Thanks. John Tolmachoff Engineer/Consultant/Owner eServices For You
> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Pete McNeil > Sent: Wednesday, August 04, 2004 10:14 AM > To: John Tolmachoff (Lists) > Subject: Re[8]: [sniffer] Rule Strengths > > On Wednesday, August 4, 2004, 1:04:59 PM, John wrote: > > JTL> Once I get the alises set up, what I can do is for former employees of the > JTL> client, I can set up a user with a 1kb mail box size, then use the nobody to > JTL> catch all those and send to a spam trap or such. > > A few words of caution... Old employee mailboxes were once legitimate. > This means that they may get legitimate messages - so you must be very > careful... It's good to let these go for a good long time before > putting them in place as any kind of spamtrap... You also want to > avoid creating a spamtrap than anyone can easily predict because it > can be poisoned. > > That said, if the traffic in these accounts is all spam - then they > are good candidates. > > In our system we will review every message that gets past the filter > so you should be safe if the occasional legitimate message shows up - > that will just force us to use "abuse" rules rather than spamtrap > rules. > > Another thought about the nobody alias. We've had some experience with > this--- having set up the nobody alias on a few systems and then > watched them fill up with dictionary attacks, we were then able to > turn on a few specific addresses from the attacks as spamtraps and > turn off the nobody alias. > > If you keep the nobody alias on you will most certainly see a growing > spam load - you may not want this. > > Here's a helpful reference. > > <http://www.sortmonster.com/MessageSniffer/Help/SpamTrapHelp.html> > > I will send you a collection point address off list. > _M > > > > > > This E-Mail came from the Message Sniffer mailing list. For information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
