This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Block entire Top Level Domains in Email Protection : Anti-spam ?

I am getting an enormous amount of spam in user quarantines from a seemingly made up TLD. I used to get .xyz and now I get .science.

Of my 10680 mails in quarrintine, 4455 are from a .science domain

I would love it if someone would tell me how to block these since that are all junk.

I tried 
*@*.science
 under Email Protection : Anti-spam : Sender blacklist but it does not work.

It looks like each SPAM campaign has a different IP, domain, and sub-domain so the TLD is the only common factor. These never get caught by rDNS or RBLs and I would like to see them gone.

Here are some sample headers: 

Received: from prescout.quinter.science ([66.248.193.188]:49960) by 7552-5.UTM-server.com with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1YzYdc-0005Qn-0p for mic@mydomain.com; Mon, 01 Jun 2015 18:56:56 -0400
Received: from 0035201d.prescout.quinter.science ([127.0.0.1]:4011 helo=prescout.quinter.science) by prescout.quinter.science with ESMTP id 00GP3520VA1D; for ; Mon, 1 Jun 2015 15:56:55 -0700
X-CTCH-RefID: str=0001.0A020203.556CE338.00C9,ss=3,re=0.000,recu=0.000,reip=0.000,cl=3,cld=1,fgs=0
Date: Mon, 1 Jun 2015 15:56:55 -0700
To: 
Message-ID: 

Received: from 2rqun09wm.lovechristian.science ([198.52.177.235]:50587) by 7552-5.UTM-server.com with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1YzYS4-0004vz-0R for connie@mydomain.com; Mon, 01 Jun 2015 18:45:00 -0400
Received: from 00de1d46.2rqun09wm.lovechristian.science (amavisd, port 6523) by 2rqun09wm.lovechristian.science with ESMTP id 00PPATYDE1DVNNNY46; for ; Mon, 1 Jun 2015 15:44:56 -0700
X-CTCH-RefID: str=0001.0A020202.556CE038.0081,ss=3,sh,re=0.000,recu=0.000,reip=0.000,cl=3,cld=1,fgs=0
Message-ID: 
Envelope-to: connie@mydomain.com
Date: Mon, 1 Jun 2015 15:44:56 -0700
From: "ONLINE-DATING" 
Subject: ARE YOU-SINGLE?- CONSIDER THIS..
To: 
Content-Language: en-us


Will a REGEX work?

If so, can someone please post one?

Thanks.


This thread was automatically locked due to age.
Parents Reply Children
  • Domain Dossier

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Thank you for the tip, I'll bookmark that one.

    However, this just shows his Whois record, which is 100% fake.

    He registers new domains with a script every few hours on namecheap.com.

    They are all 100% completely fake registration information.  Random words.

     

    By the time you report him, he has LONG since abandoned the domain.  He only uses them for a couple of hours.

  • I have worked out a less-than-perfect solution for blocking entire top level domains to counteract this kind of spammer. I'd rather not post it here for the spammers to see. What do you think Bob? Best if kept out of the forum? If you are a long-term user that recognizes the need for Sophos to fix what they broke in UTM 9.1 so this can be done in the global email settings drop me a PM and I will provide my tedious user level solution.

    Best Regards - HTG
    Frustrated Sophos Partner seeing all the things
    that brought me to Sophos slowly slip away.
    RIP astaro.org