How can I block these types of emails?? RSS

1

Whats the best way to go about blocking a certain type of spam. We get dozens of emails with the subject of: Newsletter Thu, 21 Apr 2011 03:44:34 +0200

THe sender, IP and time/date at the end of the subject is always different and I dont wan to block all emails with Newslettter in the subject .



Version: 4.4 REGISTERED
Log Mode: Verbose
Server: FS-MAIL.srf.ca
Source: SMTPSVC-1
Time: 4/20/2011 9:42:17 PM
Class: Pass
Severity: Information
Actions: (not available)
Filtering Point: On Arrival
HELO/EHLO Domain: (not available)
Related IP Address: 41.199.62.122
Message ID: (not available)
Email Subject: Newsletter Thu, 21 Apr 2011 03:44:34 +0200
Sender:
Recipient(s):
*
Message:
Email passed checks.

by Dan 7 years ago
2

Forgot to mention. Most of these emails are being rejected, but about 1/4 of them are getting by ORF>

by Dan 7 years ago
3

@Dan: You can use a very specific Keyword Blacklist regular expression against these (with Subject scope).

^Newsletter \w{3}, \d{1,2} \w{3} \d{4} \d{2}:\d{2}:\d{2} \+\d{4}$

This builds up as:

* ^Newsletter: Starts with with the "Newsletter" string
* \w{3}: Exactly three "word" characters (letters, numbers and the underscore character)
* \d{1,2}: One or two digits
* [...]
* \+: The + character (must be escaped as \+, because "+" alone is a special character in regular expressions)
* $: The string must end here, i.e. no characters expected between the last \d{4} and the end of the data.

Note that the above regular expression was constructed specifically for the "Newsletter Thu, 21 Apr 2011 03:44:34 +0200" format and any format changes, even just an extra whitespace somewhere will render the filter useless.

by Peter Karsai (ORF Team) 7 years ago
(in reply to this post)

4

@Peter Karsai (ORF Team): Thanks a lot Peter!

by Dan 7 years ago
(in reply to this post)

5

@Dan: I am glad to hear it helped, please let us know if we can be of any further assistance.

by Peter Karsai (ORF Team) 7 years ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

Nickname:
Email address (will not be published):
Your comment:

ORF Technical Support

Configuring, installing and troubleshooting ORF.

News & Announcements

Your dose of ORF-related news and announcements.

Everything but ORF

Discuss Exchange and system administration with fellow admins.

Feature Test Program

Feature Test Program discussion. Membership is required to visit this forum.

ORF Beta

Join the great bug hunt of the latest test release.

Customer Service

Stay Informed