Hello William, I assume you also use Declude? You can create a rule with Declude for this as well, we did it ourselves since we got the same problems.
In the global.cfg we made new rule "BAD-SUBJECT" which refers to a text file. If a mail is positive it gets a certain extra weight. In the text file we specified the following: "SUBJECT 0 CONTAINS =?Windows-1251" In the "$default$.junkmail" this "BAD-SUBJECT" is specified with the rule you want it to do. Met vriendelijke groet, Kind regards, Marco Teelen Systemec BV -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of William Van Hefner Sent: vrijdag 21 oktober 2005 10:27 To: [email protected] Subject: [sniffer] Adding Rules? Pete, I know that with Sniffer we have the ability to delete certain rulesets, but would it be possible to add a "custom" rule for our server? Right now, we are getting hit pretty hard with Russian Cyrillic spam. While this SHOULD be easy to stop in IMail, every single rule I have created in IMail has failed to stop the spam. Both IMail and Postfix use pretty much the same Regular Expressions, and I am able to stop 100% of this spam from getting through our Postfix box using the following rule: /charset="windows-1251"/ REJECT In IMail, the rule to accomplish the same thing should look something like: h~windows-1251:NUL Unfortunately, it does NOT work. I have tried numerous incarnations of the same rule, but IMail simply refuses to stop any of it. Is there a way that we could have a rule that looks for windows-1251 in the subject line and tags it as spam? Thanks much. FYI, even though the actual Imail server's IP address does not have an MX record, these Cyrillic spammers seem to be one of the few spam gangs clever enough to bypass all of our official MX records and deliver straight to the IMail server. We will be dumping IMail in the near future, due to its inability to stop these spams (among other reasons). In the meantime, it would be extremely helpful if we could use Sniffer to block this stuff. William Van Hefner Network Administrator Vantek Communications, Inc. 555 H Street, Ste. C Eureka, CA 95501 707.476.0833 ph This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
