Firetrust Support Forums

For many unwanted repeat emails, I use the email header info in Mailwasher to identify the domain info and add the domain to my blacklist. However, sometimes mailwasher cannot identify any domain; the header is bogus. Is there a method by which I can add a filter that will catch these emails, so they can automatically be added to my blacklist. I guess the filter would read, "if MW cannot identify header domain, filter ......"

This may not be possible, but these bogus emails are getting to be a pain... Paul.
---

I use a filter to look for email addresses that aren't in a valid format.

If you create a filter to look at the FROM, DOESN'T CONTAIN, REGEX
[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,4}

Then flag the email as spam, but you cannot use filters to automatically blacklist. That said, if the address is not a valid format, it might not work for blacklisting.

If that's not going to work, can you post an example header of one of these emails, or email it to me at [email protected]


Cheers

Below is an example of a header from a post for which Mailwasher cannot retrieve the domain info (manifestub.co). I would assume the domain is bogus? I check the domains of bogus posts, if MW identifies a domain, I place the domain on my Blacklist. That way the post gets deleted immediately as well as future posts. If MW does not identify a domain, I list the post as spam. However, it would be nice to be able to catch posts whose emails cannot be identified by MW, as a filter, etc. Then they could be earmarked to be auto-deleted. I would see the filter color in the short listing and ignore having to check them for being false spams.

My problem is I have been on the Internet since the mid 90s. I cannot change my email address or domain due to business. The email is on too many listings and exists on too many clients' address books. As a result, I receive in the neighborhood 200-300 posts per day, most of which are bogus. If I did not have MW, who knows how many

Return-Path: <38438-66082-129411-9987-[removed: rusticdog ]@mail.manifestub.co>
Delivered-To: [removed: rusticdog ]
Received: from omega892.hostpapavps.net
by omega892.hostpapavps.net with LMTP
id uHk1AgwHFWEEXAAA00xk/A
(envelope-from <38438-66082-129411-9987-[removed: rusticdog ]@mail.manifestub.co>)
for [removed: rusticdog ]; Thu, 12 Aug 2021 11:33:32 +0000
Return-path: <38438-66082-129411-9987-paul=[email protected]>
Envelope-to: [removed: rusticdog ]
Delivery-date: Thu, 12 Aug 2021 11:33:32 +0000
Received: from [163.123.143.57] (port=46531 helo=cowan.manifestub.co)
by omega892.hostpapavps.net with esmtp (Exim 4.94.2)
(envelope-from <38438-66082-129411-9987-[removed: rusticdog ]@mail.manifestub.co>)
id 1mE8xq-0006DD-LN
for [removed: rusticdog ]; Thu, 12 Aug 2021 11:33:31 +0000
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=k1; d=manifestub.co;
h=Mime-Version:Content-Type:Date:From:Reply-To:Subject:To:Message-ID; i=[email protected];
bh=qK4Di+o1xmGBsa4Py0MX2qW8cVA=;
b=UwQjWWy1uXpVXcMhBzUx5P8GV4swOWP/jv2NXOFoaurRXSGRBGU/H+b0ImhZXW8GWyIFVc/Xb4DM
YWHQdRgwkTm6cxcTesWcUnUVuz0rO7cbTuBdf4OQKOaF05iY92yRxSvHmImLRkSrFBXZCDZMDbsy
WYGyUe/XgXFHf3j+MEE=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=k1; d=manifestub.co;
b=rtunkkM54uluDLt+ThBpDGLaVo4A1x2LyyAdkdQOzBZdvxu69EgwU0NFJHpRxk5Lk0T7LZ5jnAVs
/ma9Hzxhh2Kc3/B3oxi3OvdGvMm8kQS9ctmpsTH0mm9+Q7zJngVA+kqg0Q+QNZqNrLuHq6PEMWV+
sVpdcR9tslS451Mtpkc=;
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="364607e3d8f4bd10beb3a916d8a6c22e_10222_1f983"
Date: Thu, 12 Aug 2021 07:15:16 -0400
From: "Thyroid" <[email protected]>
Reply-To: "Thyroid" <[email protected]>
Subject: Eat Pink Sea Salt To Speed Up Your Metabolism By 124%?
To: [removed: rusticdog ]
Message-ID: <[email protected]>

--364607e3d8f4bd10beb3a916d8a6c22e_10222_1f983
Content-Type: text/plain;
Content-Transfer-Encoding: 8bit

Eat Pink Sea Salt To Speed Up Your Metabolism By 124%?

Added after previous reply. I did a who-is search on manifestub.co and it is a legit domain. Not sure why MW could not locate any domain info.

BTW, I tried your filter. Wow! That may very well go a long way to doing the job. Thanks much... Paul...
---

OK, let me know if the filter doesn't end up working long term for these and we'll come back to it.

I think what might be happening is MailWasher is finding the .co and looking for a further suffix. .co.nz for example. It could be bugging out, so we'll need to look into that further.

Cheers

That's a valid point about MW looking for added domain info following .co. Thanks for adding that issue as a possible bug.

Love the app... Paul...
---