Hi John,
What is my best bet - jack up
the score a number of points for any mail coming from 86 & 87? Many of the
messages hardly trip any of the regular tests.
Wouldn't hurt - use blackholes.us and maybe score 40% of your hold
weight? I would say though blocking a /8 is not a good idea. way too
many false positives.
My first question is why the leakage? My guess would be a new spam
campaign that eventually will leak from other blocks. So first maybe
figure out how to score these on header / body content, etc . Next
examine the ip's that they are coming from and selectively block
accordingly.
Here are 2 blocks I have tagged in that range -
86.59.128.0 255.255.252.0 esnet.com ROKSO 20-May-2005 01:27 GMT
86.111.128.0 255.255.240.0 ROKSO Boris Mizhen
Don't be discouraged. There will be a new campaign tomorrow :)
-Nick
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
