hMailServer forum

Kendo

Further to my block-list filter I found that was still getting some spam emails even though they should have been blocked. So we added more informative logging and then discovered that the emails that were getting through were excused because the message body was encoded. I was thinking of decoding ...

Kendo

Ok, my blocklist filter is finished and it works. How it works block-list.txt contains a list of word and phrases that you want to block (create your own). In the script you can set a threshold of say 50 which when reached will delete the email so that it is not delivered. In block-list.txt you need...

Kendo

Kendo wrote: ↑
2019-09-30 03:22
I am currently working on a new filter to detect keywords and delete if found.

We have completed this but need to debug. Is it cool to add a report to the logfile, such as wordscore?

If so, then what format/procedure should be observed?

Kendo

I am currently working on a new filter to detect keywords and delete if found. It is based on the bad word filter mentioned earlier but instead of replacing the word, I intend to delete it. The words are contained in a text file and will have a score and when total threshold reaches the set limit, t...

Kendo

If oMessage.Recipients(i).Address = strRecipient1 or oMessage.Recipients(i).Address = strRecipient2 Then For some reason this does not work. It works for 1 but not for 2. I even add "Shift" which does appear in subject and message, but Japanese still gets through. Const strRegEx = "(\?)(gb(k|2312|1...

Kendo

Most interesting... a similar script does exist. Internal search was useless, but Google returned this post...

https://www.hmailserver.com/forum/viewt ... 20&t=29272

But this needs work for what I want to do.

Kendo

I looked but didn't find an existing rule for this... Filter email by words listed in static file. I used to use a spam filter which could list words and a score. If their total count was above a threshold then delete/etc. I found this most useful as it could be easily updated. As a text file one co...

Kendo

mattg wrote: ↑
2019-09-12 11:04
IT people are always looking for more work

Something like this should do...

If oMessage.Recipients(i).Address = strRecipient1 or oMessage.Recipients(i).Address = strRecipient2 Then

Kendo

mattg wrote: ↑
2019-09-12 03:29
Not with the existing code, you would need to modify slightly to achieve that

What do you recommend?

Kendo

In line 2 below, can I add multiple email addresses separated by comma?...

Sub OnDeliverMessage(oMessage)

Const strRecipient = "nospam@exanple.com" ' <-- Change to reflect actual user!
Const strRegEx = "(\?)(gb(k|2312|18030)|big5|euc-(cn|tw)|Shi...

Kendo

Outlook is not pre-installed on any Windows product I have ever had. Maybe you are confusing Windows Mail App pre-installed on Windows 10 as being Outlook. It does resemble Outlook but it is not Outlook and a bit restricted in features compared to Outlook. Solly, when we had our computer shop XP wa...

Kendo

jimimaseye wrote: ↑
2019-06-24 14:16
Does pale moon allow and use old style firefox add-ons?

Not sure because I don't use them except for one that stops autoplay of video. But they do provide an extensive array of add-ons that are compatible.

Kendo

Since Firefox started adopting useless features found in advertising gimmick browsers (no name mentioned) I started losing interest. Dropping support for NPAPI, Flash and Java, plus persistent nagging about updating to their latest version of nonsense was too much in the end.

I now use Pale Moon.

Kendo

Everyone's favorite is MS Outlook. Only because they find it already installed with Windows and don't bother looking for an alternative. I don't know if they have changed it much or not, but one big no-no was the way they hide the sender's email address. If anything, that should be most obvious, es...

Kendo

Anyone upgraded their Thunderbird to v60 yet? Yes. Some plugins had to be upgraded, but the ones that I depend upon, mainly "Clippings", are ok. Which mail client? Thunderbird of course... ideal for managing multiple accounts. I have used it since it began and would not recommend any of the other n...

Kendo

WordPress seems to be a popular target. I have a Windows server with no PHP or WordPress sites but most of the hits to it are looking for WordPress plugins to try and exploit. It seems that someone has distributed software that many wanna-bees use trying to exploit web sites... I see similar request...

Kendo

And spammers sending mail via command prompt will be seen as Server or My Computer?

Kendo

I understand the "local" and "external" email address difference and assume that the "Internet" range is for mail sent via SMTP to my server from outside the server, but what is the significance/difference between "Server, My Computer and Internet"?

Kendo

In the settings for IP Ranges there are 3 options: - Server - My computer - Internet I assume that "Internet" means email sent via the internet using normal channel for SMTP, but what do the other 2 options mean specifically? For example a spammer sending direct via my server... will appears as a lo...

Kendo

jimimaseye wrote: ↑
2019-03-29 09:48
Your SPF record allows your own mail server to send emails.

Of course it does. It is also listed as an allowed IP address. How else can websites hosted on it send mail outward?

