email->global filter->content filter help

Discussion in 'Tips/Tricks/Mods' started by Turbanator, Sep 30, 2010.

  1. Turbanator

    Turbanator Member HowtoForge Supporter

    I can't seem to get it right.

    Using latest ISPC3.

    Email->Global filters->Content filter-.Add New filter

    Filter = Header filter
    RegExp Pattern = /^From: *.info
    Data = <blank>
    Action = Reject
    Save = Check

    What I'm trying to do is block any email coming From an email address with .info .

    I've tried different variations but it doesn't seem to work.
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    The regex pattern seem to be incomplete. A regex has to end with the same char then it begins. If your regex starts with / it has to end with / too, please try e.g.

    /^From: *.info/
     
  3. Turbanator

    Turbanator Member HowtoForge Supporter

    Till,
    Tried that, didn't work.

    This email still came through and it was well after I made the change so the system had time to update:

    Code:
    X-Greylist: delayed 623 seconds by postgrey-1.31 at dns.domain.com; Thu, 30 Sep 2010 09:08:17 PDT
    Received: from aju112.onlyoffer.info (unknown [184.107.24.112])
    	by dns.domain.com(Postfix) with ESMTP id DC7CB10B42C0
    	for <[email protected]>; Thu, 30 Sep 2010 09:08:17 -0700 (PDT)
    From: "SwipeBids" <[email protected]>
    Date: Thu, 30 Sep 2010 11:30:06 -0400
    Mime-Version: 1.0
    Subject: WHAT?? iPhones for under 20?? It’s true!
    Message-ID: <[email protected]>
    
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    A * in a regex is no wildcard, it means only repeat the character before the * a unlimited time. As the character before the * in your regex is a whitespace, your regex will match only things like From: .info and not .info email addresses. I guess what you wanted is something like that:

    /From:.*\.info/

    Wich means that the line starts with "From:" Then there may be any other characters as . is the placeholder for any character and .* means that any number of any character might be in that place and then the end is .info where the . has to be escaped with a backslash so that it is not interpreted as wildcard.
     
  5. Turbanator

    Turbanator Member HowtoForge Supporter

    I tnk you did it! Thanx Till. Another 10% of spam will be gone.
     
  6. Johans

    Johans New Member

    Thank you for that information..
    I have a question.. How do i block spam in content filter if i would like to reject a keyword "viagra"

    I am using ISPConfig v. 3.0.2.1

    Your immediate response is highly appreciated.
     
  7. sjau

    sjau Local Meanie Moderator

    keyword "viagra" in the email text somewhere?
     
  8. Johans

    Johans New Member

    Example if there is a subject or body message name "viagra" - key word how can i put this to spam folder directly or auto delete the emails received.
     
  9. sjau

    sjau Local Meanie Moderator

    ISPC can't do header checks or body checky (yet). However you could set that up manually (or I have created a little form to amend domains to header_checks):

    http://www.postfix.org/header_checks.5.html

    Code:
    /^Subject:.*=\?(big5|euc-kr|ks_c_5601-1987|koi8)\?/ REJECT Spam not tolerated here  - hc 1
    /^Subject: offizielle sieger/ REJECT Spam not tolerated here  - hc 2
    /^Content-Type:.*charset="?(GB2312|big5|euc-kr|ks_c_5601-1987|koi8|iso-2022-jp)/ REJECT Spam not tolerated here  - hc 3
    /^Subject: Sie haben gewonnen/ REJECT Spam not tolerated here  - hc 4
    
    /@usa\.com/             REJECT Spam not tolerated here  - hc 1000
    /@mail\.disatel\.com/           REJECT Spam not tolerated here  - hc 1001
    /@cantv\.net/           REJECT Spam not tolerated here  - hc 1002
    /@infotrading\.it/              REJECT Spam not tolerated here  - hc 1003
    /@rafamt\.org/          REJECT Spam not tolerated here  - hc 1004
    
    I also added some info: hc 1000 --> header_checks entry 1000 --> that makes it easier to find out by which rule an email was rejected.
     

Share This Page