I've added a couple of rules but just can't seem to get these emails blocked for the life of me. Anyone else had any luck? The emails are the viagra, xanax, and valium ones with variants on this subject line: FWD: All Meds Here. [EMAIL PROTECTED] = X+A+Nax . Va1ium , Fi`0ric3t \ So|m|a * .Pntermin. TBSJO

I've set these rules in my local.cf with no luck.

header Y_SUBJ_VIAGRA_OBF Subject = Subject =~ /\bV[1|;[EMAIL PROTECTED]@]/i
describe Y_SUBJ_VIAGRA_OBF Subject contains possibly obfuscated 'Viagra'
score Y_SUBJ_VIAGRA_OBF 3.5


header Y_SUBJ_XANAX_OBF         Subject =~ /\bX(a|@|\(a\))[EMAIL PROTECTED]/i
describe Y_SUBJ_XANAX_OBF       Subject contains possible obfuscated 'Xanax'
score Y_SUBJ_XANAX_OBF          3.5


Any help would be appreciated. I would have sent this message to SA talk but haven't seen any emails come across it's list for some time now.


/David
_______________________________________________
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang

Reply via email to