>I was wondering if you could add a new test to Declude JunkMail? This test
>could be called "similar addresses".
>
>If someone sends a message to multiple addresses and the "to", "cc" or "bcc"
>of all the addresses contain "helpdesk@" then I'd think it's a pretty good
>bet that it's a spam message.
It is something that we have been considering, but haven't made a decision
on yet.
Note that the Bcc:'s won't be visible to Declude, so only the To: or Cc:
header could be used. Looking at our spamtraps, it looks like only a small
portion (perhaps 5% to 10%) of the spam is sent with the multiple addresses
in the To:/Cc: headers. Making it less useful is that often they are
similar-but-not-exact names -- such as "john123@", "john128@", "johnny@",
... which would either minimize the usefulness of the feature, or require
somewhat sophisticated testing to determine if the addresses were similar
(which could result in too many false positives if not done well).
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
