[qmailtoaster] ***SPAM*** Re: [qmailtoaster] locally blacklist a domain

[Jake Vickers]

Jim Shupert, Jr. wrote:

I like that idea of " write a rule for SA to target him, and just have it assign him 100 points " I have looked on the Toaster wiki and the SA site ... I do not find examples of this. How might one write a SA rule ? and does that get cronned or it is then part of the SA process?

Any assistance would be appreciated. Thanks alot

( also... when I become President ....Sapmmers will be treated like Bank Robbers.)

I'd prefer them to be treated like deserters or people who commit treason....

Before I digress to far:

http://mywebpages.comcast.net/mkettler/sa/SA-rules-howto.txt
And here's a guide on Perl regex:
http://daniel.haxx.se/projects/mail2sms/regex.shtml


Body test:
body            JV_Phaarm_Drug  /MegaPha*rm/i
describe        JV_Phaarm_Drug  Common word used by spammers in ED ads
score           JV_Phaarm_Drug  10.0

URI test (yes, I know about the period):

Writing rules is a whole other world. Here's a link on writing rules (I don't agree with all his statements, but he IS linked to from the RulesEmporium site): Or you can just dig through the rules and find examples.... Here's some of mine:

uri             JV_Pharm1l_Drug /sassantrappy.com/i
describe        JV_Pharm1l_Drug Pill ad web link
score           JV_Pharm1l_Drug 10.0

A rawbody test (catches HTML as well):
rawbody         JV_Pharm2f_Drug /Pha*rma*cy/i
describe        JV_Pharm2f_Drug catches another pill ad mispelling
score           JV_Pharm2f_Drug 2.9


A subject line test:

header JV_Pharm3i_Drug Subject =~ /The Ultimate Online Pharmaceutical/i

describe        JV_Pharm3i_Drug Pill ad subject line
score           JV_Pharm3i_Drug 15.0

A test to match specific mailers:

header          JV_Pharm3p_Drug X-Mailer =~ /The Bat/i
describe        JV_Pharm3p_Drug Pill ad mailer program signature
score           JV_Pharm3p_Drug 6.0

This guy used his name in a signature for search engine optimization spam (LONG time ago):

body            JV_Junk1s       /Javier Russo/i

score           JV_Junk1s       1.2


Hope this helps some.

describe JV_Junk1s Sorry but I get SPAM from you for search engines I don't actually have any where I block from a FROM address, since that changes so often I never felt a need to write anything like that. My rules are simple and crude. I also don't want to become a guru in regex. I target specific spam that comes through past everything else.

smime.p7s
Description: S/MIME Cryptographic Signature