Any Tutorials/Variable reference available?

Junior Member
Posts: 63
Joined: Sun May 11, 2008 10:43 pm

Any Tutorials/Variable reference available?

Postby spectrumdata » Mon Jan 04, 2010 3:20 pm

I'm trying to separate From: and Return-Path: in a filter. Trying to get rid of this:

From: VIAGRA (c) Best Supplier <oeybuc4428@btcentralplus.com>
To: kay@spectrumdata.com
Subject: [SPAM]Visitor kay's personal 80% OFF
MIME-Version: 1.0
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Return-Path: <oeybuc4428@btcentralplus.com>

I'm looking for a way to isolate the VIAGRA from the "From". The regular filter doesn't seem to do it. I seem to remember seeing a reference long ago of the {} variables we can use. I can't seem to find it. I'd also like to see a script tutorial. I'm sure scripts will be much more flexible.

Thanks
John

Developer
User avatar
Posts: 4431
Joined: Tue Apr 20, 2004 3:43 pm

Postby Alexander Telegin » Wed Jan 06, 2010 8:18 am

There is EMAIL function, that refines the email address from provided value. For example,

{EMAIL(From)} will return email address from "From" field.

Expert
Posts: 265
Joined: Tue May 04, 2004 1:07 pm

Postby dave » Mon Jan 11, 2010 3:08 pm

Hey, Alex is the expert, but I've seen lots of this same spam too.

Why not a subject filter for "personal 80% OFF"?

Assuming a good (DB) whitelist, it would seem to me that this would nail all of your spam, or to put it another way, how much legititmate email do your users get that say "personal 80% OFF"?

No, this wasn't the perfect answer either because they changed the subject line. So instead, I used the "From" address, so that if all of your "From" addresses have the word "Viagra" in them (as mine do), use this:[INDENT]OnMessage:
If From contains 'VIAGRA'
then disconnect
and delete message
and add sender IP to black list for 2 hours
and stop all filters[/INDENT]

The premise here of course is that virtually no legitimate sender will have a "From" address containing 'Viagra'.

It also blocks the IP for 2 hours, which you may not want to do. If it's Cox, Comcast, or AOL, they'll all be blocked for two hours. IMO, if they allow this crap through, they DESERVE to be blocked for two hours.

Tweak as you see fit!

Dave

Return to Filters and scripts

Who is online

Users browsing this forum: No registered users and 1 guest