The more solid the basis for the rules, the higher the score I can give to the test. Most spammers nowadays will have a time that is only off by a few hours when they hard code the headers for a zombie attack, however once you start getting out several days, or even months or years, the likelihood that this is not spam increases. There's no good rule of thumb IMO.
Scott from Declude has been testing this idea out for several months now without releasing the functionality to the public, probably because it's unreliable I'm thinking. It it was to be scored, I would much rather it be separate from other tests.
Matt
Herb Guenther wrote:
At one time we had floated the idea of a rule that would mark any email that was more than 24-48 hrs ahead or behind the actual current time and date as spam. I just got two "You've been invited to a blind date" messages that were dated last summer. 99.9% of these off date messages are spam, and anyone real who has there date that far off should fix it.
Would it be hard to add such a rule to sniffer?
Herb
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
This E-Mail came from the [EMAIL PROTECTED] mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
