SpamAssassin regex help

Questions and answers about how to do stuff
Post Reply
pingu
Posts: 9
Joined: 10 Dec 2020 08:07

SpamAssassin regex help

Post by pingu » 11 Jun 2021 08:29

Hey guys,

I'm trying to match anything that contains the word bounce or bounces in the FROM field.
I'm seeing a lot of spam in the Efa-project logs coming from emails addresses such as:


bounce+77cb6b.21948c-jgdancdsco=domain.com@domain.com

or

srs0=jkic=n4=sends.mysoapbox.com=bounces+13768798-5b57-amy=domain.com@domain.com


These messages are all outbound, since our Efa-project server is an outbound filter only. In trying to stop these messages leaving our network, I can't seem to get a good match on the regex.

This is what I have:
header BOUNCE_FILTRADO From =~ /.*bounce.*/i
score BOUNCE_FILTRADO 3.5
describe BOUNCE_FILTRADO Backscatter spam

header BOUNCES_FILTRADO From =~ /.*bounces.*/i
score BOUNCES_FILTRADO 3.5
describe BOUNCES_FILTRADO Backscatter spam

Thanks in advance

Post Reply