Cisco ESA billing@delivery-806738.info wildcard

[ccna_security]

hi. is there any way to configure esa to block such domains with wildcard?

I want to block only email coming from billing@delivery-806738.info (806738 is random number and frequently change)

esa didn't let me write down as billing@delivery-*.info   do you have any suggestions?

I crated dictionary and added billing@delivery-*.info inside it but I don't know whether it will work or not. I cant test it. please help me to solve this issue

[ccna_security]

hi. is there any way to configure esa to block such domains with wildcard?

I want to block only email coming from billing@delivery-806738.info (806738 is random number and frequently change)

esa didn't let me write down as billing@delivery-*.info   do you have any suggestions?

I crated dictionary and added billing@delivery-*.info inside it but I don't know whether it will work or not. I cant test it. please help me to solve this issue

[Paul Thomas Cyblue]

Not tested, but you could just replace the address in the rule with your personal email address to validate.

Dictionary
^(?i)billing@delivery-.*\.info$

CLI Message Filter
block_sender: if (mail-from == "^(?i)billing@delivery-.*\\.info$") {
drop();
}

Content Filter
Sender > Equals > (?i)billing@delivery-.*\.info
This will appear in list as ^(?i)billing@delivery-.*\\.info$

[ccna_security]

Thank you so much. I will test it tomorrow and will turn you back about the result. Please if possible could you send me a link that teach how i can use wildcard on different email 

[Paul Thomas Cyblue]

Use Regex101.com - below link contains your search and permutations
https://regex101.com/r/73c37m/3/

Note that \. ensures that the domain separator dot is treated as a dot.
Otherwise regex treats this as any character.
This can be important at times.

Note that there is a strange behavior where the CISCO ESA Message Filters created via SSH console require double escapes, whereas in the GUI (Content Filters / Dictionary) they do not.

Message Filter - ^(?i)billing@delivery-.*\\.info$

[ccna_security]

Your answers are so helpful. I really appreciate that.

I added to content filter->Equal-> .*\@delivery-.*\.info

But when I clicked ok is is shown as ^.*\\@delivery-.*\\.info$    Do you think this is normal behavior?

I tested with own gmail account. b.doyskiy@.*\.com esa blocked I mean worked as expected. Hope will block above email as well.

[Paul Thomas Cyblue · Accepted solution]

That's fine, off the top of my head I thought it didn't add the extra slash in the GUI, but it does on checking.
Plus I used the Trace command under System Administration to check that the Content filter matched.
You didn't need to escape the @

[ccna_security]

Thank you Paul. I really appreciate your help