Mailing List Archive

FS_REPLICA rule
hi guys ...

Do you now whats the purpose of this rule, and what sort of spams are
blocking by this mail...few legitimate mails block by this rule

##{ FS_REPLICA
header FS_REPLICA Subject =~ /replica/i^M
describe FS_REPLICA Subject says "replica"^M
##} FS_REPLICA



Thank You
Dhanushka
Re: FS_REPLICA rule [ In reply to ]
On Wed, 2012-05-02 at 17:30 +0530, dhanushka ranasinghe wrote:
> hi guys ...
>
> Do you now whats the purpose of this rule, and what sort of spams are
> blocking by this mail...few legitimate mails block by this rule
>
> ##{ FS_REPLICA
> header FS_REPLICA Subject =~ /replica/i^M
> describe FS_REPLICA Subject says "replica"^M
> ##} FS_REPLICA
>
>
At a guess, fake branded consumer goods, e.g. watches, handbags, shoes.
In short, the sort of items that poseurs wear without removing the
label.

Martin
Re: FS_REPLICA rule [ In reply to ]
On 5/2/2012 8:31 AM, Martin Gregorie wrote:
> On Wed, 2012-05-02 at 17:30 +0530, dhanushka ranasinghe wrote:
>> hi guys ...
>>
>> Do you now whats the purpose of this rule, and what sort of spams are
>> blocking by this mail...few legitimate mails block by this rule
>>
>> ##{ FS_REPLICA
>> header FS_REPLICA Subject =~ /replica/i^M
>> describe FS_REPLICA Subject says "replica"^M
>> ##} FS_REPLICA
>>
>>
> At a guess, fake branded consumer goods, e.g. watches, handbags, shoes.
> In short, the sort of items that poseurs wear without removing the
> label.

Also, you have an old version of the rule. You need to run sa-update to
update your rules. The current rules looks like this:

meta FS_REPLICA __FS_REPLICA && !FS_REPLICAWATCH
describe FS_REPLICA Subject says "replica"
header FS_REPLICAWATCH Subject =~ /replica watch\b/i
describe FS_REPLICAWATCH Subject says Replica watch
header __FS_REPLICA Subject =~ /\breplica\b/i

The new rules add a more specific check for "replica watch" and also add
boundary checking to the "replica" match to reduce false-positives.

--
Bowie