This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Block mail by sender name and not e-mail address

Hi,

I'm getting a lot of Casino spam lately. All coming from Mark Jansen but a different e-mail address everytime. How can I block those mails in the POP3 proxy? I've setup the following expression '\bMark Jansen\b' but that doesn't seem to work. Mail is still getting through. Is this because 'Mark Jansen' isn't inside the contents of the message but only in the from address?

Franc.

This thread was automatically locked due to age.

0 BAlfson over 12 years ago

Are they blocked if you put the name in the 'Expression filter' instead of the 'Sender blacklist'?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 FrancWest over 12 years ago

Hi Bob,

I already have them in the expression filter, since I thought the sender blacklist only checks e-ail addresses (and those are different every time).

Franc.
Cancel
Vote Up 0 Vote Down

Cancel
0 eganders_01 over 12 years ago in reply to FrancWest

Hi Bob,

I already have them in the expression filter, since I thought the sender blacklist only checks e-ail addresses (and those are different every time).

Franc.

What about the IP address the messages come from? Are you checking SPF's?
Cancel
Vote Up 0 Vote Down

Cancel
0 FrancWest over 12 years ago

Hi,

I'm using the pop3 proxy. That one doesn't have those kind of checks.

Franc.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 12 years ago

What happens if you get rid of "\b" in the expression?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 FrancWest over 12 years ago

Done that now and changed it to Mark.Jansen (because of the space between the two names. Let's see what happens.

Franc.
Cancel
Vote Up 0 Vote Down

Cancel
0 FrancWest over 12 years ago in reply to FrancWest

Hi,

unfortunately this doesn't work also. Looks like the expression filter only scans the message content and not the header.

Any more ideas?

Franc.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 12 years ago

I'm not a fan of the POP3 proxy. If you own the email domain, you're better off using the SMTP Proxy instead. Wingman gives a great step-by-step included in https://community.sophos.com/products/unified-threat-management/astaroorg/f/56/t/49267. I helped him solve a couple small problems, but he created the entire document from scratch, spending many hours testing and problem solving - I had fun helping and being his test sender/recipient while he was working on it.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 FrancWest over 12 years ago in reply to BAlfson

Hi Bob,

thanks for the tip. In our company we use the SMTP proxy, but at home I use the POP3 proxy since my cable provider at home blocks incoming SMTP connections.

Franc.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 12 years ago

Hmmm...

Ask your management to let you grow your skills on your own time by configuring as wingman suggests. The difference is that, in addition, you will need to configure a mail profile and an IPsec tunnel between the office and your mail server.

Cheers - Bo

Sorry for any short responses! Posted from my iPhone.

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Block mail by sender name and not e-mail address

Submitted a Tech Support Case lately from the Support Portal?