|
Gotcha. Thanks, Matt.
I have another one: Adding a line to record
sender IP/hostname to the log. Could be useful both for log reports
and for building our own sender lists.
Also, I've been thinking of some additional tests
and considering writing some external tests where needed.
1. If sender address is an ISP (requires a
lookup from a known ISP) and from address is another ISP (also determined from a
lookup), then fail the test. Could help identify forging spam.
Main task here is really just building the list of known ISPs.
2. If domain is newly registered
(configurable), fail the test. Could help identify spammers who constantly
are registering new domains. I think I remember this idea being discussed
on the list within the past couple of months, but I don't know if anyone has
implemented anything.
3. if sender name matches first part of email
address (e.g. sender is joe [x.x.x.x], while recipient email address is [EMAIL PROTECTED]) then fail the test. Could
help idenify forging spam.
Lastly, what are people using for honeypots?
I'm assuming most are using program aliases in IMail to extract the info from
the emails to build blacklists. Are there any existing solutions
to this or is everyone building them from scratch each time? I'd be
interested in putting together an IMail/SQL Server/DNS-BL system.
Thoughts? Darin. ----- Original Message -----
From: Matt
Sent: Sunday, May 16, 2004 1:40 PM
Subject: Re: [Declude.JunkMail] Logging change request Matt Darin Cox wrote:
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ ===================================================== |
