[Mimedefang] Discard by $Subject

[Paul Murphy]

OK, I'm confused - 

> Do it in sendmail.mc. e.g. something like:
 
We're discussing this on the MIMEdefang list, we have a tool which will allow
a very simple three-line piece of code to do the job, and we can use
pre-existing SpamAssassin rulesets and bayesian filtering to both identify
and learn from the spam....

The simple approach is:

in filter_begin:
  if ( $Subject =~ /Ultimate Online Pharmaceutical/i ) {
    md_graphdefang_log('drug_spam'); # optional and user-specific logging
    return action_discard();	
    # or bounce, if you're sure the sender isn't spoofed or owned
    }
Note that this is a very specific check for a very specific problem, and if
you take this approach with every leak, you'll end up with a massive filter
file which takes too long to run.

Alternatively, and my preferred option, have a look at Rules Du Jour
(http://www.exit0.us/index.php?pagename=RulesDuJour), and include the
ANTIDRUG set at the very least - I'd advise using all of them unless you have
a specific reason not to.  These tweak the base SpamAssassin rules to include
a large number of very useful extras, and it will also update them on a daily
basis to keep you up to date with the latest scams and spams.

Best Wishes,

Paul.