Setted "Action to take on SPAM message" to "no action", to just add "[SPAM]" to the Subject. Now there is no way to block a SPAM message.

[frapetti 2]

Hi,

I setted "Action to take on SPAM message" to "no action", because we prefer to add "[SPAM]" to the Subject instead of sending it to quarantine. However, now we want to quarantine messages from a specific domain, so we tried adding that domain to "Blocked Body Domain", "Blocked Senders" and "Blocked Domain to IP" lists, expecting for it to take precedence (after all, those are local, manual blacklists), and for the message to be blocked, but instead it seems that ESET just uses it to determine that the message is SPAM, then just adds the "[SPAM]" string to the Subject and allow the message to be delivered.

Is there any way to block, or quarantine the message if it is found on some of the local blacklists, while keeping "no action" set for SPAM messages?

Regards

[M.K. 22]

Hi, you can create a transport rule:

[if] Sender's domain ... is on the Blocked Sender's list  [then]  Quarantine message

and/or

[if] Sender's IP address ... is on the Blocked domain to IP list  [then] Quarantine message

[frapetti 2]

On 6/17/2024 at 4:41 AM, M.K. said:

Hi, you can create a transport rule:

[if] Sender's domain ... is on the Blocked Sender's list  [then]  Quarantine message

and/or

[if] Sender's IP address ... is on the Blocked domain to IP list  [then] Quarantine message

Thanks. I tried that, but it don't seems to trigger the rule, so i added two additional items to the list (before, only personal.com was on the list):

And this is the rule:

I suppose it's because the rules check the envelope sender's domain and not the from field, and the mail server protection log shows this:

So i added an additional rule to check the mail from address:

And also added the vps.ovh.net domain to the Blocked Senders list:

I suppose that the only way to test it, is to wait for another mail to arrive from that domain, right?

Regards

[frapetti 2]

I don't know what vps.ovh.net is, but they seem to host a massive phishing campaing that uses domains that look very similar to the authentic domains:

 

 

 

Edited June 18 by frapetti

[frapetti 2]

Finally, the following rule triggered:

For the following message: