Cisco Support Community
Community Member

Link in body

Is there a way to block an incoming message that contains only a link in the body of the message?

We have been receiving a lot of messages from clients where their computer or email account (primarily AOL) have been hacked and they are sending messages to all of their contacts.

I have a filter in place to catch messages with blank subject which would work but that will also catch legitimate messages.                  

Everyone's tags (2)

Link in body

Try looking at these...

If you take the first one:


I'd take off the word boundry at the front, and prepend ^ (beginning of line) and add $ at the end (end of line)...


Ehh, but that's going to catch any URL on a line by itself... (like the second line of this message..)

Maybe this, plus from AOL, plus a blank subject?


Community Member

Link in body

Thanks.  I will give that a try.

I got it set right now to quartine any message with a blank subject from an AOL account and then BCC me so I know something tripped the filter.

I have a military email account and they strip all links in a message and replace it with a redirect to a banner page saying it  was stripped by policy.  I did not know if Ironport could also do something like that.

Community Member

Link in body

There is a Message filter action called "Edit-body-text" which can replace text in the body of the email with other text, e.g. a message and a link to a web page somewhere which can show you the banner page you create?

If you look at ESA 7.5 Advanced guide.pdf on page 6-90-91 Edit Body Text Action it can show how to replace a URL and if you combine this with an if statement matching no subject and maybe AOL it can do what you want?

I just learnt about message filters so be careful with them, especially the Edit-body-text action since they are applied on all in/out emails it can have unintended side effects.

Good luck

CreatePlease to create content