That's another thing I want to see in a "next generation" MTA; I want to incrementally punish a message that is destined for multiple addresees who are not in my addresss book.
Right now, I can manually do it because I have a gateway scenario, so all addresses are currently allowed by the MTA. I then have a Declude JunkMail Pro filter that adds weight when certain unlikely names are in the ALLRECIPS. That technique will go away for me when I actually implement envelope rejection. Why? Oh, that's because most of the spam I see that throws extra, guessed, recipients in does so in the BCC line, they don't appear in the header. So if I have envelope rejection in the MTA, when Declude sees the message, it has no idea that there were extra, bogus recipients in the original recipient list. Andrew 8) -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, February 11, 2005 6:15 AM To: [email protected] Subject: [Declude.JunkMail] Multiple Duplicate Recipients Hello, All, A type of "obvious" spam that we receive has the same recipient listed multiple times in the X-Note: Recipient(s): field, e.g. X-Note: Recipient(s): [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] When I see this in the headers I know immediatelty that is spam. It would be great if Declude could have a test built into it in which you could punish e-mail if it had x number of multiple duplicate recipients. If this functionality does not exist I would like to put in a development request for it. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] ------------------------------------------------------------------- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
