email->global filter->content filter help

[Turbanator]

I can't seem to get it right.

Using latest ISPC3.

Email->Global filters->Content filter-.Add New filter

Filter = Header filter
RegExp Pattern = /^From: *.info
Data = <blank>
Action = Reject
Save = Check

What I'm trying to do is block any email coming From an email address with .info .

I've tried different variations but it doesn't seem to work.

[till]

The regex pattern seem to be incomplete. A regex has to end with the same char then it begins. If your regex starts with / it has to end with / too, please try e.g.

/^From: *.info/

[Turbanator]

Till,
Tried that, didn't work.

This email still came through and it was well after I made the change so the system had time to update:

X-Greylist: delayed 623 seconds by postgrey-1.31 at dns.domain.com; Thu, 30 Sep 2010 09:08:17 PDT
Received: from aju112.onlyoffer.info (unknown [184.107.24.112])
	by dns.domain.com(Postfix) with ESMTP id DC7CB10B42C0
	for <user@domain.com>; Thu, 30 Sep 2010 09:08:17 -0700 (PDT)
From: "SwipeBids" <gianna@onlyoffer.info>
Date: Thu, 30 Sep 2010 11:30:06 -0400
Mime-Version: 1.0
Subject: WHAT?? iPhones for under 20?? It’s true!
Message-ID: <1624863331.7005481383406083446@aju112.onlyoffer.info>

[till]

A * in a regex is no wildcard, it means only repeat the character before the * a unlimited time. As the character before the * in your regex is a whitespace, your regex will match only things like From: .info and not .info email addresses. I guess what you wanted is something like that:

/From:.*\.info/

Wich means that the line starts with "From:" Then there may be any other characters as . is the placeholder for any character and .* means that any number of any character might be in that place and then the end is .info where the . has to be escaped with a backslash so that it is not interpreted as wildcard.

[Turbanator]

I tnk you did it! Thanx Till. Another 10% of spam will be gone.

[Johans]

Originally Posted by till

A * in a regex is no wildcard, it means only repeat the character before the * a unlimited time. As the character before the * in your regex is a whitespace, your regex will match only things like From: .info and not .info email addresses. I guess what you wanted is something like that:

/From:.*\.info/

Wich means that the line starts with "From:" Then there may be any other characters as . is the placeholder for any character and .* means that any number of any character might be in that place and then the end is .info where the . has to be escaped with a backslash so that it is not interpreted as wildcard.

Thank you for that information..
I have a question.. How do i block spam in content filter if i would like to reject a keyword "viagra"

I am using ISPConfig v. 3.0.2.1

Your immediate response is highly appreciated.

[sjau]

keyword "viagra" in the email text somewhere?

[Johans]

Originally Posted by sjau

keyword "viagra" in the email text somewhere?

Example if there is a subject or body message name "viagra" - key word how can i put this to spam folder directly or auto delete the emails received.

[sjau]

ISPC can't do header checks or body checky (yet). However you could set that up manually (or I have created a little form to amend domains to header_checks):

http://www.postfix.org/header_checks.5.html

/^Subject:.*=\?(big5|euc-kr|ks_c_5601-1987|koi8)\?/ REJECT Spam not tolerated here  - hc 1
/^Subject: offizielle sieger/ REJECT Spam not tolerated here  - hc 2
/^Content-Type:.*charset="?(GB2312|big5|euc-kr|ks_c_5601-1987|koi8|iso-2022-jp)/ REJECT Spam not tolerated here  - hc 3
/^Subject: Sie haben gewonnen/ REJECT Spam not tolerated here  - hc 4

/@usa\.com/             REJECT Spam not tolerated here  - hc 1000
/@mail\.disatel\.com/           REJECT Spam not tolerated here  - hc 1001
/@cantv\.net/           REJECT Spam not tolerated here  - hc 1002
/@infotrading\.it/              REJECT Spam not tolerated here  - hc 1003
/@rafamt\.org/          REJECT Spam not tolerated here  - hc 1004

I also added some info: hc 1000 --> header_checks entry 1000 --> that makes it easier to find out by which rule an email was rejected.