On Sunday 07 July 2002 22:20 CET Andrew Kohlsmith wrote: >[...] > > For both the ISP I help at and also the company who pays my bills there > is a large amount of spam which is sent to a large number of people at > the same domain. Now I know SA has tests for "similar" email addresses > but IIRC it only checks the user part of the address (i.e. > -->user<--@domain) -- perhaps another test that that checks the other > end?
And you gave me another idea: SpamAssassin could track it's own table with checksums of mails it saw. If it received one mail more than, let's say, four times in three days then this mail is probably a mass mailing. This makes most sense for (big) companies/organizations where SA looks at each user's mails. I see three problems with this table: o The table will grow quite big quickly. The bigger the organization the bigger the table. o If some users subscribed to the same mailing list then every message to this list will score. This can be avoided by ignoring mails (a) send by mailing list daemons (Matt already started collecting such signs in bug 511 [1]) (b) have Precedence: bulk (every good mailing list daemon should set this) (c) have a whitelisted originator. o The spammers' unique ids could break it. I f'uped to sa-devel as this idea should be discussed there. >[...] Malte [1]http://bugzilla.spamassassin.org/show_bug.cgi?id=511 -- -- Coding is art. -- ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek We have stuff for geeks like you. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
