spam assassin rule to block a From address

[Indunil Jayasooriya]

>
> You should probably also match only the address, not the full From line,
> especially when you're anchoring:


what's the difference between From and From:addr ?


>
> header SPAM11OctF1 From:addr =~ /^aireco....

Can you complete this ? anyway here I complete it.


header SPAM11OctF1 From:addr =~
/^airecom612\+97d7d60a91d9695c9a4240f92d5c3cae\@/i
describe SPAM11OctF1 From address contains the word airecom612@
score SPAM11OctF1 10.0

Is it OK?


what are the sites to learn spam-assassin rules?


anyway, I get spam mails with below addressees.


bounce-mc.us8_29275787.517673-wer=mynet.com at mail172.atl61.mcsv.net
ml-bounce-mc.us8_29275787.517673-hewe=mynet.com at mail172.atl61.mcsv.net


I wrote  below  rule to block it. it does NOT seem to work.

header SPAM13OctF1 From =~ /.*bounce.*\@/i
describe SPAM13OctF1 From address contains the word bounce.
score SPAM13OctF1 10.0


should I change from From to From:addr ?

Can you complete it?










>>>
>>> my /etc/mail/spamassassin/SPAM_11Oct2016_From_1.cf file
>>>
>>> header SPAM11OctF1 From =~ /(airecom612\+97d7d60a91d9695c9a4240f92d5c3cae)@/i
>>> describe SPAM11OctF1 From address contains the word airecom612@
>>> score SPAM11OctF1 10.0
>>>
>>>
>>>>
>>>>
>>>> Can you post to us a source code of spam mail?
>>>
>>>
>>> here's the log.
>>>
>>> Oct 12 02:55:37 mailgw amavis[1054]: (01054-03) Passed CLEAN [190.123.45.119] [190.123.45.119] airecom612+97d7d60a91d9695c9a4240f92d5c3cae at therealizationofhealth.net - rept at mydomain.com Message-ID: 97d7d60a91d9695c9a4240f92d5c3cae at therealizationofhealth.net mail_id: dOZ+MykHl9Z2 Hits: -0.047 size: 11977 queued_as: 32CE11084D 9548 ms
>>>
>>>
>>> Ideas are welcome.
>>>
>>>
>>>
>>>
>>>> 12 Calcinaia (PI)
>>>> Tel +39058759108
>>>> cell 340 8398772
>>>> E-mail: maurizio at etarom.com
>>>> Assistenza: assistenza at etarom.com
>>>> P.E.C. etarom at pec.etarom.com
>>>>
>>>> Non indugiare oltre!, attiva adesso la tua casella di Posta Elettronica Certificata, per maggiori informazioni consulta la nostra news qui
>>>>
>>>>
>>>> ****************************************
>>>> Qualora questo messaggio fosse da Voi ricevuto per errore vogliate cortesemente darcene notizia a mezzo telefax o e-mail e distruggere il messaggio ricevuto erroneamente. Quanto precede ai fini del rispetto del D.Lgs 196/03 sulla tutela dei dati personali.
>>>> ****************************************
>>>
>>>
>>>
>>>
>>> --
>>> cat /etc/motd
>>>
>>> Thank you
>>> Indunil Jayasooriya
>>> http://www.theravadanet.net/
>>> http://www.siyabas.lk/sinhala_how_to_install.html   -  Download Sinhala Fonts
>>>
>>>
>>>
>>> --
>>>
>>>
>>> Via del Tiglio 45
>>> 56012 Calcinaia (PI)
>>> Tel +39058759108
>>> cell 340 8398772
>>> E-mail info at etarom.com
>>> P.E.C. etarom at pec.etarom.com
>>>
>>> Non indugiare oltre!, attiva adesso la tua casella di Posta Elettronica Certificata, per maggiori informazioni consulta la nostra news qui
>>>
>>>
>>> ****************************************
>>> Qualora questo messaggio fosse da Voi ricevuto per errore vogliate cortesemente darcene notizia a mezzo telefax o e-mail e distruggere il messaggio ricevuto erroneamente. Quanto precede ai fini del rispetto del D.Lgs 196/03 sulla tutela dei dati personali.
>>> ****************************************
>>
>>
>>
>>



-- 
cat /etc/motd

Thank you
Indunil Jayasooriya
http://www.theravadanet.net/
http://www.siyabas.lk/sinhala_how_to_install.html   -  Download Sinhala Fonts