I'm trying to match anything that contains the word bounce or bounces in the FROM field.
I'm seeing a lot of spam in the Efa-project logs coming from emails addresses such as:
These messages are all outbound, since our Efa-project server is an outbound filter only. In trying to stop these messages leaving our network, I can't seem to get a good match on the regex.
This is what I have:
header BOUNCE_FILTRADO From =~ /.*bounce.*/i
score BOUNCE_FILTRADO 3.5
describe BOUNCE_FILTRADO Backscatter spam
header BOUNCES_FILTRADO From =~ /.*bounces.*/i
score BOUNCES_FILTRADO 3.5
describe BOUNCES_FILTRADO Backscatter spam
Thanks in advance