Resolved How to block spam from specific pattern adress of *@nl.*.com and *@nl.*.de

[kwhs]

Hello,
spam which always contain "@nl." in the email adress of the sender is driving me crazy. I get many emails on daily basis like name1@nl.name2.com... the "name1" and "name2" always change but "@nl." is always available in the sender adress.
What can I do to block all emails where the sender emailadress contain @nl. ? Where and how can I do it?

Thank you for your help in advance.

 

[tkalfaoglu]

Perhaps this would help. I created a rule in /etc/mail/spamassassin/local.cf that adds a score to strange TLD's. With a bit of tweaking you can make it fit your needs

header __FROM_TLDFROM From =~ /\.(bid|icu|book|click|club|cricket|date|democrat|directory|download|faith|help|host|link|ni
nja|online|party|press|pro|racing|reviews?|rocks|science|site|social|space|stream|top|uno|webcam|website|work|win|xyz)\>/i

header __FROM_TLDFROMA From:address =~ /\.(bid|icu|book|click|club|cricket|date|democrat|directory|download|faith|help|hos
t|link|ninja|online|party|press|pro|racing|reviews?|rocks|science|site|social|space|stream|top|uno|webcam|website|win|work
|xyz)$/i

meta FROM_TLD ( __FROM_TLDFROM + __FROM_TLDFROMA >= 1 )
score FROM_TLD 2.0
describe FROM_TLD Strange TLD

 

[Kaspar]

Try:

header     CRAZY_SPAM      From:addr =~ /@nl\..+\.com/i
describe   CRAZY_SPAM      Spam that is driving you crazy
score      CRAZY_SPAM      7.0

 

[kwhs]

Thank you very much for your kind help.