Rule to delete *@*.info or *@*.*.info domains

bescher · Post by **bescher** » 2012-08-27 17:47

I have created two separate rules I am trying to delete the above info domains
each has the from and contains rule and the action is to delete the email (I am getting 120 emails a day and more than half is from *@*.info
domains. and they are still coming through
What am I doing wromg?

Thanks

Bob

dzekas · Post by **dzekas** » 2012-08-27 17:50

bescher wrote:I have created two separate rules I am trying to delete the above info domains
each has the from and contains rule and the action is to delete the email (I am getting 120 emails a day and more than half is from *@*.info
domains. and they are still coming through
What am I doing wrong?

See http://www.catb.org/esr/faqs/smart-ques ... #beprecise

We are not gods and we can't see rules set up for your account.

bescher · Post by **bescher** » 2012-08-27 20:06

Which Language do you want me to use? I stated that half of my spam mail comes from *@*.info domains. I created a rule that if it contains
the above (*@*.info) (I also tried wildcard expression which didn't work either) and the action was to delete those emails. what am I doing wrong with the rule?

What other information would you like? I can post pictures of the rules if you wish (which I did in a different post)

And I am sorry that you are not a god

dzekas · Post by **dzekas** » 2012-08-27 20:15

bescher wrote:I created a rule that if it contains the above

Which part of email are you checking in your rules? Why question is posted on Scripts section? Rules are not related to scripts.

Could you tell values and options used in rule definition instead of "delete *@*.info or *@*.*.info domains" description? You are not telling your rule settings. You only describe your goals.

Spam is not sent from selected domains. It is sent by people, who can put any text in sender's field.

bescher · Post by **bescher** » 2012-08-27 21:13

I did I said contains, I also said. Obviousy it's a From field with a search type of either contains or wildcard,
The value is *@*.info, the action is to delete the email.
I am aware that anyone can send (or forge a email address) I may not be as smart as some of you guys when it comes to rules
and routes and scripting.

But I started out with Postoffice, then went to mail server pro , then mail serverpro with ewall and then Hmail with ewall and now just hmailserver. For the amount of users I have it doesn't pay to buy ewall (which is a good program) and has some good features in it (blacklist and whitelist in txt files, rather than having to add each domain, ip address etc separately

^DooM^ · Post by **^DooM^** » 2012-08-28 01:32

contains is a literal string search. Just do contains .info no *. Also make sure the from address is the one they are using in the SMTP envelope (I.E. Check your SMTP logs for the RCPT: FROM as that's what it's checked against).

bescher · Post by **bescher** » 2012-08-30 13:31

Thanks Doom
I spent yesterday entering 125 domain names in the rules as you suggested .info woke uo this mornig many of them were back. (use or,- contains .info or linklot.com put it into the value with search type of contains and then also into test value. I then added the action of delete email. Wron answer many of the same were back today.
I also added their ip's in the ip ranges (lower) (along with others giving them their domain names as name with a priority of 10, the IP address they were using and generally a 255.255.255.0 for upper range (which I am presuning is really the subnet for reading and seeing other posts here
No expiration date and unchecked smtp, pop, imap and unchecked all allow deliverires from. For a grand total of 85.
This is over 200 spam messages a day for one email box. I don't know what I am doing but it's not working
Any suggestions please

dzekas · Post by **dzekas** » 2012-08-30 14:41

bescher wrote:Any suggestions please

Could you show Received: headers of your spams? If you care about privacy, replace only own IP addresses and domain names with xxx text.

