{Spam?} Potential use for custom SPAM action ?

[Dhawal Doshy]

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> bounces at lists.mailscanner.info] On Behalf Of UxBoD
> Sent: Monday, July 30, 2007 1:33 PM
> To: MailScanner discussion
> Subject: {Spam?} Potential use for custom SPAM action ?
> 
> Have been thinking what I could use this for and have this idea.  Using
> the idea from
> http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:rbls:a
> ll:your_own_onemore&s=rbl how about if a certain SA score is achieved
> then it would write into a MySQL table the IP, time, delta seconds
> since last seen and count. If count > n times then write into the RBL
> the IP.

The data already exists in mysql (maybe not the count, been too long since I did this).. To achieve what you want, simply modify some values in your spam.sec

This line defines your required score for pattern matching.
pattern=Message (\S+) from (\S+) (\S+) to (\S+) is spam, SpamAssassin .*cached, score=(\S+), required 5

The "9" out here is your high scoring spam value
context= =( scalar($5) > 9 )

The time span in seconds in a shifting window.
window=60

The number of times a pattern matches in the above time span
thresh=3

Let me know if you need more answers (and make sure to whitelist as Ken mentioned)

- dhawal