Hi Kami, Yes you're right. I haven't thought until now to forward messages automaticaly. Probably you can provide some info's on how to forward messages to different spam db's (destination adress, forward the entire message or only the data from the new declude variables ...)
Probably this shouldn't do everyone around the world that has running a spamfilter but I think it can be helpfull here in my zone (between Italy and Germany) Most of the spam messages that are able to pass our filters are from this zone and I see very few of them listed on a spam db. Even if all forwarded messages from our system will count only as a single "vote" it's yet one step forward. About forwarded false positives: In the last 30 days we've stopped 10060 spam messages. 20 of them was false positives. ( ~ 0.2 %) 15 of this fp's was between 100 and 115% of the hold value. So if we forward only messages over 115% of the hold value we've a false reporting rate of around 0.05% Markus > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan > Sent: Saturday, March 22, 2003 6:32 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] 1.68 - new variables > > > Markus... > > While a grand idea and one that we did for a while but we > learned via this group that in practice it may cause problems. > > Once someone in this group posted a message with a lot of the > words associated with the postcard spam that was going > around. It scored so high in our system that the message was > automatically sent to Spamcop. > > We had our system set for a certain weight to forward the > message to spamcop. Oh well... After that incident we > changed it since the consequence of a false positive was too much. > > Of course now we have Whitelisted this list in our system and > have never seen a false positive at that high scoring level. > > Just a thought and experience that may be worth considering.. > > Regards, > Kami > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler > Sent: Saturday, March 22, 2003 3:33 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] 1.68 - new variables > > > > > %IP4R% inserts the IP address in the format for ip4r-style spam > > databases (if the IP is 192.0.2.25, it will return 25.2.0.192). > > %RHSBL% inserts the "Right-Hand-Side" information from the > > return address > > ("declude.com" for "[EMAIL PROTECTED]") > > %MAILFROMBL% will return the "MAIL FROM" data in the format > > needed for spam > > databases ("horizons.declude.com") > > %HELO% inserts the HELO/EHLO data that the remote > mailserver reported > > > Sound like this var's can be used to send automated > notifications to spam databases...? > > I'm not sure if they want to recieve so much automated > messages. On the other side no human can be faster forwarding > a spam message. This could accelerate the listing of an > spamming server in the databases. > > Markus > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
