Scott, I can't remmeber exactly my suggestion (as said it was around two years ago) but I've made a similar research as you in the logfiles in order to go sure that the HH-SS / SH-SH ratio would be good enough to consider it a valuable option for some points in the weighting system.
There are more values that can be compared: HELO REVDNS MAILFROM COUNTRY ... There are many zombies out who send messages with randomly selected/generated values. If there is a message with HELO xy.domain.de REVDNS xy.domain.net MAILFROM [EMAIL PROTECTED] and COUNTRY shows Mexiko as origin then it maybe should be possible to add something like 20 - 40% of your hold weight to the final weight of this message. Markus > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Scott Fisher > Sent: Monday, September 04, 2006 5:15 PM > To: declude.junkmail@declude.com > Subject: Re: [Declude.JunkMail] Test idea > > I ran a query on this looking at my August email results > (228889 emails): > > Excluding HELOBOGUS > Excluding (timeout) and [No Reverse DNS] and (Private IP) > Looking at last 4 chars of helo <> last 4 chars of revdns > > 1487 ham: > including gov / us mismatches > a fair amount of .com / .org with DSL / CABLE static revdns > small amount of valid mismatches shaw.ca / shawcable.net > mindspring.com/earthlink.net. I've definitely seen this from > some non US mailservers where a country code is in one and > .net is in another. > > 19668 spam > lots of zommbies,especially non-US > Fair amount of static spammers .net / .info mismatches for example > > ----- Original Message ----- > From: "John T (Lists)" <[EMAIL PROTECTED]> > To: <declude.junkmail@declude.com> > Sent: Monday, September 04, 2006 1:29 AM > Subject: [Declude.JunkMail] Test idea > > > > Idea! (Ouch) > > > > If email failed HELOBOGUS or NOREVDNS (or other specified tests) END > > otherwise compare the last 3 characters of the HELO with the last 3 > > characters of the REVDNS and if not match add say 1/5 or so of HOLD > > weight. > > > > Thoughts, comments, boos, yahs, Go back to sleep (Can I Please?) > > > > John T > > eServices For You > > > > "Seek, and ye shall find!" > > > > > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
