help with blocking this tyoe of email spam RSS


Your help on blocking these emails is apprecitated. Lots of R rated Spam always coming from a particular user name (ANGEL) with always differing email addresses. Please see header below. I believe there is a way to block RAW header emails with REGEX correct? Please advise... Thank You

Date: Sat, 05 Nov 2011 19:00:46 -0400
From: "ANGEL"
MIME-Version: 1.0
Subject: Welcome!

by R Drum 7 years ago

@R Drum: Yes, ORF supports testing the MIME header contents.

1. Start the Administration Tool
2. Make sure the Keyword Blacklist test is enabled (Configuration / Tests / Tests)
3. Expand Configuration / Filtering - On Arrival / Keyword Blacklist in the left navigation tree
4. Click New
5. On the Filter Properties tab, set the Search scope radio button to "Raw MIME"
6. Add a comment text, so you can identify the filter later, e.g. "ANGEL in MIME From: line"
7. On the Filter Expression tab, add the following expression:


8. Set the Expression type to "Regular expression (Perl-compatible)"
9. Click OK, and press Ctrl + S to save the configuration.

Please note that by using the recommended automated tests of ORF, it is capable of detecting more than 99% of spam with zero false positives (, and without the need of adding any manual expressions. Please make sure ORF is configured as per our recommendations (see

by Krisztian Fekete (Vamsoft) 7 years ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

Email address (will not be published):
Your comment:

ORF Technical Support

Configuring, installing and troubleshooting ORF.

News & Announcements

Your dose of ORF-related news and announcements.

Everything but ORF

Discuss Exchange and system administration with fellow admins.

Feature Test Program

Feature Test Program discussion. Membership is required to visit this forum.

ORF Beta

Join the great bug hunt of the latest test release.

Customer Service

Stay Informed