The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Blocking Spam with cPanel Filters

Discussion in 'E-mail Discussions' started by D. Stall, Aug 3, 2014.

  1. D. Stall

    D. Stall Member

    Joined:
    Apr 1, 2013
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Website Owner
    How do I block all email by specific domain ending (such as .cn - China)?

    I am able to block IPs using "Any header" and "Matches regex" with this expression -
    Code:
    (\W|^)(66\.225\.198\.[0-9]{1,3})(\W|$)
    I can also block any typical SPAM words in header, subject, from and body with same expression -
    Code:
    (\W|^)(Viaagra|cialis|ciaalliiss)(\W|$)
    But for some reason, that expression is not working to filter domain endings -
    Code:
    (\W|^)(\.cd|\.cf|\.cg|\.ci|\.cl|\.cm|\.cn|\.co|\.cu|\.cv)(\W|$)
    Is there some change to the expression that I can make to enable filter to work on domain endings?
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,762
    Likes Received:
    662
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    Do you experience the same issue when creating a separate filter rule for each TLD? This could be a viable workaround as it looks like you only have a few to block.

    Thank you.
     
  3. D. Stall

    D. Stall Member

    Joined:
    Apr 1, 2013
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Website Owner
    I've tested the following 4 ways, and none of them work -

    Body, matches regex -
    (\W|^)(\.info)(\W|$)
    (\W|^)(\.info|\.us)(\W|$)
    (\W|^)((\.info|\.us))(\W|$)
    (\W|^)(\.(info|us))(\W|$)

    I've sent email with body that includes link /http://www.test.info
    and email message is never filtered to Junk folder with any of the above 4 expressions.
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,762
    Likes Received:
    662
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    You may find this thread helpful when formulating a filter rule:

    Need to filter ALL email

    While it's intended for the entire server on that thread, you could modify it so it applies to a single account.

    Thank you.
     
  5. D. Stall

    D. Stall Member

    Joined:
    Apr 1, 2013
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Website Owner
    I'm using CPanel from my hosting provider.
    Under Rules there are 2 sets of drop down menus -
    The first gives choices for - From, Subject, To, Reply Address, Body, Any header, Any recipient, Has not been previously delivered, is an error message.
    The second has choices for - equals, matches regex, contains, does not contain, begins with, ends with, does not begin, does not end with, does not match.
    Under the 2 drop down menus there's a single horizontal text block for entering the filter.

    I may have a lot of domain endings to filter, as I don't care about mail from most of the world, mostly only the US.
    The solution at the thread at the link seems to be domain ending specific, which means I'd have to have a filter for each separate domain ending.
    It also mentions an Exim Configuration Manager which I don't have
    Also, I don't understand how that multiple line filter should be entered on the single text block in CPanel.
    When I cut and paste it, everything is put on a single line like this -
    if first_delivery and ("$h_to:, $h_cc:" contains ".pw") or ("$h_from:" contains ".pw") then seen finish endif

    Is that the way it should be?
     
  6. D. Stall

    D. Stall Member

    Joined:
    Apr 1, 2013
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Website Owner
    How do I escape a "." in CPanel regex?
    Escaping "." with forward slash "\" does not work in any CPanel regex, except regex for an IP address as shown in initial post.
     
Loading...

Share This Page