-Pete

Can I use
<header name='X-AOL-IP:' received='aol.com [' ordinal='0' />

for the AOL header:
X-AOL-IP: 213.55.79.58



-----Original Message-----
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Pete
McNeil
Sent: Monday, December 06, 2010 2:31 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Large amount of hotmail, msn, aol, yahoo and
other free account blacklisted servers


On 12/6/2010 2:47 PM, Colbeck, Andrew wrote:
> I have the same position as Scott.
>
> I find that the MessageSniffer product from ARM Research is the most
reliable test

<snip/>

> Hotmail in particular would be less effective for the bad guys if I had an
antispam tool that would determine from the headers that the sender was from
Hotmail (or others) and then check the
>
> X-Originating-IP: [111.222.333.444]

<snip/>

> I've suggested it before but vendors are, quite reasonably, leery of
building into their product a feature that is specific to a few providers
while being prone to false positives.

Actually, if I may, Message Sniffer has precisely that feature built 
into GBUdb training.

Specifically, you can tell Message Sniffer to identify the source IP for 
the message based on the presence of a specific header. This feature was 
designed specifically for hotmail and other systems that provide a 
source IP for one reason or another -- (perhaps complex internal routing).

For configuration information see:

http://www.armresearch.com/support/articles/software/snfServer/config/node/g
budb/training/source.jsp
http://www.armresearch.com/support/articles/software/snfServer/config/node/g
budb/training/source-header.jsp

If you configure this training mechanism for GBUdb in your Message 
Sniffer engine then GBUdb will become much more accurate for messages 
coming through that source.

Best,

_M


-- 
Pete McNeil, President
MicroNeil Research Corporation
www.microneil.com
703.779.4909
x7010




---
[This E-mail was scanned by Declude]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





---
[This E-mail was scanned by Declude]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to