>>> \s is the proper way to represent whitespace.
>>
>> lol, yes, I know that; I was actually trying to match 's' and the
>> slash is the start of the pattern match.
>
> I wasn't referring to the beginning of the RE.
Yeah, I realized that just after I sent this, if anyone cares :-)
Thanks again,
McDonald, Dan wrote:
>
> From: Matt Kettler [mailto:mkettler...@verizon.net]
>
> >This rule should detect 10 consecutive occurrences.
> >uri L_URI_FUNNYDOTS /(?:\.[a-z,0-9]{2}\.){10}
>
> >Warning: I wrote this quickly without too much thought. It may have
> >bugs, but I'm short on time at the
On Fri, 2009-09-11 at 15:09 -0400, MySQL Student wrote:
> Hi,
>
> > The 'doubleheadedrover' domain currently shows up in Razor(E8),
> > uribl_black, surbl_jp, and invaluement.
> >
> > But it wasn't in all of those when he first started posting about it.
>
> Yes, that's correct. Thanks for your he
On Fri, 2009-09-11 at 12:43 -0700, John Hardin wrote:
> \s is the proper way to represent whitespace.
True. However, in all rule types that use rendered text, there is only a
space -- no tabs. Well, there are newlines, but that doesn't matter
unless you use special modifiers. ;)
Actually, this re
On Fri, 2009-09-11 at 15:09 -0400, Alex wrote:
> I'd like to create a rule that matches a specific letter and up to 5
> spaces after it, repeated ten times. I'm thinking something like this:
>
> /s\ {5}o\ {5}n\ {5}i\ {5}c\ {5}\ m\ {5}e\ {5}d\ {5}i\ {5}a/i
A space does not have any special meaning
On Fri, 11 Sep 2009, MySQL Student wrote:
I'd like to create a rule that matches a specific letter and up to 5
spaces after it, repeated ten times. I'm thinking something like this:
/s\ {5}o\ {5}n\ {5}i\ {5}c\ {5}\ m\ {5}e\ {5}d\ {5}i\ {5}a/i
\s is the proper way to represent whitespace.
{5}
Hi,
> The 'doubleheadedrover' domain currently shows up in Razor(E8),
> uribl_black, surbl_jp, and invaluement.
>
> But it wasn't in all of those when he first started posting about it.
Yes, that's correct. Thanks for your help. That's already caught a
few. I have another that I thought you could
On Fri, 2009-09-11 at 14:37 +0200, Matus UHLAR - fantomas wrote:
> On 10.09.09 18:28, MySQL Student wrote:
> > I've seen this pattern in spam quite a bit lately:
> >
> > href="http://EXAMPLE.com/jazert/html/?39.6d.3d.31.66.67.6b.79.77.63.77.63.65.6e.74.69.6e.6e.69
> > .61.6c.5f.68.31.33.33.2e.6f.3
On 10.09.09 18:28, MySQL Student wrote:
> I've seen this pattern in spam quite a bit lately:
>
> href="http://doubleheaderover.com/jazert/html/?39.6d.3d.31.66.67.6b.79.77.63.77.63.65.6e.74.69.6e.6e.69
> .61.6c.5f.68.31.33.33.2e.6f.39.39.41.4d.2e.30.30.45.33.39.2e.30.32.30.61.64.6b.37.61.76.61.67.6
From: Matt Kettler [mailto:mkettler...@verizon.net]
>This rule should detect 10 consecutive occurrences.
>uri L_URI_FUNNYDOTS /(?:\.[a-z,0-9]{2}\.){10}
>Warning: I wrote this quickly without too much thought. It may have
>bugs, but I'm short on time at the moment.
your variant would requir
On Thu, 2009-09-10 at 18:28 -0400, MySQL Student wrote:
> Hi all,
>
> I've seen this pattern in spam quite a bit lately:
>
> href="http://doubleheaderover.com/jazert/html/?39.6d.3d.31.66.67.6b.79.77.63.77.63.65.6e.74.69.6e.6e.69
> .61.6c.5f.68.31.33.33.2e.6f.39.39.41.4d.2e.30.30.45.33.39.2e.30.32
MySQL Student wrote:
> Hi all,
>
> I've seen this pattern in spam quite a bit lately:
>
>
> Would it be reasonable to create a rule that looks for this two-char
> then dot pattern, or is it reasonable that it might appear in a
> legitimate email too frequently? If possible, how would you create
Hi all,
I've seen this pattern in spam quite a bit lately:
href="http://doubleheaderover.com/jazert/html/?39.6d.3d.31.66.67.6b.79.77.63.77.63.65.6e.74.69.6e.6e.69
.61.6c.5f.68.31.33.33.2e.6f.39.39.41.4d.2e.30.30.45.33.39.2e.30.32.30.61.64.6b.37.61.76.61.67.63.31.66.
62.2e.6a.61.7a.65.72.74.2e.68.
13 matches
Mail list logo
