Write a keyword blacklist expressions for phishing - ORF Forums

@Monkeenmao: Hello,

If you want to block emails that contain hyperlinks which include an "email=*@*.*" string in the URL, I recommend the following:

1. Start the 'ORF Administration Tool'
2. Navigate to 'Blacklists > Keyword Blacklist' page
3. Click 'New'
4. In the Keyword Filter Properties dialog, set the Search Scope to 'Email body' and mark the 'Body raw HTML source' checkbox enabled
5. Add a Comment text (e.g., "URL Blocker")
6. On the 'Filter Expression' tab, add the following expression:

.*&lta[^>]+href=['"\s]https?[^>]+email=[^>]+@[^>]+>

7. Set the expression type to Regular expression (Perl-compatible)
8. Click 'Ok'
9. Save your settings to apply the changes by pressing 'Ctrl + S'.

I hope the above proves helpful to you, but let me know if you need further assistance.