In fact, there was this error, even after fixing it still didn't work.
I believe that the problem was occurring because the message had a HMTL
attached and in turn had a link to the file. I decided to change and do
as follows:
header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i
body __ORCAMENTO_B /or.*amento|planilha|urgente/i
mimeheader __ORCAMENTO_M Content-Disposition =~ /\.html[";]/i
meta ORCAMENTO ( __ORCAMENTO_H || __ORCAMENTO_B ) && __ORCAMENTO_M
score ORCAMENTO 5.5
I don't know if you're absolutely correct and efficient, but I did some
tests with a few spams and seems to have worked
Em 28-05-2014 11:38, Bowie Bailey escreveu:
On 5/28/2014 9:19 AM, Rejaine Monteiro wrote:
Hi
I need a rule to block spam contains
Subject or Body contains words 'or.*amento' or 'planilha' or 'urgente'
AND URI contains links to orcamento or panilha (php or pdf)
So, I doing this:
header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i
body __ORCAMENTO_B /or.*amento|planilha|urgente/i
uri __ORCAMENTO_U
/orcamento\.php|/orcamento\.pdf|planilha\.php|planilha\.pdf)
meta ORCAMENTO ( __JAMEF_ORCAMENTO_H || __JAMEF_ORCAMENTO_B ) &&
__JAMEF_ORCAMENTO_U
score ORCAMENTO 5.5
describe ORCAMENTO Fala sobre orçamentos urgentes e contem links
supostamente para arquivos PDF
But is not working. What I'm doing wrong?
__JAMEF_ORCAMENTO_H is not the same as __ORCAMENTO_H.
Make sure you are using the same name in the meta as you use to define
the rules.
I don't see anything else obviously wrong. If it's still not working,
put a sample spam in pastebin and give us a link so we can see what
the full spam looks like and test the rules for ourselves.
