Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 0 subscribers
  • Views 9355 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Puremessage: Content filtering HTML emails

scaramanga

Hi,

One of our users is getting a pretty huge amount of spam - at least one every 5 mins, 24hrs a day.  Puremessage is giving it a spam score of around 10 which means I can't block using the usual methods as it would catch almost all our emails.

Fortunately, all the emails contain a link to the website eteamz.com so I went to the content filter and filtered out *eteamz* and %eteamz% (not sure which is the correct wildcard).

None of these email are being blocked.  Puremessage will block if I include text that displays as HTML, but not if I use something that's part of an <a> tag.

Can anyone help?

Thanks

:8471


This thread was automatically locked due to age.
  • 0

    Have you submitted these spam messages to our labs for analysis.  You can do so by either forwarding the messages to is-spam@sophos.com or contacting out support team.

    Our labs may be able to create a definition which will address this type of campaign if it is one.   If you are using regex expressions you can use the .* along with your word to match. The * in perl is for a single character and not all characters.

    :8493
  • 0

    Hi Jason, thanks for your reply.

    A few of the users here have been forwarding emails to the address you provided, but they're still getting through with a very low spam score (around 8%).

    I've content-filtered both *eteamz* and %eteamz% from both the string and the regexp tabs, but the mail still gets through.

    Regards,

    Paul

    :8751
Unfiltered HTML