Would appreciate help with a global email filter

[Bob Ulius]

I have written many email filters. This one eludes me.
Right now I have quite a few SPAM coming in and getting past everything with the first line in the header reading:

Return-Path: <[email protected]>

The 6 numbers are always different and the domain is always different. But up to the numbers always the same.

I tried Regex matches in header for updates\d{6}@ and /updates\d{6}@. Neither worked.

I tried header contains Return-Path: <updates. No good.

Any ideas?

That string Return-Path: <updates does repeat two or three time in the header. For example:

(envelope-from <[email protected]>

Thanks.

 

[cPRex]

What if instead of the "\d{6}" section you tried individual blocks? [0-9][0-9][0-9][0-9][0-9][0-9] to get six numbers' worth?

 

[Bob Ulius]

Thanks for the reply.

I believe I found another way to catch these, which are the number 1 source of S{PAM for me for the last month or so:

Any header contains": envelope-from <updates

Seems to work, at least for now.

~Bob

 

[cPRex]

That would work too! Just make sure it's not so general that it catches emails you may want to receive.

 

[Bob Ulius]

Indeed! Right now I am sending to the junk folder rather than deleting to be sure for a few days no fals positives.

Trying to catch it with Match Regex was tough for this one.