ConfigServer Community Forum

I use Bayes filtering with Mailwatch and are very pleased with the results. Little gets through but spammers are cleaver.

I sometimes use the blacklist in MailScanner Frontend to block specific hosts such as *@baddomain. However many spammers use spam@sub.sub.sub.domain and it isn't feasible to list all their hosts in the blacklist. Is there a way to block *@*.domain so to speak in Mailscanner or exim?

Likewise, we sometimes get spammed by ".rocks" or ".click" domains and would like to block *.rocks or *.click (all domains belonging to that top level domain) How would one do this using a typical CSF/MS configured system?

Thank you for any insight into these questions.

I found the TLD solution in another post. I added this

From: /\.pw$/ yes
From: /\.me$/ yes
From: /\.ru$/ yes
From: /\.pw$/ yes
From: /\.in$/ yes
From: /\.asia$/ yes
From: /\.link$/ yes
From: /\.click$/ yes
From: /\.rocks$/ yes

to /usr/mailscanner/etc/rules/spam.blacklist.rules and it really did the trick.
Can I do something like:

From: /\domain.click$/ yes

To filter a specific domain and all of its subdomains? Thanks!

This already does what you are looking to do: block the domain.domain. BTW, that list had 2 pw domains so I edited it and added science. Seems to work pretty well.

This also seems to work for domain.domain.domain like save.newgroceryspecials.link.