What we have done is weigh negatively the sum of those tests for these two domains (Yahoo, Hotmail).
We have a list of any free domains that we have received mail from. The free sites we add 5 to start with. [I can send you the list if you want] The Hotmail and Yahoo spam are typically caught by a lot of other tests such as body filters. Basically we have created a filter for all the URL's that are used in the spam and weigh them if they occur. Combination of these has reduced the spam to almost 1 or 2 a week (even if that). We do not use Sniffer.. So far have not found any need for it since we have an extensive filter file for URL addresses that appear in spam. (I can have it sent to you if you want). For Base64 tests we have basically made the weight enough such that if any other tests are failed, or if it is coming from any free email address then it will be held for review. Regards, Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mark Smith Sent: Thursday, January 09, 2003 11:32 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc... What is everyone doing about Hotmail, Yahoo, Juno and other web-based mail systems? It's really a catch-22. Hotmail is so frequently listed on RBL's and is a large source of spam but it's also a large source of legitimate email. They all seem to fail postmaster and abuse so they're already at 6-8 points on most peoples Junkmail. You can't whitelist them, and the RBL's usually send them over the edge. I use Sniffer so I've thought about adding a rule for hotmail, yahoo, etc to subtract the sum of postmaster and abuse and let message sniffer do some magic on these sites. Thoughts? --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
