lots of spam .. invoice, Transactions details etc

Discussion in 'General' started by florix.net, Sep 23, 2016.

  1. florix.net

    florix.net Member

    All domains on our server are getting lots of spam with zip attachments

    with subject line invoice, Transactions details, Fwd: DHL Shipment Documents : 9079991203

    how can we disable it ? Can we add new rules in spamassasin?
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Using a postfix header or body filter in ispconfig might be easier than writing a SpamAssassin rule.
     
  3. florix.net

    florix.net Member

    Dear Till,

    thank you for your quick response.

    Can you tell me where exactly? also will it be applicable for all domains we are hosting on server?
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    In ISPConfig: Mail > Global > Content filter
    You can find examples for these filters in the ISPConfig manual, or you take a look at the postfix documentation for header and body filters in postfix (thats the kind of filters that ispconfig applies here).

    yes.
     
  5. budgierless

    budgierless Member HowtoForge Supporter

    What setting would you suggest to use for what has been said, as I have the same problem too.
     
  6. Jesse Norell

    Jesse Norell Active Member

    Postfix header/body checks are not a 'setting' per se, you would need to create rules to match the messages you're receiving. If you're not familiar with regular expressions you may have a bit of a learning curve, but there are examples available in google. You'd probably need to see the actual message, but assuming what @florix.net meant was it has:
    Code:
    Subject: invoice, Transactions details, Fwd: DHL Shipment Documents : 9079991203
    then a regex similar to this should match:
    Code:
    /^Subject: .*invoice, Transactions details, Fwd: DHL Shipment Documents : [[:digit:]+]/
    On the problem generally (blocking these emails), make sure you're making use of the sanesecurity signatures, as they catch a lot of those. http://sanesecurity.com/usage/signatures/
     
    florix.net and till like this.
  7. florix.net

    florix.net Member


    Thank you. I am good at REGEX, just want to know where to add and monitor such regex to control spam
     
  8. sjau

    sjau Local Meanie Moderator

Share This Page