RE: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc...
What we have done is weigh negatively the sum of those tests for these two domains (Yahoo, Hotmail). We have a list of any free domains that we have received mail from. The free sites we add 5 to start with. [I can send you the list if you want] The Hotmail and Yahoo spam are typically caught by a lot of other tests such as body filters. Basically we have created a filter for all the URL's that are used in the spam and weigh them if they occur. Combination of these has reduced the spam to almost 1 or 2 a week (even if that). We do not use Sniffer.. So far have not found any need for it since we have an extensive filter file for URL addresses that appear in spam. (I can have it sent to you if you want). For Base64 tests we have basically made the weight enough such that if any other tests are failed, or if it is coming from any free email address then it will be held for review. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mark Smith Sent: Thursday, January 09, 2003 11:32 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc... What is everyone doing about Hotmail, Yahoo, Juno and other web-based mail systems? It's really a catch-22. Hotmail is so frequently listed on RBL's and is a large source of spam but it's also a large source of legitimate email. They all seem to fail postmaster and abuse so they're already at 6-8 points on most peoples Junkmail. You can't whitelist them, and the RBL's usually send them over the edge. I use Sniffer so I've thought about adding a rule for hotmail, yahoo, etc to subtract the sum of postmaster and abuse and let message sniffer do some magic on these sites. Thoughts? --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc...
The way I have it configured, they will end up with a weight of 8 and we hold at 20, so they would have to fail a test like SPAMCOP or NOXMAIL or one of our major filters to be held. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc...
We use Declude standard weights and add 15 for ones that fail SortMonster tests. We hold on weights over 30 and I don't think we've caught legitimate mail from these sources for sometime. Our only real fine tuning was to negative weight some email domains (below). We don't use any kill lists at all. MAILFROM -10 CONTAINS @talk21.com MAILFROM -10 CONTAINS @passport.com MAILFROM -30 CONTAINS @economist.com MAILFROM -100 CONTAINS .ft.com MAILFROM -30 CONTAINS @bbc.co.uk HEADERS 15 CONTAINS charset=GB2312 David WiSS Limited -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mark Smith Sent: 09 January 2003 16:32 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc... What is everyone doing about Hotmail, Yahoo, Juno and other web-based mail systems? It's really a catch-22. Hotmail is so frequently listed on RBL's and is a large source of spam but it's also a large source of legitimate email. They all seem to fail postmaster and abuse so they're already at 6-8 points on most peoples Junkmail. You can't whitelist them, and the RBL's usually send them over the edge. I use Sniffer so I've thought about adding a rule for hotmail, yahoo, etc to subtract the sum of postmaster and abuse and let message sniffer do some magic on these sites. Thoughts? --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc...
That's the problem... Hotmail is on and off of Spamcop every other day. We bounce at 12 and delete at 20. Spamcop is at 8 so I'll put in -8 for hotmail which will adjust for the nopostmaster and noabuse. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Thursday, January 09, 2003 11:59 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc... The way I have it configured, they will end up with a weight of 8 and we hold at 20, so they would have to fail a test like SPAMCOP or NOXMAIL or one of our major filters to be held. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc...
Agreed here - we've been working on various white-rules for these domains and each attempt has failed due to the amount of actual spam sourced from these servers. _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Mark Smith | Sent: Thursday, January 09, 2003 11:54 AM | To: [EMAIL PROTECTED] | Subject: RE: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc... | | | I'd stay away from IP's because they can change all of the | time. But the problem still is that actual spam comes from those IP's. | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of | Markus Gufler | Sent: Thursday, January 09, 2003 11:48 AM | To: [EMAIL PROTECTED] | Subject: RE: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc... | | | I'm not sure if I'm right with this: | Should it be possible to determine a list of IP-ranges from | the real outgoung smtp-servers of this popular domains, then | Declude probably can add a new test if this mail (using a | popular from domain) commes from one of this ip-ranges. | | Even if this ip-ranges are very wide (Class C or B) a lot of | spamming servers forging the recipients adress should be caught. | | Markus | | | | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of | Mark Smith | Sent: Thursday, January 09, 2003 5:32 PM | To: [EMAIL PROTECTED] | Subject: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc... | | | What is everyone doing about Hotmail, Yahoo, Juno and other | web-based mail systems? It's really a catch-22. Hotmail is so | frequently listed on RBL's and is a large source of spam but it's | also a large source of legitimate email. | | They all seem to fail postmaster and abuse so they're | already at 6-8 | points on most peoples Junkmail. You can't whitelist | them, and the | RBL's usually send them over the edge. | | I use Sniffer so I've thought about adding a rule for hotmail, | yahoo, etc to subtract the sum of postmaster and abuse and let | message sniffer do some magic on these sites. | | Thoughts? | | --- | [This E-mail scanned for viruses by F-Proto Virus Scanner] | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type | unsubscribe Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the | Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and | type unsubscribe Declude.JunkMail. The archives can be found | at http://www.mail-archive.com. | --- | [This E-mail scanned for viruses by F-Proto Virus Scanner] | | | | --- | [This E-mail scanned for viruses by F-Proto Virus Scanner] | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
