Re: Blocking cannibalized spam/virus mail with password-protected attachments
Nikolaos Milas <[email protected]>
| Newsgroups | gmane.mail.virus.amavis.user |
|---|---|
| Organization | National Observatory of Athens |
| Message-ID | <[email protected]> |
On 22/12/2020 11:18 π.μ., Matus UHLAR - fantomas wrote: > spamassassin rule could look like this: > > body __ARCHIVE_PASSWORD_1 /pass(word)? archiv(e|io):/i > body __ARCHIVE_PASSWORD_2 /archiv(e|io) pass(word)?:/i > meta ARCHIVE_PASSWORD __ARCHIVE_PASSWORD_1 || > __ARCHIVE_PASSWORD_2 > describe ARCHIVE_PASSWORD provides archive password > score ARCHIVE_PASSWORD 5 Hi Matus, How could I modify the above to also capture the text "Archiv Passwort: 9999" Would the following work? body __ARCHIVE_PASSWORD_1 /pass(word|wort)? archiv(e|io)?:/i body __ARCHIVE_PASSWORD_2 /archiv(e|io)? pass(word|wort)?:/i meta ARCHIVE_PASSWORD __ARCHIVE_PASSWORD_1 || __ARCHIVE_PASSWORD_2 describe ARCHIVE_PASSWORD provides archive password score ARCHIVE_PASSWORD 5 Sorry, I am struggling through these... Thanks, Nick