Kendo

jimimaseye wrote: ↑
2019-03-29 02:13
What is your spf record?

v=spf1 a mx ptr a:cp12.example.com ip4:64.71.130.99 ip4:64.71.130.100 ip4:64.71.130.101 ip4:64.71.130.102 ip4:64.71.130.103 ip4:74.200.85.166 ip4:64.202.189.1/16 ip4:116.250.207.34 ip4:116.250.255.1/16 ip4:116.250.254.1/16 include:apn.net.au -all

Kendo

Without any SMTP Authentication settings, why doesn't SPF prevent non-authorised IP addresses as senders using local email addresses?

Kendo

What exactly is the role of hMailServer in your organisation? 1. To send mail from webforms on the same server. 2. To send mail from cms on the same server... from authors to subscribers. 3. To receive mail sent to the listed domains/accounts. 4. Received mail then gets resent to a separate server ...

Kendo

SorenR wrote: ↑
2019-03-29 00:17
How do your customers send mail normally? Webmail only?

New clients use a webform on one of the websites. Some sites are on the same server and some on another (apache) server.

Established contacts email directly from their mail client.

Kendo

Without any SMTP Authentication settings, why doesn't SPF prevent non-authorised IP adresses as senders?

Kendo

mattg wrote: ↑
2019-03-27 03:30
By default hMailserver allows users to AUTH with one account and send FROM another

Where are these set?

Kendo

Ah, on Internet only?

Kendo

I deleted the script mentioned at viewtopic.php?p=68117#p68117 but now have spam sent from myaddess.example.com to myaddress@example.com again, even though I have SPF enabled. I ran the diagnostic test and all it says is what my settings are... 2019-03-28 Hmailserver: 5.6.5-B2367 DOMAINS "Domain1.co...

Kendo

SorenR wrote: ↑
2019-03-28 01:05
You are aware that you need to "reload" the script whenever you make changes.

Yep. No problem.

Kendo

SorenR wrote: ↑

2019-03-27 02:06

Code: Select all

   Const strRegEx      = "(gb(k|2312|18030)|big5|euc-(cn|tw)|iso-2022-(cn|jp))"   ' <-- Here you can add search params!

Without the "?"

Kendo

Nice catch. Yes I did add the 2nd script and that must be the cause. Have lost a lot of business since then. But I don't understand... I thought that I was stopping mail being sent from the same address, like spammers do using From: you@domain.com To: you@domain.com Anyways, I deleted the rule for n...

Kendo

Not that I am aware of. It has been happening since before we added that new rule.

Kendo

Recently my mail server stopped allowing mail to be sent from my webforms on the same server. The logs show... "You are only allowed to send from your own account" All settings look ok. http://addmine.com/temp/hMailServer_settings.jpg Server, Computer and Internet are set the same. I rebooted hMailS...

Kendo

Yes and tested. Didn't have any since except for these 3 emails just recently.

Kendo

SorenR wrote: ↑
2019-03-26 12:15
If you look at the raw email, does it have the "X-hMailServer-Mime-Ban: YES" header ?

No. It was not detected/tagged.

Now have 3 emails that include... "Subject: =?gb2312?B?..."

Kendo

This one got through...

Subject: =?gb2312?B?svrGt76twO3I57rOtqjOu6O/yOe6zrLfu67T0L661fnBprXEsu7S7A==?= =?gb2312?B?u6+y+sa3y9XW3bXIs8fK0Mno09Cw7MrCtKYyMDE5LzMv?=
=?gb2312?B?MjYg0MfG2rb+yc/O5yA1OjE5OjE0?=

Re: 产品经理如何定位？如何策划有竞争力的差异化产品苏州等城市设有办事处2019/3/26 星期二上午 5:19:14

Kendo

SorenR wrote: ↑
2019-03-24 13:46
The new mail header "X-hMailServer-Mime-Ban"...

That worked, thanks. Nice work!

Kendo

One got through but there might be something different because the encoding starts with "?gb" instead of "?utf". I have seen a few like this before, for example... Subject: =?gb2312?B?vt7I6cLcwPKz+MTvw8DJ2cWuw/6xrMjpyODAy9Go5fzDxMnr0ve3og==?= =?gb2312?B?tLrS+dPvusPP67LZy/0=?= Which came from... 巨乳萝莉...

Kendo

palinka wrote: ↑
2019-03-24 01:16
Did you try using the simple rule with Soren's regex? Directly above your last post.

Yes. That seems to work ok. Thanks everyone!

Kendo

jimimaseye wrote: ↑
2019-03-23 22:38

If oMessage.Subject = "=?utf-8?B?5LyB5Lia566h55CG6LWE5paZ?=" Then

How does this detect anything that is not specifically "=?utf-8?B?5LyB5Lia566h55CG6LWE5paZ?="?

