Have you tried content blocking on the URL's in the body? Or checked the from or RDNS ranges to see if they have anything in common? Usually, when I've seen this, it is one new spammer, shoving out as many as possible before their new IP is known and blocked.
K > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Karl Hentschel > Sent: Monday, August 18, 2003 1:23 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Increased SPAM not being blocked. > > > Over the past several weeks our level of spam has doubled and a good > majority of it isn't failing enough tests to be blocked based on my > settings. The problem is that a good deal of it isn't failing ANY tests or > only helobogus and ipnotinmx. I can't really block on helobogus > or ipnotinmx > alone because I would have a great deal of false positives. One > test that a > few of the emails fail is SBL. Is anyone effectively blocking on > SBL alone? > Are there any other methods being used other than the declude > tests? I have > tried using keywords but it tends to generate too many false positives. > There are a few people who are receiving over 30 spams a day and that is > just unacceptable considering we are running antispam software. Any > suggestions would be appreciated. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] > > --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
