Message rule to stop porn
 

Hi all

My inbox has recently been hit with porn email which is not nice.

The to addresses often is not me but other ntl customer's I presume. The properties of the from address appear to be be different but I guess coming from the same source. See below

bandikaa@spike.fa.gau.hu
fpl@battanet.hu
csuri@cc.u-szeged.hu
etolvaj@datatrans.hu

Can anyone suggest a message rule so I can simply delete these from the server.

Many thanks

Mike

Re: Message rule to stop porn
 

I would suggest getting SpamPal (free).
This acts as a POP proxy and adds message headers which make it easy to write rules in your mail client for filtering out spam.
It's very configurable as to what constitutes spam.

Re: Message rule to stop porn
 

I do have spampal (great programme) but these are going through.

Re: Message rule to stop porn
 

If the To address is often not yours, one very simple rule you can use is to scan the To address for your address and if it's not there mark it as spam. I don't know much about SpamPal but you could also see if it has a learning function so you can train it on the unwanted mail. Alternatively, submit the spam to one of the blacklists that SpamPal uses.

Re: Message rule to stop porn
 

You could ad "*@*.hu" (or some such variant) to the SpamPal Email Addresses blacklist

Re: Message rule to stop porn
 

Here's a thread that has various posts on extra DNSBL definitions, including ones for blocking countries other than those in the default list:

http://www.spampalforums.org/phpBB2/...p?t=3129#16949

I have Spampal set up to be quite strict:

Blacklists... Public blacklists... Click "Pre-created filtering strategies" Choose "Aggressive"
Blacklists... Countries... Check all except America

Re: Message rule to stop porn
 

Some of the more aggressive DNSBLs have NTL's email servers on them - not sure if any on the main list are that fierce.

I've been examining the Message-ID in detail, and while I thought I'd found a great way to home in on my main repeating spammer, it doesn't seem to be completely unique:

12 hex characters $ 8 hex characters $ 8 hex characters @ 4-6 alpha
That message ID format seems to be VERY strongly indicative of a spammer, though I have seen it from other email lists - mind you, if that's the only one it's wrong on, then I just whitelist my wanted lists, and let it eat the rest - now to figure out REGEX



PS. Spampal update 03 Jul 2004 http://www.spampal.org/
1.57 release
1.62 beta

Re: Message rule to stop porn
 

NTLs servers on a blacklist - tradgedy :p:

I think there are existing regex rules that look at the ID. Have a look at the rule file - might be something there that will help you form the correct regex. Also, there's the regex filter manual and a forum for the plugin where users can post questions and share their regexs.