We started off using rules.ima but that process became unworkable as the rule base grew beyond 1500 rules and we recognized the economics of managing that rule base. We ended up building Sortmonster/Message Sniffer to solve the problem. We use this now for all of the domains we host.
See http://www.sortmonster.com/ The current package is a plug-in for declude so if you're using Declude already (for virus scanning), then this would be an easy add on. Otherwise, we will be porting the system to linux based mail systems soon. If you have another way to integrate the scanning utility then that might be another option. It scans a message file and returns a numerical result if it finds a pattern match... much like a virus scanner. Hope this helps, _M | -----Original Message----- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]]On Behalf Of Michael E. | Middleton | Sent: Monday, February 04, 2002 11:35 AM | To: [EMAIL PROTECTED] | Subject: RE: [IMail Forum] rules.ima | | | Thanks, but I was mostly wondering about spam identification. I'm pretty | happy with my antivirus setup. Does anyone have a rules.ima that they're | happy with as it relates to moving possible spam into a junkmail | mailbox? I | have one, but it is not very effective. | | Mike | | > -----Original Message----- | > From: [EMAIL PROTECTED] | > [mailto:[EMAIL PROTECTED]]On Behalf Of Joseph Marlin | > Sent: Monday, February 04, 2002 10:32 AM | > To: [EMAIL PROTECTED] | > Subject: RE: [IMail Forum] rules.ima | > | > | > I have used some of the rules.ima posted here and they work on | everything | > but . c o m's (spaced for others with the same rules) for me. I | still get | > false positives on http messages with embedded web site or email address | > links. | > | > For example, this rule (without the extra spaces): | > | > B~name=".*\. c o m":virusbox | > B~filename=".*\. c o m":virusbox | > B~Begin 6.*\. c o m:virusbox | > | > Catches this offensive line (without the extra spaces) in html messages: | > | > <DIV><FONT face=Arial><FONT size=2><SPAN | class=502594922-03022002><FONT | > color=#0000ff>Using the IMail Administration Program, add to the alias | > field, | > all of the names by which your users may wish to login, | such as <A | > href="http://www.domain. c o m">www.domain. c o m</A>, | > mail.theirdomain. c | > o m, | > theirdomain. c o m, etc. This is a change required when upgrading to | > 7.05.</FONT></SPAN></FONT></FONT></DIV> | > | > So, I have to go fishing for IMail forum messages sent in HTML format. | > | > Joseph Marlin | > | > | > -----Original Message----- | > From: [EMAIL PROTECTED] | > [mailto:[EMAIL PROTECTED]]On Behalf Of Michael E. | > Middleton | > Sent: Sunday, February 03, 2002 11:56 AM | > To: [EMAIL PROTECTED] | > Subject: [IMail Forum] rules.ima | > | > | > Does anyone have a rules.ima that is effective against the | > current flood of | > spam and trojans? Is there a forum where y'all share rules.ima files and | > ideas? How effective is rules.ima? | > | > Mike | > | > | > Please visit http://www.ipswitch.com/support/mailing-lists.html | > to be removed from this list. | > | > An Archive of this list is available at: | > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ | > | | | Please visit http://www.ipswitch.com/support/mailing-lists.html | to be removed from this list. | | An Archive of this list is available at: | http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ | | Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
