-----Original Message-----
From: Pete McNeil [mailto:[EMAIL PROTECTED]
On Tuesday, November 30, 2004, 1:36:13 PM, Andrew wrote:
CA> Pete, could you recap for us how to set up a "Declude project" to
forward
CA> non-sniffer-detected spam to a custom spamtrap address at SortMonster?
CA> Perhaps two versions, one for normal spamtrap, and one for spam that
meets
CA> our chosen weight yet didn't trigger sniffer?
>
> I know that there are a few systems out there that have experimented
> with this, but I don't have the details on how to do it and they might
> require some very system specific configurations. It would be best if
> someone who has done this could document it for us and then we will be
> pleased to post the instructions on our site for future reference.
>
CA> I can piece together snippets myself, and I know there's a good spamtrap
CA> writeup on your website, but a cookbook would be timely!
>
> I agree. Sorry I don't have that information right now.
>
CA> I've been thinking about this as I've found spam that was triggering the
CA> CMDSPACE test in Declude, but didn't trigger SpamCop or Sniffer (my two
most
CA> reliable and frequently triggered tests).
>
> This kind of "virtual spam trap" is a very interesting idea. I'm not
> sure that there are any configurations that are mature enough to be
> generalized... but I hope so.
>
> If I understand you correctly, you are looking for a Declude
> configuration that forwards messages to a spamtrap address if they
> were considered spam by your Declude installation but did not fail a
> specific test - such as SNF.
>
> There is no direct way to do this, at least not that I am aware of,
> but I know there are a couple people who have been working on it.
If I understand correctly, here is what I do to forward mail that passes my
spam delete threshold but does not fail any sniffer rule group tests (I
recently posted this to the Declude JunkMail list):
==========
The first thing you need to do before setting up auto-forwarding of messages
to SortMonster is to ask them to setup a special spam-trap account for you
that you can forward these messages to (they will assign you a specific
e-mail address to use).
In your global.cfg, setup a specific weight test for special handling of
messages over a certain weight:
WEIGHT-SPAMBOX weight x x 36 0
In your $declude$.junkmail file, create a new ROUTETO action for this weight
test:
WEIGHT-SPAMBOX ROUTETO [EMAIL PROTECTED] (this is a local account on your
IMail server)
The configuration of the IMail "spambox" account is as follows:
1. Create the "spambox" e-mail account
2. Create two inbound filter rules for this account
a. Click "Add" on the "Inbound Rules" tab
i) Select Rule: "If Header Text"
ii) Select "Contains" radial button
III) Search Text: SNIFFER
iv) Check "Match Case"
v) Click "Ok"
vi) Select the "Delete" radial button
b. Click "Add" again on the "Inbound Rules" tab
i) Select Rule: "If Header Text"
ii) Select "Does not Contain" radial button
III) Search Text: SNIFFER
iv) Check "Match Case"
v) Click "Ok"
vi) Select the "Forward" radial button
vii) Enter the special e-mail address SortMonster assigns to you in
the "Address" field
c. Click "Apply"
All messages forwarded to this "spambox" account by Declude JunkMail that
contain the work "SNIFFER" in the headers will be deleted. All messages
that do not contain a the word "SNIFFER" in the headers will be forwarded to
the special e-mail address assigned to you by SortMonster.
=====
> As for sharing spamtraps with us in general, we are shifting in a new
> direction lately. Rather than having systems forward spamtraps to us
> as we have in the past, we now have our robots go and get spamtrap
> data from ordinary pop3 accounts. If you have a spamtrap on your
> system that you would like to share then please let us know the
> server, login, and password, and how the spamtrap was created so that
> we can rate it in our system. Sharing a spamtrap like this can
> accelerate our response to new spam that arrives on your system.
Pete, would you rather that I now drop these e-mails into a local POP
account instead of forwarding them to the special e-mail account you setup
for me?
Bill
-------------------------------------------------------------------------------
This message and any included attachments are from Siemens Medical Solutions
USA, Inc. and are intended only for the addressee(s).
The information contained herein may include trade secrets or privileged or
otherwise confidential information. Unauthorized review, forwarding, printing,
copying, distributing, or using such information is strictly prohibited and may
be unlawful. If you received this message in error, or have reason to believe
you are not authorized to receive it, please promptly delete this message and
notify the sender by e-mail with a copy to [EMAIL PROTECTED]
Thank you
This E-Mail came from the Message Sniffer mailing list. For information and
(un)subscription instructions go to
http://www.sortmonster.com/MessageSniffer/Help/Help.html
