[Rspamd-Users] How to mark this kind of mails as spam ...

[Tino Hendricks]

I was lazy and found that the two headers

/Exim 4\.96.*envelope-from <hostmaster@/
/X-Mailer: Thunderbird/

are ALWAYS and only there present, so to my setup it works 100% with a simple multimap

BEWERBUNGEN {
    type = "content";
    filter = "headers";
    map = "${LOCAL_CONFDIR}/local.d/bewerbungen.map";
    prefilter = false;
	score = 6.0;
    regexp = true;
}

Cheers,

Tino

> Am 28.05.2024 um 17:39 schrieb Albrecht Backhaus via Users <users at lists.rspamd.com>:
> 
> Good evening everyone
> 
> Lately I have been receiving an increasing number of unsolicited CVs (?) (as PDF) with comprehensive SPAM applications. The only pattern that is recognizable, is that the subject of the email matches the file name (without the extension) of the attached PDF file.
> 
> Does anyone have a tip on how I can recognize and block this type of spam?
> 
> Thanks in advance
> 
> -- 
> Users mailing list
> Users at lists.rspamd.com
> https://lists.rspamd.com/mailman/listinfo/users