These are commonly seen with viruses trying to pass attachments through with a filename like foofile.doc.exe, causing Windows to typically not show the .exe extention, misleading the client into thinking the file is safe to open. Sometimes this block will deny innocent files, so use this with moderate caution.

The extra complexity at the start of the regex (^[^\.]*) is to make sure there are no other preceeding '.' chars prior to the finishing double-triple, this helps reduce the false hit rate.