blocking tld and it's subdomains

greetings...

I am trying to block a tld and it's subdomains. The subdomains, IP address and name are always changing making various methods posted in this forum ineffective.

Code:

[174.135.15.7]:<hayricks@proverbiologistw.inboxmsg-232.top>
[24.229.69.40]:<blenniiformv@carpenteringt.inboxmsg-239.top>
[216.9.176.191]:<osteocraniumt@photomuralsw.inboxmsg-218.top>
[66.182.116.193]:<appositee@buttermouthj.inboxmsg-219.top>
[87.125.122.14]:<frenziesg@furbelowedu.inboxmsg-238.top>
[52.119.17.193]:<tracheotomizedb@lucernsj.inboxmsg-79.top>
[88.196.40.111]:<convalescentsx@hemafibritej.inboxmsg-230.top>
[208.118.156.49]:<illimitablef@carcinoidx.inboxmsg-218.top>
[99.135.78.58]:<lacrosserv@lamellarm.inboxmsg-219.top>
[192.34.143.103]:<diplodusg@vamoosedm.inboxmsg-83.top>

I've tried:

Code:

if first_delivery
and ("$h_to:, $h_cc:" contains ".top")
or ("$h_from:" contains ".top")
then
seen finish
endif

and also:

Code:

if first_delivery
and $h_from matches " \\N\\.top$\\N"
then
seen finish
endif

both do not work.

any help would be greatly appreciated

and a new one without inboxmsg as a common factor

Code:

countercoupj@archpillarw.info-10.top

 

None of the solutions here work. Including all the options contained in the link you posted.

 

Initially it worked when "discarded" was selected. The "discarded" selection also signifies that the email was "accepted". Which I don't want especially since most of these are being sent to a non-existant email address on the server.

So I changed the filter from "discarded" to "failed with message" and now the emails are coming through again.

I need a wild card for sender. subdomain1 and subdomain2. along with the tld.

wildcard@wildcard.wildcard.top