attachments
like this.
BODYONLY 25 PCRE
(?i:v.{0,[EMAIL PROTECTED],2}[\|li1í\!].{0,2}[\|i1í\!].{0,2}[vu].{0,2}m)
also:
Capital Firms
cycle analysis
- Original Message -
From: Nick Hayer [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Wednesday, March 14, 2007 8:14 AM
Subject: Re: [Declude.JunkMail] PCRE FILTERING
fyi -
#CIALIS
ANYWHERE 3 PCRE
(?i:\bc.{0,2}[\|li1í\!].{0,[EMAIL
:15 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE FILTERING
I'm seeing hits in the attachments too.
Triggered ANYWHERE PCRE filter REGEX-KEYWORDS : vHXAH51eG1ujzM (valium)
It would be real nice to be able to search the body without the attachments
like this.
BODYONLY 25
with some sort of $ amount
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Wednesday, March 14, 2007 10:17 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE FILTERING
also:
Capital Firms
cycle analysis
: [Declude.JunkMail] PCRE FILTERING
I'm seeing hits in the attachments too.
Triggered ANYWHERE PCRE filter REGEX-KEYWORDS : vHXAH51eG1ujzM (valium)
It would be real nice to be able to search the body without the attachments
like this.
BODYONLY 25 PCRE
(?i:v.{0,[EMAIL PROTECTED],2}[\|li1í\!].{0,2}[\|i1í
of an executable, a specific virus, or the header of
a TIFF file.
Andrew.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Matt
Sent: Wednesday, March 14, 2007 9:21 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] PCRE FILTERING
This was an old, old feature request/bug fix from back in the
Scott days, where it was desired not include encoded base64
I requested this as a change long ago for two reasons:
1) To avoid false positives where search text matches the MIME or UUENCODE
formatting
2) To provide an
Just to clarify a bit on this, there is the conundrum regarding text or
HTML base64 encoded attachments and other types of attachments where you
want to search the text and HTML stuff in decoded format, but not the
image, application and other MIME types. It is however less common to
40 matches
Mail list logo
