RE: [sniffer] Adding Rules?
Pete, Thanks so much. That Cyrillic spam was the one thing that I could never seem to get a handle on. I'll never understand why some regular expressions work fine in IMail, while others simply refuse to work at all, no matter how many different ways one tries to code them. It's nice to know that there are some programmers out there who still know what they are doing. :-) William Van Hefner Network Administrator Vantek Communications, Inc. 555 H Street, Ste. C Eureka, CA 95501 707.476.0833 ph > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > Sent: Friday, October 21, 2005 7:38 AM > To: William Van Hefner > Subject: Re: [sniffer] Adding Rules? > > > On Friday, October 21, 2005, 4:27:20 AM, William wrote: > > WVH> Pete, > > WVH> I know that with Sniffer we have the ability to delete certain > WVH> rulesets, but would it be possible to add a "custom" > rule for our > WVH> server? > > Yes. > > > > WVH> Unfortunately, it does NOT work. I have tried numerous > incarnations > WVH> of the same rule, but IMail simply refuses to stop any of it. Is > WVH> there a way that we could have a rule that looks for > windows-1251 > WVH> in the subject line and tags it as spam? Thanks much. > > Yes. I'm creating the rule for you now. > > _M > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Adding Rules?
On Friday, October 21, 2005, 4:27:20 AM, William wrote: WVH> Pete, WVH> I know that with Sniffer we have the ability to delete certain rulesets, but WVH> would it be possible to add a "custom" rule for our server? Yes. WVH> Unfortunately, it does NOT work. I have tried numerous WVH> incarnations of the same rule, but IMail simply refuses to stop WVH> any of it. Is there a way that we could have a rule that looks WVH> for windows-1251 in the subject line and tags it as spam? Thanks WVH> much. Yes. I'm creating the rule for you now. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [sniffer] Adding Rules?
Met vriendelijke groet, Nope. We use MxGuard. WVH > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Marco Teelen > Sent: Friday, October 21, 2005 1:40 AM > To: sniffer@SortMonster.com > Subject: RE: [sniffer] Adding Rules? > > > Hello William, > > I assume you also use Declude? > You can create a rule with Declude for this as well, we did > it ourselves since we got the same problems. > > In the global.cfg we made new rule "BAD-SUBJECT" which refers > to a text file. If a mail is positive it gets a certain extra > weight. In the text file we specified the following: > "SUBJECT 0 CONTAINS=?Windows-1251" > > In the "$default$.junkmail" this "BAD-SUBJECT" is specified > with the rule you want it to do. > > > > Met vriendelijke groet, > Kind regards, > > > Marco Teelen > Systemec BV > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of William Van Hefner > Sent: vrijdag 21 oktober 2005 10:27 > To: sniffer@SortMonster.com > Subject: [sniffer] Adding Rules? > > Pete, > > I know that with Sniffer we have the ability to delete > certain rulesets, but would it be possible to add a "custom" > rule for our server? Right now, we are getting hit pretty > hard with Russian Cyrillic spam. While this SHOULD be easy to > stop in IMail, every single rule I have created in IMail has > failed to stop the spam. Both IMail and Postfix use pretty > much the same Regular Expressions, and I am able to stop 100% > of this spam from getting through our Postfix box using the > following rule: > > /charset="windows-1251"/ REJECT > > In IMail, the rule to accomplish the same thing should look something > like: > > h~windows-1251:NUL > > Unfortunately, it does NOT work. I have tried numerous > incarnations of the same rule, but IMail simply refuses to > stop any of it. Is there a way that we could have a rule that > looks for windows-1251 in the subject line and tags it as > spam? Thanks much. > > FYI, even though the actual Imail server's IP address does > not have an MX record, these Cyrillic spammers seem to be one > of the few spam gangs clever enough to bypass all of our > official MX records and deliver straight to the IMail server. > We will be dumping IMail in the near future, due to its > inability to stop these spams (among other reasons). In the > meantime, it would be extremely helpful if we could use > Sniffer to block this stuff. > > > William Van Hefner > Network Administrator > > Vantek Communications, Inc. > 555 H Street, Ste. C > Eureka, CA 95501 > 707.476.0833 ph > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [sniffer] Adding Rules?
Hello William, I assume you also use Declude? You can create a rule with Declude for this as well, we did it ourselves since we got the same problems. In the global.cfg we made new rule "BAD-SUBJECT" which refers to a text file. If a mail is positive it gets a certain extra weight. In the text file we specified the following: "SUBJECT0 CONTAINS=?Windows-1251" In the "$default$.junkmail" this "BAD-SUBJECT" is specified with the rule you want it to do. Met vriendelijke groet, Kind regards, Marco Teelen Systemec BV -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of William Van Hefner Sent: vrijdag 21 oktober 2005 10:27 To: sniffer@SortMonster.com Subject: [sniffer] Adding Rules? Pete, I know that with Sniffer we have the ability to delete certain rulesets, but would it be possible to add a "custom" rule for our server? Right now, we are getting hit pretty hard with Russian Cyrillic spam. While this SHOULD be easy to stop in IMail, every single rule I have created in IMail has failed to stop the spam. Both IMail and Postfix use pretty much the same Regular Expressions, and I am able to stop 100% of this spam from getting through our Postfix box using the following rule: /charset="windows-1251"/ REJECT In IMail, the rule to accomplish the same thing should look something like: h~windows-1251:NUL Unfortunately, it does NOT work. I have tried numerous incarnations of the same rule, but IMail simply refuses to stop any of it. Is there a way that we could have a rule that looks for windows-1251 in the subject line and tags it as spam? Thanks much. FYI, even though the actual Imail server's IP address does not have an MX record, these Cyrillic spammers seem to be one of the few spam gangs clever enough to bypass all of our official MX records and deliver straight to the IMail server. We will be dumping IMail in the near future, due to its inability to stop these spams (among other reasons). In the meantime, it would be extremely helpful if we could use Sniffer to block this stuff. William Van Hefner Network Administrator Vantek Communications, Inc. 555 H Street, Ste. C Eureka, CA 95501 707.476.0833 ph This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
