[Oisf-users] Block Spam Mail

[Andreas Herz]

On 20/10/16 at 09:57, Mesra.net CEO wrote:
> I have problem lately with some spam mail from *@osu.edu and
> *@vanderbilt.edu, i cant block their ip because their using dynamic ip of
> outlook.com, so how can i make a rules to block any incoming mail from
> *@osu.edu and *@vanderbilt.edu

I would solve that within the mailserver/spamassassin but you can also
write drop rules for smtp, there are already smtp rules (alert) in the
ET ruleset:

https://rules.emergingthreats.net/open/suricata/rules/emerging-smtp.rule

-- 
Andreas Herz