help with blocking this tyoe of email spam RSS Back to forum
@R Drum:
Yes, ORF supports testing the MIME header contents.
1. Start the Administration Tool
2. Make sure the Keyword Blacklist test is enabled (Configuration / Tests / Tests)
3. Expand Configuration / Filtering - On Arrival / Keyword Blacklist in the left navigation tree
4. Click New
5. On the Filter Properties tab, set the Search scope radio button to "Raw MIME"
6. Add a comment text, so you can identify the filter later, e.g. "ANGEL in MIME From: line"
7. On the Filter Expression tab, add the following expression:
.*^From:\s*"ANGEL"[^\r\n]*$
8. Set the Expression type to "Regular expression (Perl-compatible)"
9. Click OK, and press Ctrl + S to save the configuration.
Please note that by using the recommended automated tests of ORF, it is capable of detecting more than 99% of spam with zero false positives (http://www.vamsoft.com/press-release-2011-11-25.asp), and without the need of adding any manual expressions. Please make sure ORF is configured as per our recommendations (see http://www.vamsoft.com/downloads/getmostguide.pdf)
Your help on blocking these emails is apprecitated. Lots of R rated Spam always coming from a particular user name (ANGEL) with always differing email addresses. Please see header below. I believe there is a way to block RAW header emails with REGEX correct? Please advise... Thank You
Date: Sat, 05 Nov 2011 19:00:46 -0400
From: "ANGEL" <>
MIME-Version: 1.0
To: <>
Subject: Welcome!