On 5/28/2014 9:19 AM, Rejaine Monteiro wrote:
Hi
I need a rule to block spam contains
Subject or Body contains words 'or.*amento' or 'planilha' or 'urgente'
AND URI contains links to orcamento or panilha (php or pdf)
So, I doing this:
header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i
body __ORCAMENTO_B /or.*amento|planilha|urgente/i
uri __ORCAMENTO_U
/orcamento\.php|/orcamento\.pdf|planilha\.php|planilha\.pdf)
meta ORCAMENTO ( __JAMEF_ORCAMENTO_H || __JAMEF_ORCAMENTO_B ) &&
__JAMEF_ORCAMENTO_U
score ORCAMENTO 5.5
describe ORCAMENTO Fala sobre orçamentos urgentes e contem links
supostamente para arquivos PDF
But is not working. What I'm doing wrong?
__JAMEF_ORCAMENTO_H is not the same as __ORCAMENTO_H.
Make sure you are using the same name in the meta as you use to define
the rules.
I don't see anything else obviously wrong. If it's still not working,
put a sample spam in pastebin and give us a link so we can see what the
full spam looks like and test the rules for ourselves.
--
Bowie
