have you test this regex?:

header SPAM11OctF1 From =~ /.*airecom612\+97d7d60a91d9695c9a4240f92d5c3cae\@/i
describe SPAM11OctF1 From address contains the word airecom612@
score SPAM11OctF1 10.0

it must work



I think that the parenthesis are not necessary and the @ must be escaped
     I sometimes use brackets to filter Subject (some times multiple
Subjects). They work.

see one rule I use below . It is for Subject with brackets. Not for From address


file /etc/mail/spamassassin/SPAM_12AUG2016_Subject_1.cf

header SPAMS1 Subject =~ /(special offer|Marketing Strategy|amazing
offer|intake|Enroll Now)/i
describe SPAMS1 Email contains the above words
score SPAMS1 9.0


anyway, I removed brackets this time. Let's see what happens now. I
think \@ is a good point I should think of.

this is my new rule


file  /etc/mail/spamassassin/SPAM_11Oct2016_From_1.cf

header SPAM11OctF1 From =~ /^airecom612\+97d7d60a91d9695c9a4240f92d5c3cae\@/i
describe SPAM11OctF1 From address contains the word airecom612@
score SPAM11OctF1 10.0





^.*airecom612\+97d7d60a91d9695c9a4240f92d5c3cae\@

for check onhttps://regex101.com  you can try the regex on complete mail source 
code like this:

......
......

X-Received: by 10.194.204.198 with SMTP id la6mr8163648wjc.2.1476250191474;
  Tue, 11 Oct 2016 22:29:51 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.194.122.104 with HTTP; Tue, 11 Oct 2016 22:29:51 -0700 (PDT)
From: Indunil Jayasooriya<induni...@gmail.com>
Date: Wed, 12 Oct 2016 10:59:51 +0530
Message-ID:<CAJF2yJRrygrg6myKO_Trd=2OQUP7Qd3LkObE=XH=4h3he84...@mail.gmail.com>
Subject: spam assassin rule to block a From address
To:amavis-users@amavis.org
Content-Type: text/plain; charset=UTF-8
X-BeenThere:amavis-users@amavis.org
......
.......



are you for usage of '^' ? because the string not start with sender address, 
you can try withou it.

^ - start matching from the beginning of the string in regex

anyway, without it, I can try.



here's my new file ( without ^ )

my /etc/mail/spamassassin/SPAM_11Oct2016_From_1.cf file

header SPAM11OctF1 From =~ /(airecom612\+97d7d60a91d9695c9a4240f92d5c3cae)@/i
describe SPAM11OctF1 From address contains the word airecom612@
score SPAM11OctF1 10.0


Can you post to us a source code of spam mail?
here's the log.

Oct 12 02:55:37 mailgw amavis[1054]: (01054-03) Passed CLEAN [190.123.45.119] 
[190.123.45.119]airecom612+97d7d60a91d9695c9a4240f92d5c3...@therealizationofhealth.net
  -r...@mydomain.com  
Message-ID:97d7d60a91d9695c9a4240f92d5c3...@therealizationofhealth.net  
mail_id: dOZ+MykHl9Z2 Hits: -0.047 size: 11977 queued_as: 32CE11084D 9548 ms


Ideas are welcome.




12 Calcinaia (PI)
Tel +39058759108
cell 340 8398772
E-mail:mauri...@etarom.com
Assistenza:assiste...@etarom.com
p.e.c.eta...@pec.etarom.com

Non indugiare oltre!, attiva adesso la tua casella di Posta Elettronica 
Certificata, per maggiori informazioni consulta la nostra news qui


****************************************
Qualora questo messaggio fosse da Voi ricevuto per errore vogliate cortesemente 
darcene notizia a mezzo telefax o e-mail e distruggere il messaggio ricevuto 
erroneamente. Quanto precede ai fini del rispetto del D.Lgs 196/03 sulla tutela 
dei dati personali.
****************************************


--
cat /etc/motd

Thank you
Indunil Jayasooriya
http://www.theravadanet.net/
http://www.siyabas.lk/sinhala_how_to_install.html    -  Download Sinhala Fonts



--


Via del Tiglio 45
56012 Calcinaia (PI)
Tel +39058759108
cell 340 8398772
e-maili...@etarom.com
p.e.c.eta...@pec.etarom.com

Non indugiare oltre!, attiva adesso la tua casella di Posta Elettronica 
Certificata, per maggiori informazioni consulta la nostra news qui


****************************************
Qualora questo messaggio fosse da Voi ricevuto per errore vogliate cortesemente 
darcene notizia a mezzo telefax o e-mail e distruggere il messaggio ricevuto 
erroneamente. Quanto precede ai fini del rispetto del D.Lgs 196/03 sulla tutela 
dei dati personali.
****************************************





--

<https://www.etarom.com/>
Via del Tiglio 45 56012 Calcinaia (PI)
Tel +39058759108
cell 340 8398772
E-mail: mauri...@etarom.com <mailto:mauri...@etarom.com>
Assistenza: assiste...@etarom.com <mailto:assiste...@etarom.com>
P.E.C. eta...@pec.etarom.com <mailto:eta...@pec.etarom.com>

Non indugiare oltre!, attiva adesso la tua casella di *P*osta *E*lettronica *C*ertificata, per maggiori informazioni consulta la nostra news qui <https://www.etarom.com/ETAROM/ShowNews.php?new=142e3a0dbdd57282212742d9025b8aa04aece90b4731f9f45c9bda1c8139a151>



****************************************
Qualora questo messaggio fosse da Voi ricevuto per errore vogliate cortesemente darcene notizia a mezzo telefax o e-mail e distruggere il messaggio ricevuto erroneamente. Quanto precede ai fini del rispetto del D.Lgs 196/03 sulla tutela dei dati personali.
****************************************

Reply via email to