How to regex to block this spammer ?

[altomarketing]

Hi !

Sorry im new at this , so i need your help.

I notice in my servers that spammers rotates ips, rotate domains, but all spam we receive are sent using Interinspire Email marketer AKA = IEM

I would like to block ANY inbound emails to the server that has this line:

Code: Select all

List-Unsubscribe: <http://%%MATCHANYDOMAIN%%/unsubscribe.php?M=

How can i do it ?

[Sergio]

What you are looking for is an Spamassassin rule to block that emails, the rule could be as follows:

Code: Select all

body        Check_Body   /List-Unsubscribe\: \<http\://%%MATCHANYDOMAIN%%/unsubscribe\.php\?M\=/i
describe  Check_Body   Unsubscribe List spam
score       Check_Body   5.0

Sergio