Could anybody help newbie to build rule for "From:" line? My server is
flooded with spams like this:
From: Enlargement pils Free Sample <derekfron...@latimes.com>
To: <someb...@panska.cz>
Subject: The scientific breakthrough is here
Date: Sun, 23 Oct 2011 18:02:36 -0100
Message-ID: <002801cc91b3$5acd01a0$106704e0$@com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0027_01CC91B3.5ACD01A0"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AcjoW4M4hB7d9osc8YJ1yiNuSNsYkA==
Content-Language: en-us
Return-Path: <>
...
There are more types of these messages, but they always have clear "From:"
name. In contrary the From: address <someth...@somewhere.tld> is changing
message to message.
I tried to use rule like hereunder (and I was modyfiing it many times many
ways), but I cannot find the right expression to triger the spam messages.
header FROM_ENLARG From: =~
/(\bsex\b|\bfree\b|\btrial\b|\benlarge.*|\bpils|sample.*)/i
score FROM_ENLARG 5
describe FROM_ENLARG From contains words like enrargement, pils
etc.
When I test the regex using http://www.quanetic.com/Regex, it seems to work,
and also spamassassin --lint is not protesting.
Thanks a lot in advance for any help.
Jakub
--
View this message in context:
http://old.nabble.com/How-to-write-rule-for-From%3A-line-tp32706137p32706137.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
