Would appreciate help with a global email filter

Bob Ulius

Active Member
Jun 7, 2015
25
2
53
Palo Alto, CA
cPanel Access Level
Website Owner
I have written many email filters. This one eludes me.
Right now I have quite a few SPAM coming in and getting past everything with the first line in the header reading:

Return-Path: <[email protected]>

The 6 numbers are always different and the domain is always different. But up to the numbers always the same.

I tried Regex matches in header for updates\d{6}@ and /updates\d{6}@. Neither worked.

I tried header contains Return-Path: <updates. No good.

Any ideas?

That string Return-Path: <updates does repeat two or three time in the header. For example:

(envelope-from <[email protected]>

Thanks.
 
Last edited by a moderator:

Bob Ulius

Active Member
Jun 7, 2015
25
2
53
Palo Alto, CA
cPanel Access Level
Website Owner
Thanks for the reply.

I believe I found another way to catch these, which are the number 1 source of S{PAM for me for the last month or so:

Any header contains": envelope-from <updates

Seems to work, at least for now.

~Bob
 

Bob Ulius

Active Member
Jun 7, 2015
25
2
53
Palo Alto, CA
cPanel Access Level
Website Owner
Indeed! Right now I am sending to the junk folder rather than deleting to be sure for a few days no fals positives.

Trying to catch it with Match Regex was tough for this one.
 
  • Like
Reactions: cPRex