[Mimedefang] I give up on blocking this one

David Prestwich dprestwich at pacsim.com
Mon Feb 23 11:48:27 EST 2004


I've added a couple of rules but just can't seem to get these emails 
blocked for the life of me.  Anyone else had any luck?  The emails are 
the viagra, xanax, and valium ones with variants on this subject line:  
FWD: All Meds Here. v1 at GRA = X+A+Nax . Va1ium , Fi`0ric3t \ So|m|a * 
.Pntermin. TBSJO

I've set these rules in my local.cf with no luck.

header Y_SUBJ_VIAGRA_OBF        Subject = Subject =~ 
/\bV[1|;i!].?[a@]g.?r.?[a@]/i
describe Y_SUBJ_VIAGRA_OBF      Subject contains possibly obfuscated 
'Viagra'
score Y_SUBJ_VIAGRA_OBF         3.5

header Y_SUBJ_XANAX_OBF         Subject =~ /\bX(a|@|\(a\))n[a@]x/i
describe Y_SUBJ_XANAX_OBF       Subject contains possible obfuscated 'Xanax'
score Y_SUBJ_XANAX_OBF          3.5


Any help would be appreciated.  I would have sent this message to SA 
talk but haven't seen any emails come across it's list for some time now.

/David



More information about the MIMEDefang mailing list