mailbody scan

[seechiller]

I have a new mail gateway running and notice that almost all mails arrive with links in the form page.link, e.g.:
https://ifjuzcfj.page.link/bG1vcFmTTsSp18FC9
https://tasuulmw.page.link/1KxEGmkkbaGfvPaa8
https://dkrldfgl.page.link/11sFfZPAviB66TXP8
https://lajrahba.page.link/SwNfro99dBWPUeAp7
https://hswxaher.page.link/FXYm5udAqpFMeQMd7
https://anqjoiqw.page.link/coHRBruBvrdEtCzw8

I have created a regex for this:
https:\/\/[a-z0-9]+\.page\.link\/[a-zA-Z0-9_-]+

Now the question is where do I integrate this so that the content of the mails is scanned, if there is a hit, the mail should be rejected / filtered immediately and not appear in the quarantine.

What is the best way to do this?

 

[Stoiko Ivanov]

For matching strings in the body you need to create a custom spamassassin configuration:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#_custom_spamassassin_configuration
The rule-system only matches information in the headers, because matching in the body usually creates false positives and can lead to very long scanning times.

I hope this helps!