Need to block by Sender

[Zenit]

Can anyone tell me how to block by sender rather than by his mail address? For instance, I want to block e-mails that say "Forensics Degrees" as sender, whereas e-mail address changes with every message. Same things for United Nations, Acai Berry, etc. I would appreciate your help!

thank you

Yuri

[Peter Banz]

I recall checking into that a while back and it's not possible under the current from block option. Did you try to block the strings in the text block?

[Zenit]

Unfortunately, it is not an option. I don't want to block, for instance, "United Nations" because it can block some newsletters that people still want to receive. However, sender "United Nations" is always the same - a Nigerian 419 scammer

Would it be possible to ask the developers to include block by sender option into the next release of Xwall?

thank you

Yuri

[Peter Banz]

In Options->Blocking->Header add

"From:Forensics Degrees"

[kumarsundaram]

Hi,

Sorry I didn't want to start a new thread for this because my issue is also exactly the same. I setup the From header as Peter suggested and it seemed to work to catch most of the time. However, is there a way to include wild char in the Header filtering? I mean setting up something like "From:*Viagra*" or "From:?Viagra?" should catch any From field that contains the word Viagra right? But, unfortunately that's not the case for me.. is there a solution to this instead of blocking the exact words in From field?

[maga]

Last edit: 03/09/2010 to reflect Peters clarification:

I just verified the following header filter which work for these pesky senders using Viagra within their friendly name:

from:viagra

(Note the absence of spaces in the above string. This will search the From: header for viagra regardless of the position of the text)

If you set the filter action to "Discard message", these mails won't reach your users any longer.

Blocking Viagra Headers

XWall_Blocking_Viagra_Headers.jpg (8.75 KB) Viewed 174 times

[kumarsundaram]

I am afraid your solution doesn't work for me.

I have the following:
From:*viagra
From:viagra*
From: *Pfizer
From: *Pfizer*

But, I still continue to get messages with the From header like "Genuine Pfizer VIAGRA" and other combination.

[maga]

If the mails are not whitelisted somehow, is the "friendly" name really viagra or is it VlAGRA (the big I is really a small L)?

... or do the From: and To: header fields contain something like

From: =?ISO-8859-1?Q?Ita=FA?= Banking <faked@banking-address.example.com>

You can see this 1) in the xwall logs, 2) in the mail history 3) in Outlook under View, Options. Message Options

Obviously, "friendly" names like in the above sample would thwart regular text filtering.

On our XWalls, these mails are usually filtered by SLS, SURBL and SPF. As all these are IP-based filters,
do you by chance use any "Antispam" device or "Antispam" MX service in front of your your XWall?

[kumarsundaram]

The mails are not whitelisted.

Here is a sample entry from the Xwall log:

Received: from 173-9-119-202-newengland.hfc.comcastbusiness.net [173.9.119.202]
by mx.mycompany.com
with XWall v3.44 ;
Fri, 19 Feb 2010 11:44:54 -0500
From: "Pfizer (tm) Viagra Certified Seller" <uzuliqy9175@comcast.net>

I have even tried blocking the domain @comcast.net because we got so many spams from this domain. But, it doesn't seem to help either. Looking at this log, may be it doesn't originate from @comcast.net rather coming comcastbunsiness.net?

[kumarsundaram]

btw, we don't have any "AntiSpam" devices or services in front of Xwall.