Wishing to add email account filter to discard certain domains

Of late, the majority of unsolicited (SPAM) mail received has either a web-page or email link to Russian domains. I am wishing to use the cPanel email "Account Level Filtering" to create a Rule that would allow detection of a specific domain extensions and discard all email containing that detail.
A much earlier thread suggested that a rule as, (see below), would accomplish the required results.

Body - matched regex - htt://*.ru - discard message
and
Body - matched regex - @*.ru - discard message

Whilst these rules appear to work using the "Filter Test", in full action do not. I suspect this is due to the domain and email information being as "Links" as opposed to plain text used in the test filter.

Does any body have any ideas as to how to make an effective rule to discard these unwanted emails.

Regard,