What Object - Rule to match a word in mail content

[Service Informatique FHM]

Hi PMG Forum

I try to create a rule to match mail content against a regexp.
But AFAIK, mail content is not a field like "subject" can be. Am I wrong ?

Could you give me the trick to create a rule that can match against mail content ?

Thanks in advance,
SIFHM

 

[hata_ph]

Use spamassassin custom rules to filter mail content.

https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#_custom_spamassassin_configuration
https://cwiki.apache.org/confluence/display/SPAMASSASSIN/writingrules
https://github.com/kawaiipantsu/spamassassin-rules/tree/master/rules

 

[Service Informatique FHM]

Thanks a lot @hata_ph

I'll have a look to the spamassassin rules

Have a nice day !

 

[GG_jr]

Hi PMG Forum

I try to create a rule to match mail content against a regexp.
But AFAIK, mail content is not a field like "subject" can be. Am I wrong ?

Could you give me the trick to create a rule that can match against mail content ?

Thanks in advance,
SIFHM

Hi,

You can use Message as Field.
Gabriel

 

[poetry]

Hi,

You can use Message as Field.
Gabriel

View attachment 43424

I would vote against making such rules. It's very easy to get a very high number of false positives if you have many different rules with Message as Field so be very careful if you decide to make such rules...
I would always say no I will not even start making such rules because this is a never ending game against spammers. They will change the subject, they will change the content of email, they will change the server from where they send email. Like some spam will go pass the gateway no way around it unless you have hours per day of time to monitor every message and accept/deny them from quarantine or simillar.

 

[GG_jr]

I would vote against making such rules. It's very easy to get a very high number of false positives if you have any different rules with Message as Field so be very careful if you decide to make such rules...

Hi,

Thank you for the advice.
I created these rules for several emails of almost the same type, which alternate the keywords between Subject and Message (please see the attachment). I will use this type of ruler as rarely as possible, only when I can be very precise.
DNSBL sites do their job well!

Thank you again for the advice!

BR,
Gabriel

P.S
I was just reviewing these emails and in 99% of cases, the phrase "Telegram - @Cryptaxbot" is present. I could reduce the rules to just one.

 

[kirschi]

Hi,

I came to this thread as I try myself to realize some expression blacklist. However for me it doesn't seem to work. I have created a WhatObject (any matches) containing a few entries with Match Field Message and a single expression like "chainsaw". I also tried some test strings and they worked perfectly. I have then created a rule to quarantine mails with expressions from that What Object but the still go through. Yes, the rule is enabled and I also doublechecked for the correct priority. Did I miss something?

Yes, I know spamassassin is recommend but just for a start...

Thanks
Daniel