Ah alas it seems there are no perfect spam detection techniques. Not even human review!
> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Pete McNeil > Sent: Friday, October 01, 2004 3:09 PM > To: Kevin Bilbee > Subject: Re: [Declude.JunkMail] ContainsIP with RDNS check > > > On Friday, October 1, 2004, 5:16:26 PM, Kevin wrote: > > KB> I have been running my ContainsIP external test with a > reverse dns check and > KB> have found the following. I have not had one report of a > false positive in > KB> the 5 days I have been running this test. > > KB> If you are interested it can be found here with usage instructions > KB> http://www.ssc-isp.net/HoldAnalyzer/containsip.aspx > > KB> We receive about 3500 emails a day to our server. As you can > see a large > KB> amout of the messages fail the reverse DNS test when they > have an ip address > KB> in the HELO string. I am finding this to be a very good > indicator of spam. > > We have some message sniffer rules that take advantage of this. It is > a very strong methodology... not perfect, but very, very strong. > > _M > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
