help with blocking this tyoe of email spam - ORF Forums

help with blocking this tyoe of email spam RSS Back to forum


Your help on blocking these emails is apprecitated. Lots of R rated Spam always coming from a particular user name (ANGEL) with always differing email addresses. Please see header below. I believe there is a way to block RAW header emails with REGEX correct? Please advise... Thank You

Date: Sat, 05 Nov 2011 19:00:46 -0400
From: "ANGEL"
MIME-Version: 1.0
Subject: Welcome!

by R Drum 8 years ago

@R Drum: Yes, ORF supports testing the MIME header contents.

1. Start the Administration Tool
2. Make sure the Keyword Blacklist test is enabled (Configuration / Tests / Tests)
3. Expand Configuration / Filtering - On Arrival / Keyword Blacklist in the left navigation tree
4. Click New
5. On the Filter Properties tab, set the Search scope radio button to "Raw MIME"
6. Add a comment text, so you can identify the filter later, e.g. "ANGEL in MIME From: line"
7. On the Filter Expression tab, add the following expression:


8. Set the Expression type to "Regular expression (Perl-compatible)"
9. Click OK, and press Ctrl + S to save the configuration.

Please note that by using the recommended automated tests of ORF, it is capable of detecting more than 99% of spam with zero false positives (, and without the need of adding any manual expressions. Please make sure ORF is configured as per our recommendations (see

by Krisztian Fekete (Vamsoft) 8 years ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2