Blocking Spam with cPanel Filters

[D. Stall]

How do I block all email by specific domain ending (such as .cn - China)?

I am able to block IPs using "Any header" and "Matches regex" with this expression -

(\W|^)(66\.225\.198\.[0-9]{1,3})(\W|$)

I can also block any typical SPAM words in header, subject, from and body with same expression -

(\W|^)(Viaagra|cialis|ciaalliiss)(\W|$)

But for some reason, that expression is not working to filter domain endings -

(\W|^)(\.cd|\.cf|\.cg|\.ci|\.cl|\.cm|\.cn|\.co|\.cu|\.cv)(\W|$)

Is there some change to the expression that I can make to enable filter to work on domain endings?

 

[cPanelMichael]

Hello

Do you experience the same issue when creating a separate filter rule for each TLD? This could be a viable workaround as it looks like you only have a few to block.

Thank you.

 

[D. Stall]

I've tested the following 4 ways, and none of them work -

Body, matches regex -
(\W|^)(\.info)(\W|$)
(\W|^)(\.info|\.us)(\W|$)
(\W|^)((\.info|\.us))(\W|$)
(\W|^)(\.(info|us))(\W|$)

I've sent email with body that includes link /http://www.test.info
and email message is never filtered to Junk folder with any of the above 4 expressions.

 

[cPanelMichael]

You may find this thread helpful when formulating a filter rule:

Need to filter ALL email

While it's intended for the entire server on that thread, you could modify it so it applies to a single account.

Thank you.

 

[D. Stall]

I'm using CPanel from my hosting provider.
Under Rules there are 2 sets of drop down menus -
The first gives choices for - From, Subject, To, Reply Address, Body, Any header, Any recipient, Has not been previously delivered, is an error message.
The second has choices for - equals, matches regex, contains, does not contain, begins with, ends with, does not begin, does not end with, does not match.
Under the 2 drop down menus there's a single horizontal text block for entering the filter.

I may have a lot of domain endings to filter, as I don't care about mail from most of the world, mostly only the US.
The solution at the thread at the link seems to be domain ending specific, which means I'd have to have a filter for each separate domain ending.
It also mentions an Exim Configuration Manager which I don't have
Also, I don't understand how that multiple line filter should be entered on the single text block in CPanel.
When I cut and paste it, everything is put on a single line like this -
if first_delivery and ("$h_to:, $h_cc:" contains ".pw") or ("$h_from:" contains ".pw") then seen finish endif

Is that the way it should be?

 

[D. Stall]

How do I escape a "." in CPanel regex?
Escaping "." with forward slash "\" does not work in any CPanel regex, except regex for an IP address as shown in initial post.