Filtering Compound Domain Names

[SweaterBaron]

Recently, a prolific spammer has been creating multiple compound domains each day. By compound domain names I mean "xxxx.beauty" where the xxxx is different each time. My attempts to add the domain name with a wildcard (*.beauty") to my filters hasn't worked. The filtering rule I created is: Filter Type: Spam Domain - Contains - Plain Text = *.beauty or *beauty

Any ideas how better to block these messages?

Thanks,

Scott

[Digerati]

Did you try just .beauty?

[Wizcrafts]

Scott;
Are these domain names in the headers or the message body? If in the body, are they in plain text or base64?

It might help us create a rule if you provide a snippet or two from these spam messages, including the domain you want to detect.

[gingbat]

Yes, you can only add wildcards to black or friendslists, plain text filters need to be exactly what you want them to filter, eg, as Digerati posted, simply use .beauty in the filter, not the *

OR, another option is to add *.beauty* as a wildcard for blacklist possibly? that would catch any email with .beauty in the senders address....

To do this, click Settings>>Spam Tools>>Blacklist, select, "Wildcard Expression" and type in:

*.beauty*

And click Add.

[SweaterBaron]

gingbat, both of your suggestions mentioned above worked. So, I deployed them both. Probably a bit redundant, but don't suppose there's any harm.

1. Created filter for just " .beauty" without the wildcard.
2. Added to blacklist as "*.beauty"

Thank you.

[gingbat]

Excellent....

[Wizcrafts]

Recently, a prolific spammer has been creating multiple compound domains each day. By compound domain names I mean "xxxx.beauty" where the xxxx is different each time. My attempts to add the domain name with a wildcard (*.beauty") to my filters hasn't worked. The filtering rule I created is: Filter Type: Spam Domain - Contains - Plain Text = *.beauty or *beauty

Any ideas how better to block these messages?

Thanks,

Scott

Scott;
When you need to create wildcard rules in a MailWasher filter, you have to specify the type as Regular Expression, not plain text. The periods, asterisks and plus signs are only special characters in Regular Expressions. So, change your filter to the following:
Filter Type: Spam - Match Any -
Rule #1: Domain - Contains - RegEx = .*\.beauty
Rule #2: From - Contains - RegEx = .*\.beauty

The dot (.) means any one character at all (a letter, number, special character, space, etc). The asterisk (*) means zero or more times. I corrected the code sequence before ".beauty" and added a backslash before the period to escape it so it is treated literally as a dot. My expression works for any number of characters, followed by a dot, then beauty. It even matches no characters before the dot. If there are always some characters before the dot, which makes sense, you can change the * to a +. The + sign means 1 or more times. If you want to do that, your filter rules would be as follows:
Rule #1: Domain - Contains - RegEx = .+\.beauty
Rule #2: From - Contains - RegEx = .+\.beauty