[sniffer] rule idea

2004-02-17 Thread Herb Guenther 
At one time we had floated the idea of a rule that would mark any email 
that was more than 24-48 hrs ahead or behind the actual current time and 
date as spam.  I just got two You've been invited to a blind date 
messages that were dated last summer.  99.9% of these off date messages 
are spam, and anyone real who has there date that far off should fix it.

Would it be hard to add such a rule to sniffer?

Herb

--
Herb Guenther
Lanex, LLC
(262)789-0966x102 Office
(262)780-0424 Direct
This e-mail is confidential and is for the use of the intended recipient(s) only.  If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way.  

This E-Mail came from the [EMAIL PROTECTED] mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html

Re: [sniffer] rule idea

2004-02-17 Thread Matt 
Please don't, my Grandmother probably couldn't get through then :)

The more solid the basis for the rules, the higher the score I can give 
to the test.  Most spammers nowadays will have a time that is only off 
by a few hours when they hard code the headers for a zombie attack, 
however once you start getting out several days, or even months or 
years, the likelihood that this is not spam increases.  There's no good 
rule of thumb IMO.

Scott from Declude has been testing this idea out for several months now 
without releasing the functionality to the public, probably because it's 
unreliable I'm thinking.  It it was to be scored, I would much rather it 
be separate from other tests.

Matt



Herb Guenther wrote:

At one time we had floated the idea of a rule that would mark any 
email that was more than 24-48 hrs ahead or behind the actual current 
time and date as spam.  I just got two You've been invited to a blind 
date messages that were dated last summer.  99.9% of these off date 
messages are spam, and anyone real who has there date that far off 
should fix it.

Would it be hard to add such a rule to sniffer?

Herb

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
This E-Mail came from the [EMAIL PROTECTED] mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html