[SOLVED] Move mails with special text to quarantaine

[wwweiss]

I would like to filter out mails having a link in the message body with .../ub.php?... If a mail has this content it should be moved to the users spam-quarantaine. I know about the risk of false positives, but during my tests over one week I had about 10.000 spam mails and only one false!
How can I get this filter? As far as I understand now the way should be to add a custom.cf into the spamassassin directory /etc/mail/spamassassin, but I have no idea how to make such a rule. Can someone give me an example what I should have inside custom.cf? Or is there any other option available in the web interface?

 

[Stoiko Ivanov]

this is quite well explained in the Spamassassin documentation:
https://cwiki.apache.org/confluence/display/SPAMASSASSIN/WritingRules

add a body rule (the part between the '/' is a regular expression) with fitting score

afterwards you need to restart pmg-smtp-filter

make sure to keep an eye on your logs (especially the processing time)

I hope this helps!

 

[wwweiss]

Thank you very much! It is really very easy - I just needed this hint, because I already made some tests before, which all were not working because I did not restart pmg-smtp-filter. Maybe an important note for anyone else playing with additional rules.

 

[Stoiko Ivanov]

Glad that worked out.

Please mark the thread as 'SOLVED' - it could help others in similar situations

Thanks!