Or does the regex need to be included? If so, please provide an example of the completed script.

Kendo

I believe it is because he is still focusing on wanting to delete mail recognised as Chinese Japanese etc (which spamassassin does) and not understanding that the appearance and dealing with "utf8" (which your script deals with) has nothing to do with it. It seems he thinks spamassassin handles utf...

Kendo

SorenR wrote: ↑
2019-03-23 02:06
I believe you got your answer in the second post...

In hindsight that is easy to say, but now we know why. Perhaps hMailserver can be upgraded to cater for such a simple rule. Then we could do without SA which I have never liked.

Kendo

We already got all of that, except for those clouding the issue by posting irrelevant suggestions.

Kendo

TB = Thunderbird?

That is of no use because it is the mail server applying the rule and not your local mail client.

Kendo

katip wrote: ↑
2019-03-22 15:15
probably this:

TB -> Options, Display, Formatting, Advanced

Where are these options found?

Kendo

I also copied some of the subjects that you posted above to test, and they all get caught by my rule Do you have a global rule or an account level rule? I don't know how else I can test what you are experiencing To test properly you may need to use the same characters in the Subject line, for examp...

Kendo

Does hMailserver require a restart after applying a rule?

Kendo

I was wondering ... The "?" ... How does your OS display UTF-8 characters not implemented in your current codepage? What may be more relevant is how does Windows Server 2008 display the characters because that is where the filtering is actioned. looking for "?" is just nuts and when matching will a...

Kendo

Contains both list unsubscribe and a question mark. This is not spam , it is a authorised/requested facebook notification email. And I have MANY MANY more. And all of them would fall foul of both of the 2 methods you both mentioned. I shall repeat again... any mail sent to my nospam@example.com tha...

Kendo

Should I be looking for an encoded version of "?" and if so, what should I try?

Kendo

I've been running my own mailserver for close to 20 years and my current domain is 16 years old. I first started working with The Internet around 1986 so I have first hand experience with a SPAM free Internet. Same here. My domain is more than 20 years old . Always had my own mail server and for 15...

Kendo

Really ?? Why are you redacting senders email, if they are sending SPAM? You don't expect us to believe they use domains like aaa, bbb, xxx, yyy and zzz? We are not stupid you know. Really? Sometimes spammers send using legitimate email addresses that are innocent! How would you like having your em...

Kendo

Can you paste the raw headers of a few messages? From: =?utf-8?B?5ZGo5pyJ5piO?= <gqvvwen@xxx.net> Subject: =?utf-8?B?NDQzOTfjgIrmipbpn7PokKXplIDjgItndg==?= From: =?utf-8?B?6am+6b6a5oq156e96Zif572a6K6w55qL?= <aiyis@yyy.mobi> Subject: =?utf-8?B?MTA5OTk3MumUgOWUrueyvuiLsTLlpKnlvLrljJborq3nu4N5cWM=?= =...

Kendo

SorenR wrote: ↑
2019-03-21 18:14
Combine Script and Rules.

The string "=?utf-8?B?5LyB5Lia566h55CG6LWE5paZ?=" is Base64 encoded using UTF-8 charset.

The Subject is different every time, but always contains "?utf"

Kendo

mattg wrote: ↑
2019-03-21 02:19
Have you confirmed in your logs that the address and subject do actually have the required text in them?

I have SMTP logging enabled, but nothing shows for Subject.

Kendo

Then simply delete it all Can't do that because nospam@ needs to accept some critical mail. Cannot change nospam@ because to English speaking clients (95%) they get the message, ie: no spam to that address! In SpamAssassin you can test for language and character sets I don't use SpamAssassin becaus...

Kendo

If the header is in Japanese, for example, the contents of the mail will not be searchable. "?" in raw view likely no more exists after decoding attempt. Sure, but that would mean not searchable in "Japanese". For example the header data might look like... Subject: =?utf-8?B?5LyB5Lia566h55CG6LWE5pa...

Kendo

I need to prevent spammers from sending Chinese spam to my "nospam@example.com" email address. No-one else sends to "nospam" so may be they cannot read English. All of these emails include Chinese in the Subject and sometimes in the From line, so I created 2 rules: 1. If Subject contains "?" or "?ut...

Kendo

I need a plugin that enables me to list/add keywords to detect and flag spam.

It should blacklist keywords, ip address and domain senders.

Kendo

Moved from Bribie earlier this year. Living in a shed with 20 times faster Internet while the house is built. The 4x4 is 20 years old and still runs up a 40 degree incline with a ton of gravel on it. Best car I ever had.

Search found 86 matches