[Rspamd-Users] How to mark this kind of mails as spam ...

[Steve Witten]

The way I would do this is write a rule using the Lua API.

You would use the *Message parts module* (
https://rspamd.com/doc/lua/rspamd_mimepart.html) to get the Subject. You
would then use the *Message parts module* to loop through all the
attachments looking for an attachment that:

   - has a *Content-Type* of *application/pdf*; and
   - has a name matching the contents of the Subject with *.pdf* appended.

Set the score appropriately if the message matches.

There are examples of how to loop through the attachments at the link above.

*Lua* is pretty easy to learn (https://www.lua.org/pil/ &
https://www.lua.org/manual/5.1/) and the *luajit* implementation that you
need to run *rspamd* (https://luajit.org) is lightning fast.  Performance
shouldn't be an issue if you eliminate lots of cases for
further consideration before getting to the loop (*e.g.,* the message has
no attachments, etc.)

I hope this helps...

--
Steve Witten
Portland, OR

On Tue, May 28, 2024 at 8:40 AM Albrecht Backhaus via Users <
users at lists.rspamd.com> wrote:

> Good evening everyone
>
> Lately I have been receiving an increasing number of unsolicited CVs (?)
> (as PDF) with comprehensive SPAM applications. The only pattern that is
> recognizable, is that the subject of the email matches the file name
> (without the extension) of the attached PDF file.
>
> Does anyone have a tip on how I can recognize and block this type of
> spam?
>
> Thanks in advance
>