[BlueOnyx:21270] Re: **SPAM(5.0)** Re: block spam from .faith domains

[Meaulnes Legler @ MailList]

On 16.08.17 13:18, Michael Stauber wrote:
> Subject: [BlueOnyx:21258] Re: block spam from .faith domains
> From: Michael Stauber <mstauber at blueonyx.it>
> Date: 16.08.17 13:18
> To: blueonyx at mail.blueonyx.it
> 
> Hi Meaulnes,
>> what other indicators?
> Depends. Something that's in the message body or header of all these emails. One could use the GUI to create a custom SpamAssassin rule that triggers on that.

yes I could, but SpamAssassin only _tags_ the spam but doesn't _block_ it.

>> I extracted all «From» addresses and inserted the domains in the «Block Email From Hosts/Domains»-box:
>> artcdr.faith
>> babelism.faith
>> bardelye.faith
> <snip>
> You could use this wildcard then:
> *@*.faith
> That would cover them all and anything from a *.faith toplevel-domain.

This works with SpamAssassin, but not in Server Management > Network Services > E-Mail > Advanced: the «Block Email From Hosts/Domains»-box doesn't accept asterisks.

I just entered «faith» without the leading dot (.faith wasn't accepted either), let's see if it works, didn't get any mails from *.faith domains until now...

> -- With best regards Michael Stauber

Thank you and best regards

Meaulnes Legler
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
~ http://www.WaveWeb.ch ~
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
~  Zurich, Switzerland  ~
~  +41\0 44 260 16 60   ~
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~


PS: it's strange, your mail got tagged!

On 16.08.17 13:18, Michael Stauber wrote:
> Spam detection software, running on the system "bleue.waveweb.ch",
> has identified this incoming email as possible spam.  The original
> message has been attached to this so you can view it or label
> similar future email.  If you have any questions, see
> the administrator of that system for details.
>
> Content preview:  Hi Meaulnes, > what other indicators? Depends. Something that's
>    in the message body or header of all these emails. One could use the GUI
>   to create a custom SpamAssassin rule that triggers on that. > I extracted
>   all «From» addresses and inserted the domains in the «Block > Email From
>    Hosts/Domains»-box: > > artcdr.faith > babelism.faith > bardelye.faith <snip>
>    [...] 
>
> Content analysis details:   (5.0 points, 5.0 required)
>
>  pts rule name              description
> ---- ---------------------- --------------------------------------------------
> -0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at http://www.dnswl.org/, no
>                             trust
>                             [38.114.102.7 listed in list.dnswl.org]
>  2.5 RATS_DYNA              RBL: No description available.
>                             [181.140.22.142 listed in dyna.spamrats.com]
> -0.0 RP_MATCHES_RCVD        Envelope sender domain matches handover relay domain
>  4.0 DCC_CHECK              Detected as bulk mail by DCC (dcc-servers.net)
> -1.5 AWL                    AWL: Adjusted score from AWL reputation of From: address
>
>