block with regex in body of the message

[ghesi]

Hi,
I want to create a regex to block words/phrases in the body of the message but something is not working and its gets frustating because I use the same code for subject and no probleme there.
These phrases and words I want to block:
"bancar a fost folosit ilegal|App development on iOS and Android|Using their bank account|and text boxes|an security researcher and I have found a bug in your website|requires all users to verify their wallets|Your multichain crypto wallet|to synchronise your wallet|putea folosijcardul dac|tualizarejdejsecuritate|altejtranzac|are a Mobile Apps and|and propose the best offers|rivire lajcredituljpe c|expecting a bug bounty"

I tried

body=(?i)(\W|^)(bancar a fost folosit ilegal|App development on iOS and Android|Using their bank account|and text boxes|an security researcher and I have found a bug in your website|requires all users to verify their wallets|Your multichain crypto wallet|to synchronise your wallet|putea folosijcardul dac|tualizarejdejsecuritate|altejtranzac|are a Mobile Apps and|and propose the best offers|rivire lajcredituljpe c|expecting a bug bounty)(\W|$)

or

body=(?i)(\W|^)(bancar\sa\sfost\sfolosit\silegal|App\sdevelopment\son\siOS\sand\sAndroid|Using\stheir\sbank\saccount|and\stext\sboxes|an\ssecurity\sresearcher\sand\sI\shave\sfound\sa\sbug\sin\syour\swebsite|requires\sall\susers\sto\sverify\stheir\swallets|Your\smultichain\scrypto\swallet|to\ssynchronise\syour\swallet|putea\sfolosijcardul\sdac|tualizarejdejsecuritate|altejtranzac|are\sa\sMobile\sApps\sand|and\spropose\sthe\sbest\soffers|rivire\slajcredituljpe\sc|expecting\sa\sbug\sbounty)(\W|$)

and the messages are not blocked
What is frustating is that blocking on subject works using:

subject=(?i)(\W|^)(blocat\scardurile|cardurile\stemporar|believe\sthey\sare\styping\sin\sthe\spassword|for\sthe\sethical\sdisclosure\sof\sthe\svulnerabilit|wallet\shas\sbeen\slocked|Telekom\sRomania\sMobile)(\W|$)

What im doing wrong here?

 

[Stoiko Ivanov]

matches on the mail-body are not possible through the rulesystem (for performance reasons)

see e.g. https://forum.proxmox.com/threads/h...malicious-characteristics）.119710/post-519675
(there are quite a few threads here with similar questions)

I hope this helps!

 

[ghesi]

Ok, got it.
Thanks.