blocking based on connection info
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5138
Printed Date: 11 May 2025 at 4:40am
Topic: blocking based on connection info
Posted By: keizersozay
Subject: blocking based on connection info
Date Posted: 22 April 2005 at 11:23am
|
for example, I have the following information in my logs: If I write some regex to block anything with 'dsl' in the name, what file would I put it in to block based on the reverse dns lookup of the connecting ip address? If this is not possible, can it be added. I think it would be a big help. Thanks |
Replies:
Posted By: Desperado
Date Posted: 22 April 2005 at 7:52pm
|
keizersozay,
First you need to make sure that the SpamFilter.ini setting "ScanReceivedHeaders=1" is set. Then, the RegEx
(.+(client2|client|dhcp|adsl).*\.(net|com|biz|org|edu))
in the Blocked Domains, some variation of this will block it.
Regards, ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
Posted By: keizersozay
Date Posted: 25 April 2005 at 9:54am
| Thanks... |
Posted By: keizersozay
Date Posted: 25 April 2005 at 3:12pm
|
I know it has been posted several times before, but what is the order that spam filter uses to block messages. The reason I ask is because I did what was mentioned above, and the messages are not stopped by what is in the 'blacklist domain' file, but they are being blocked by the regular keyword file. |
Posted By: LogSat
Date Posted: 25 April 2005 at 6:35pm
|
keizersozay, Yes, this has been posted before, but it never hurts to post it again, especially since the previous lists do not include the antivirus plugin. As of SpamFilter ISP v2.5: All the whitelists are checked first. If a match is found, the blacklists are skipped, the email recipients are accepted, and SpamFilter is ready to accept the data command. If none of the whitelists are matched, then the blacklists are currently searched in order below: 1. Allowed Domains 2. Local Domain BlackList 3. Local Emails Blacklist 4. Local Emails TO Blacklist 5. Not in Authorized TO Emails 6. Country Blacklist 7. Reject No Reverse DNS 8. Reject Empty Mail From 9. Reject Same To From Email address 10. Reject Same To From Domain 11. Recipient Count > Max RCPTTO 12. MX Record check 13. SPF Filter 14. MAPS check 15. Attachment Filter 16. Keywords 17. Bayesian Filtering 18. Antivirus Plugin ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: Marrab
Date Posted: 29 April 2005 at 12:50am
It doesn't work. I am put in Blocked Domains: (.+\.comcast\.net) And i received mail: Connection from: 24.15.118.155 - Originating country : United States I'm try *.comcast.net with same result. In readme.html write "Blacklisted Domains - You can keep a file with additional Domains that you want to blacklist (based on the MAIL FROM field)..." but not result of resolving. I'm have version 2.5.1.441. |
Desperado wrote: