How Do I Block All Mail Containing a Specific String

Use this forum if you have installed hMailServer and want to ask a question related to a production release of hMailServer. Before posting, please read the troubleshooting guide. A large part of all reported issues are already described in detail here.
Post Reply
User avatar
CopBlaster
New user
New user
Posts: 23
Joined: 2019-06-28 11:17
Location: Portland, Oregon
Contact:

How Do I Block All Mail Containing a Specific String

Post by CopBlaster » 2019-09-27 23:57

I keep getting a lot of spam containing old passwords and threats to disseminate them if I do not pay the ransom. Is there any way to keep hMailServer from accepting any messages with those passwords?

I am new to hMailServer and have never written rules for it before. I would like something that says if email contains specific string then block.

User avatar
mattg
Moderator
Moderator
Posts: 20232
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: How Do I Block All Mail Containing a Specific String

Post by mattg » 2019-09-28 03:59

rules don't block senders

Rules CAN delete messages

Global rule

If BODY contains Specifc_String
THEN
Delete message
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

Kendo
Normal user
Normal user
Posts: 86
Joined: 2015-07-08 23:33
Location: Rural Australia

Re: How Do I Block All Mail Containing a Specific String

Post by Kendo » 2019-09-30 03:22

I am currently working on a new filter to detect keywords and delete if found. It is based on the bad word filter mentioned earlier but instead of replacing the word, I intend to delete it.

The words are contained in a text file and will have a score and when total threshold reaches the set limit, then the email is deleted.

I'll keep you posted.

Kendo
Normal user
Normal user
Posts: 86
Joined: 2015-07-08 23:33
Location: Rural Australia

Re: How Do I Block All Mail Containing a Specific String

Post by Kendo » 2019-10-05 04:24

Kendo wrote:
2019-09-30 03:22
I am currently working on a new filter to detect keywords and delete if found.
We have completed this but need to debug. Is it cool to add a report to the logfile, such as wordscore?

If so, then what format/procedure should be observed?

palinka
Senior user
Senior user
Posts: 1215
Joined: 2017-09-12 17:57

Re: How Do I Block All Mail Containing a Specific String

Post by palinka » 2019-10-05 04:50

Use the event log.

Code: Select all

EventLog.Write( "whatever you want to record." )

Kendo
Normal user
Normal user
Posts: 86
Joined: 2015-07-08 23:33
Location: Rural Australia

Re: How Do I Block All Mail Containing a Specific String

Post by Kendo » 2019-10-10 10:33

Ok, my blocklist filter is finished and it works.

How it works

block-list.txt contains a list of word and phrases that you want to block (create your own). In the script you can set a threshold of say 50 which when reached will delete the email so that it is not delivered.

In block-list.txt you need to enter each word/phrase per line with a score, for example:

dick, 20
meet women, 30
pharma, 30
sex, 30

You can set words at 50 or lower so that a second instance or another word can trigger the threshold, it's up to you.

Code: Select all

Sub OnDeliverMessage(oMessage)
	
	'Commence block-list filter

	Dim strWords
	Dim i
	Dim strBadWord
	Dim blnReject
	Dim dicWordCount
	Dim dicWordScore
	Dim intBadWordCount : intBadWordCount = 0
	Dim intBadScore
	Dim strLine

	Const THRESHOLD = 50
	Dim Location : Location = "C:\Program Files (x86)\hMailServer\block-list.txt"
	 
	Dim strBody : strBody = LCase(oMessage.Body)
	Dim strHTMLBody : strHTMLBody = LCase(oMessage.HTMLBody)
	Dim strSubject : strSubject = LCase(oMessage.Subject)

	Set dicWordCount = CreateObject("Scripting.Dictionary")
	Set dicWordScore = CreateObject("Scripting.Dictionary")

	Set objFSO = CreateObject("Scripting.FileSystemObject")
	Set objTextFile = objFSO.OpenTextFile(Location, 1)

	Do While objTextFile.AtEndOfStream <> True
	strLine = objTextFile.Readline

	If Len(strLine) >=2 And InStr(strLine,",") >=1 Then
	arrWords = Split(strLine, ",")
	strBadWord = Trim(arrWords(0))
	intBadScore =  Int(Trim(arrWords(1)))

	If InStr(strSubject,strBadWord) >=1 Then
	intBadWords = Int(UBound(Split(strSubject,strBadWord))) * intBadScore

	If dicWordCount.Exists(strBadWord) = False Then
	   dicWordCount.Add strBadWord,intBadWords
	End If
	End If

	If InStr(strBody,strBadWord) >=1 Then
	intBadWords = Int(UBound(Split(strBody,strBadWord))) * intBadScore

	If dicWordCount.Exists(strBadWord) = False Then
	   dicWordCount.Add strBadWord,intBadWords
	Else
	   dicWordCount.Item(strBadWord) = Int(dicWordCount.Item(strBadWord)) + intBadWords
	End If
	End If
	End If
	Loop

	objTextFile.Close()

	arrBadWordCount = dicWordCount.Items
		   
	For i = 0 To UBound(arrBadWordCount)
	intBadWordCount = Int(arrBadWordCount(i)) + intBadWordCount
	Next

	If intBadWordCount >= THRESHOLD Then
	oMessage.HeaderValue("X-hMailServer-Mime-Ban") = "YES"
	Result.Value = 1
	EventLog.Write( "not delivered" )
	Else
	Result.Value = 0
	EventLog.Write( "delivered" )
	End If
	  
End Sub

When satisfied that it works for you, comment out the lines "EventLog.Write..." to stop logging to hmailserver_events.log

Kendo
Normal user
Normal user
Posts: 86
Joined: 2015-07-08 23:33
Location: Rural Australia

Re: How Do I Block All Mail Containing a Specific String

Post by Kendo » 2019-10-19 08:06

Further to my block-list filter I found that was still getting some spam emails even though they should have been blocked.

So we added more informative logging and then discovered that the emails that were getting through were excused because the message body was encoded.

I was thinking of decoding and then checking for bad words, but a suggestion has been made... if encoding is found should we simply delete the email?

So my question is, if Content-Transfer-Encoding: base64 is found can we safely assume that it is spam, otherwise why would anyone use base64 encoding in email?

User avatar
jimimaseye
Moderator
Moderator
Posts: 8157
Joined: 2011-09-08 17:48

Re: How Do I Block All Mail Containing a Specific String

Post by jimimaseye » 2019-10-19 10:50

I think all mail composed by Outlook (online or maul client) is encoded (legit or otherwise).

[Entered by mobile. Excuse my spelling.]
HMS 5.6.6 B2383 on Win Server 2008 R2 Foundation, + 5.6.7-B2415 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

Post Reply