Which antispam options are you using in hMailServer?

bescher · Post by **bescher** » 2012-08-31 11:57

Hi Dzekas:
I am using all spam options including spamassassin. Mark threshold s 8, delete is 9. I am using graylisting, rules and routes (as mentioned)
It also seems that a lot of it is coming from a 170.0.0.0 range and a 184 range as below. I made the mistake of tellingoutlook to delete all messages that it thinks it's spam so I can't show more
I have ten dnsblacklists and five surbl list (the usual, spamhaus, ubl zones, spamcop barracudacentral, etc still roughly 180 spam a day
In Hmail server status 2256 messags, 192, virus detected and 411 spam messsages all for 55 email address in 12 hours
Occasionaly I am getting a message (always in the morning that says something like script error, can read or write but the only script I have is the VBS one on this system and it does have read write properties

Thanks
Bob

Headers
Return-Path: not9@degreesofaccounting.com
Delivered-To: bescher@rsegroup.com
Received: from kgo36.degreesofaccounting.com ([184.154.145.226])
by pop.rsegroup.com
; Thu, 30 Aug 2012 22:59:44 -0500
Message-ID: <YmVzY2hlckByc2Vncm91cC5jb20734@degreesofaccounting.com>
From: "PlatinumCreditCard" <not9@degreesofaccounting.com>
To: <bescher@rsegroup.com>
Subject: =?UTF-8?B?UGxhdGludW0gaXMgYmV0dGVyIHRoYW4gZ29sZA==?=
Date: Thu, 30 Aug 2012 21:58:01 -0600
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit

eturn-Path: old52@checkitnowtoday.com
Delivered-To: bescher@rsegroup.com
Received: from zi6.checkitnowtoday.com ([108.178.58.50])
by pop.rsegroup.com
; Fri, 31 Aug 2012 03:07:46 -0500
Message-ID: <YmVzY2hlckByc2Vncm91cC5jb20251@checkitnowtoday.com>
From: "BelizeVacation" <old52@checkitnowtoday.com>
To: <bescher@rsegroup.com>
Subject: =?UTF-8?B?TG9va2luZyBmb3IgYW4gZXhvdGljIHZhY2F0aW9uPyBHbyB0byBCZWxpemUu?=
Date: Fri, 31 Aug 2012 02:06:03 -0600
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit

dzekas · Post by **dzekas** » 2012-08-31 12:04

http://www.senderbase.org/senderbase_qu ... 54.145.226

http://www.senderbase.org/senderbase_qu ... .178.58.50

Could you doublecheck your blacklist configuration and ratings. Both addresses listed in CBL, PBL, NJABL and SORBS.

bescher · Post by **bescher** » 2012-08-31 12:24

All are enabled, ratings are at 2 or 3 and not that it matters but that ip address doesn't use that frazelgolf domain name. Today was the first day (http://www.senderbase.org/senderbase_qu ... .178.58.50)

dzekas · Post by **dzekas** » 2012-08-31 12:43

Sorry. My mistake. Confused senderbase RBL display. They are not listed in RBLs, but senderbase reputation for their network shows that entire subnet is f...ed up.

Your sample emails don't match .info rules.

Is it possible to see how spamassassin evaluates those emails?

bescher · Post by **bescher** » 2012-08-31 13:10

OH I have plenty of rules, roughly 60 of them
They are all
like the below Or similiar
Criteria is use and
contains
from (in this case)
value
@weatherwory.com (the name of the rule doesn't necessarily have a . or a @ in it but the rule itselg does (see image)

[/img]
(Test value is ok
and action is to delete it

Rule to delete @.info or @.*.info domains

Rule to delete @.info or @.*.info domains

Re: Rule to delete @.info or @.*.info domains

Re: Rule to delete @.info or @.*.info domains

Re: Rule to delete @.info or @.*.info domains

Re: Rule to delete @.info or @.*.info domains

Re: Rule to delete @.info or @.*.info domains

Re: Rule to delete @.info or @.*.info domains

Re: Rule to delete @.info or @.*.info domains

Re: Rule to delete @.info or @.*.info domains

Re: Rule to delete @.info or @.*.info domains

Re: Rule to delete @.info or @.*.info domains

Re: Rule to delete @.info or @.*.info domains

Re: Rule to delete @.info or @.*.info domains