On Thu, 26 Jun 2014, Philip Prindeville wrote:
The [^\s] wouldn’t work because there is space in there…
note the name, non-breaking space, and the timestamp before the UUID’s…
The nonbreaking space wouldn't have any effect, that's not converted
before the RE scan; but the space in the date
On Thu, 26 Jun 2014, John Hardin wrote:
On Thu, 26 Jun 2014, Philip Prindeville wrote:
On Jun 25, 2014, at 3:47 PM, John Hardin wrote:
> That still doesn't hit *only* the same GUID repeated. Try this:
>
> rawbody L_REPEATING_UUIDS /> [^\s>]+(;[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9
On Jun 26, 2014, at 7:31 PM, John Hardin wrote:
> On Thu, 26 Jun 2014, Philip Prindeville wrote:
>
>> On Jun 25, 2014, at 3:47 PM, John Hardin wrote:
>>
>>> That still doesn't hit *only* the same GUID repeated. Try this:
>>>
>>> rawbody L_REPEATING_UUIDS />> [^\s>]+(;[A-F0-9]{8}-[A-F0-9]{4}
On Thu, 26 Jun 2014, Philip Prindeville wrote:
On Jun 25, 2014, at 3:47 PM, John Hardin wrote:
That still doesn't hit *only* the same GUID repeated. Try this:
rawbody L_REPEATING_UUIDS /]+(;[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12})\1\1\1/i
Sorry, that got dropped along
On Jun 25, 2014, at 3:47 PM, John Hardin wrote:
> On Wed, 25 Jun 2014, Philip Prindeville wrote:
>
>> Including 6 distinct UUID’s would seem to be useful. Including the same
>> UUID 6 times seems broken.
>>
>> Perhaps a pattern like:
>>
>> body /((;[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-
On 06/25/2014 11:35 PM, Philip Prindeville wrote:
On Jun 25, 2014, at 3:00 PM, Axb wrote:
On 06/25/2014 10:37 PM, Philip Prindeville wrote:
On Jun 25, 2014, at 3:09 AM, Axb wrote:
On 06/25/2014 03:07 AM, Philip Prindeville wrote:
Anyone have rules to catch these they could point me at?
On Wed, 25 Jun 2014, Philip Prindeville wrote:
Including 6 distinct UUID’s would seem to be useful. Including the same UUID 6
times seems broken.
Perhaps a pattern like:
body /((;[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12})){4,}/
would be… no, wait… we’d need to save the fi
On Jun 25, 2014, at 3:00 PM, Axb wrote:
> On 06/25/2014 10:37 PM, Philip Prindeville wrote:
>>
>> On Jun 25, 2014, at 3:09 AM, Axb wrote:
>>
>>> On 06/25/2014 03:07 AM, Philip Prindeville wrote:
>>>
Anyone have rules to catch these they could point me at? Or any empirical
evidenc
On 06/25/2014 10:37 PM, Philip Prindeville wrote:
On Jun 25, 2014, at 3:09 AM, Axb wrote:
On 06/25/2014 03:07 AM, Philip Prindeville wrote:
Anyone have rules to catch these they could point me at? Or any empirical
evidence about how successful they’ve been with such?
Wouldn't use this f
On Jun 25, 2014, at 3:09 AM, Axb wrote:
> On 06/25/2014 03:07 AM, Philip Prindeville wrote:
>
>> Anyone have rules to catch these they could point me at? Or any empirical
>> evidence about how successful they’ve been with such?
>
> Wouldn't use this for a rule unless you meta it with lots of
On 06/25/2014 03:07 AM, Philip Prindeville wrote:
I’ve been seeing spam with such as:
and the style=“VISIBILITY: hidden” is also dubious (why would normal mail have
hidden text???).
Lots of legitmate bulk mail uses this for tracking purposes
Anyone have rules to catch these they could po
I’ve been seeing spam with such as:
and the style=“VISIBILITY: hidden” is also dubious (why would normal mail have
hidden text???).
Anyone have rules to catch these they could point me at? Or any empirical
evidence about how successful they’ve been with such?
Thanks,
-Philip
12 matches
Mail list logo
