Page 1 of 1

How Do I Block All Mail Containing a Specific String

Posted: 2019-09-27 23:57
by CopBlaster
I keep getting a lot of spam containing old passwords and threats to disseminate them if I do not pay the ransom. Is there any way to keep hMailServer from accepting any messages with those passwords?

I am new to hMailServer and have never written rules for it before. I would like something that says if email contains specific string then block.

Re: How Do I Block All Mail Containing a Specific String

Posted: 2019-09-28 03:59
by mattg
rules don't block senders

Rules CAN delete messages

Global rule

If BODY contains Specifc_String
THEN
Delete message

Re: How Do I Block All Mail Containing a Specific String

Posted: 2019-09-30 03:22
by Kendo
I am currently working on a new filter to detect keywords and delete if found. It is based on the bad word filter mentioned earlier but instead of replacing the word, I intend to delete it.

The words are contained in a text file and will have a score and when total threshold reaches the set limit, then the email is deleted.

I'll keep you posted.

Re: How Do I Block All Mail Containing a Specific String

Posted: 2019-10-05 04:24
by Kendo
Kendo wrote:
2019-09-30 03:22
I am currently working on a new filter to detect keywords and delete if found.
We have completed this but need to debug. Is it cool to add a report to the logfile, such as wordscore?

If so, then what format/procedure should be observed?

Re: How Do I Block All Mail Containing a Specific String

Posted: 2019-10-05 04:50
by palinka
Use the event log.

Code: Select all

EventLog.Write( "whatever you want to record." )

Re: How Do I Block All Mail Containing a Specific String

Posted: 2019-10-10 10:33
by Kendo
Ok, my blocklist filter is finished and it works.

How it works

block-list.txt contains a list of word and phrases that you want to block (create your own). In the script you can set a threshold of say 50 which when reached will delete the email so that it is not delivered.

In block-list.txt you need to enter each word/phrase per line with a score, for example:

dick, 20
meet women, 30
pharma, 30
sex, 30

You can set words at 50 or lower so that a second instance or another word can trigger the threshold, it's up to you.

Code: Select all

Sub OnDeliverMessage(oMessage)
	
	'Commence block-list filter

	Dim strWords
	Dim i
	Dim strBadWord
	Dim blnReject
	Dim dicWordCount
	Dim dicWordScore
	Dim intBadWordCount : intBadWordCount = 0
	Dim intBadScore
	Dim strLine

	Const THRESHOLD = 50
	Dim Location : Location = "C:\Program Files (x86)\hMailServer\block-list.txt"
	 
	Dim strBody : strBody = LCase(oMessage.Body)
	Dim strHTMLBody : strHTMLBody = LCase(oMessage.HTMLBody)
	Dim strSubject : strSubject = LCase(oMessage.Subject)

	Set dicWordCount = CreateObject("Scripting.Dictionary")
	Set dicWordScore = CreateObject("Scripting.Dictionary")

	Set objFSO = CreateObject("Scripting.FileSystemObject")
	Set objTextFile = objFSO.OpenTextFile(Location, 1)

	Do While objTextFile.AtEndOfStream <> True
	strLine = objTextFile.Readline

	If Len(strLine) >=2 And InStr(strLine,",") >=1 Then
	arrWords = Split(strLine, ",")
	strBadWord = Trim(arrWords(0))
	intBadScore =  Int(Trim(arrWords(1)))

	If InStr(strSubject,strBadWord) >=1 Then
	intBadWords = Int(UBound(Split(strSubject,strBadWord))) * intBadScore

	If dicWordCount.Exists(strBadWord) = False Then
	   dicWordCount.Add strBadWord,intBadWords
	End If
	End If

	If InStr(strBody,strBadWord) >=1 Then
	intBadWords = Int(UBound(Split(strBody,strBadWord))) * intBadScore

	If dicWordCount.Exists(strBadWord) = False Then
	   dicWordCount.Add strBadWord,intBadWords
	Else
	   dicWordCount.Item(strBadWord) = Int(dicWordCount.Item(strBadWord)) + intBadWords
	End If
	End If
	End If
	Loop

	objTextFile.Close()

	arrBadWordCount = dicWordCount.Items
		   
	For i = 0 To UBound(arrBadWordCount)
	intBadWordCount = Int(arrBadWordCount(i)) + intBadWordCount
	Next

	If intBadWordCount >= THRESHOLD Then
	oMessage.HeaderValue("X-hMailServer-Mime-Ban") = "YES"
	Result.Value = 1
	EventLog.Write( "not delivered" )
	Else
	Result.Value = 0
	EventLog.Write( "delivered" )
	End If
	  
End Sub

When satisfied that it works for you, comment out the lines "EventLog.Write..." to stop logging to hmailserver_events.log

Re: How Do I Block All Mail Containing a Specific String

Posted: 2019-10-19 08:06
by Kendo
Further to my block-list filter I found that was still getting some spam emails even though they should have been blocked.

So we added more informative logging and then discovered that the emails that were getting through were excused because the message body was encoded.

I was thinking of decoding and then checking for bad words, but a suggestion has been made... if encoding is found should we simply delete the email?

So my question is, if Content-Transfer-Encoding: base64 is found can we safely assume that it is spam, otherwise why would anyone use base64 encoding in email?

Re: How Do I Block All Mail Containing a Specific String

Posted: 2019-10-19 10:50
by jimimaseye
I think all mail composed by Outlook (online or maul client) is encoded (legit or otherwise).

[Entered by mobile. Excuse my spelling.]