The world doesn't run on Outlook Express. :)
Hopefully some use in production will prove me wrong. It's a good idea, I'm just not sure how much we can rely on the everyone using perfectly-formatted stuff like that .. *shrugs*
Jonathan
At 05:06 AM 1/7/2004, you wrote:
Scott,
It took about 1 minute to figure out that this will be a very valuable test as I'm seeing similar hit rates. What matters most though is the type of thing that will FP, and what other tests will generally fail along with it. I'm guessing that an FP with CMDSPACE will probably also tend to FP with BADHEADERS, and I might need to balance that out. Could you describe that one FP that you found so that I know what to look out for? Was this an instance where some small-time newsletter sender was using the same bad software that the spammers use, or was it something else like some Web script? If it's really rare and tied to an X-Mailer, maybe we could counterbalance it with a filter???
Regardless, it appears that the FP rate of this thing will far out perform any other technical tests as well as the hit rate. That's HUGE!
Thanks,
Matt
R. Scott Perry wrote:
We've just added a new test to the latest interim release, called CMDSPACE. This one looks for spaces in SMTP commands where there shouldn't be any.
It is catching about 75% of the spam to the spamtraps here, and since we started using it, only 1 of the approximately 500 legitimate E-mails that came in was caught. It looks like this could be a good test until spammers change their spamware.
To use it, you need the latest interim release (from http://www.delude.com/interim ), and need to use the following line in your \IMail\Declude\global.cfg file to define the test:
CMDSPACE cmdspace x x 8 0
(where "8" is the weight you want to assign to the test).
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
