[Mimedefang] I give up on blocking this one
David Prestwich
dprestwich at pacsim.com
Mon Feb 23 11:48:27 EST 2004
I've added a couple of rules but just can't seem to get these emails
blocked for the life of me. Anyone else had any luck? The emails are
the viagra, xanax, and valium ones with variants on this subject line:
FWD: All Meds Here. v1 at GRA = X+A+Nax . Va1ium , Fi`0ric3t \ So|m|a *
.Pntermin. TBSJO
I've set these rules in my local.cf with no luck.
header Y_SUBJ_VIAGRA_OBF Subject = Subject =~
/\bV[1|;i!].?[a@]g.?r.?[a@]/i
describe Y_SUBJ_VIAGRA_OBF Subject contains possibly obfuscated
'Viagra'
score Y_SUBJ_VIAGRA_OBF 3.5
header Y_SUBJ_XANAX_OBF Subject =~ /\bX(a|@|\(a\))n[a@]x/i
describe Y_SUBJ_XANAX_OBF Subject contains possible obfuscated 'Xanax'
score Y_SUBJ_XANAX_OBF 3.5
Any help would be appreciated. I would have sent this message to SA
talk but haven't seen any emails come across it's list for some time now.
/David
More information about the MIMEDefang
mailing list