EXIM custom filter to block email address in name field?

equens

Well-Known Member
Feb 8, 2002
278
3
318
Hello Keat63, thanks for your help. It's not the same sender, I would like to create rule across all servers to stop these emails.
 

equens

Well-Known Member
Feb 8, 2002
278
3
318
Hello again:

Code:
Received: from unknown (HELO bork.domain.com) (119.252.18.x)
  by 0 with ESMTPS (DHE-RSA-AES256-GCM-SHA384 encrypted); 4 Oct 2019 09:19:01 -0000
Received: (qmail 49057 invoked by uid 89); 4 Oct 2019 09:19:01 -0000
Received: from unknown (HELO ?93.146.196.170?) ([email protected]*****[email protected]***)
  by 0 with ESMTPA; 4 Oct 2019 09:18:58 -0000
Received: (qmail 19157 invoked by uid 89); 4 Oct 2019 09:18:59 -0000
Received: from mx7.web*****ot.com ([203.143.**.9]:54780)
by or***.dron***.net with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.92)
(envelope-from <[email protected]>)
id 1iGJkY-00005d-FN
for f****[email protected]***.com; Fri, 04 Oct 2019 11:19:49 +0200
Received: fr*** n.dro***.net
by o***n.dro*****ia.net with LMTP
id sMRZCbUOl11mAQAAZqXNcQ
(envelope-from <[email protected]>)
for <fo****[email protected]****ud.com>; Fri, 04 Oct 2019 11:19:49 +0200
Return-Path: <[email protected]>

From: "Pre*****ud <pre****[email protected]****.com>" <[email protected]>

To: =?utf-8?Q?Juan_A.-_Dpto.Formaci=C3=B3n_-_PREFOR?=
=?utf-8?Q?_SALUD?= <for*****@pr****ud.com>
Subject: [virus GenScript.GGG Troyano] propuesta
Date: Fri, 4 Oct 2019 12:18:55 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
Best regards,
Equens.
 
Last edited by a moderator:

cPanelLauren

Forums Analyst II
Staff member
Nov 14, 2017
8,040
652
263
Houston
cPanel Access Level
DataCenter Provider
Hello @equens

Do you utilize SpamAssassin on the domain/s receiving these types of emails? Has it flagged them if so? While a filter might be doable - I wonder if you wouldn't be able to get this resolved by going to WHM>>Server Configuration>>Exim Configuration Manager: Experimental: Rewrite From: header to match actual sender