Thanks jake!
and as a point of interest ..... your email to me was tagged ***SPAM***
I suppose because of the refrs in the body
----- Original Message -----
From: Jake Vickers
To: qmailtoaster-list@qmailtoaster.com
Sent: Tuesday, July 03, 2007 9:52 AM
Subject: [qmailtoaster] ***SPAM*** Re: [qmailtoaster] locally blacklist a
domain
Jim Shupert, Jr. wrote:
I like that idea of " write a rule for SA to target him, and just have it
assign him 100 points "
I have looked on the Toaster wiki and the SA site ... I do not find
examples of this.
How might one write a SA rule ? and does that get cronned or it is then
part of the SA process?
Any assistance would be appreciated. Thanks alot
( also... when I become President ....Sapmmers will be treated like Bank
Robbers.)
I'd prefer them to be treated like deserters or people who commit treason....
Before I digress to far:
Writing rules is a whole other world. Here's a link on writing rules (I don't
agree with all his statements, but he IS linked to from the RulesEmporium site):
http://mywebpages.comcast.net/mkettler/sa/SA-rules-howto.txt
And here's a guide on Perl regex:
http://daniel.haxx.se/projects/mail2sms/regex.shtml
Or you can just dig through the rules and find examples.... Here's some of
mine:
Body test:
body JV_Phaarm_Drug /MegaPha*rm/i
describe JV_Phaarm_Drug Common word used by spammers in ED ads
score JV_Phaarm_Drug 10.0
URI test (yes, I know about the period):
uri JV_Pharm1l_Drug /sassantrappy.com/i
describe JV_Pharm1l_Drug Pill ad web link
score JV_Pharm1l_Drug 10.0
A rawbody test (catches HTML as well):
rawbody JV_Pharm2f_Drug /Pha*rma*cy/i
describe JV_Pharm2f_Drug catches another pill ad mispelling
score JV_Pharm2f_Drug 2.9
A subject line test:
header JV_Pharm3i_Drug Subject =~ /The Ultimate Online
Pharmaceutical/i
describe JV_Pharm3i_Drug Pill ad subject line
score JV_Pharm3i_Drug 15.0
A test to match specific mailers:
header JV_Pharm3p_Drug X-Mailer =~ /The Bat/i
describe JV_Pharm3p_Drug Pill ad mailer program signature
score JV_Pharm3p_Drug 6.0
This guy used his name in a signature for search engine optimization spam
(LONG time ago):
body JV_Junk1s /Javier Russo/i
describe JV_Junk1s Sorry but I get SPAM from you for search
engines
score JV_Junk1s 1.2
I don't actually have any where I block from a FROM address, since that
changes so often I never felt a need to write anything like that.
My rules are simple and crude. I also don't want to become a guru in regex. I
target specific spam that comes through past everything else.
Hope this helps some.
