I agree with you. This is one of the key reasons we developed Message Sniffer (www.sortmonster.com) which categorizes spam not by it's source, but rather by the content of the message. There are two key results from this approach:
1. If/when a spammer is discovered abusing a system and is shut down, simply moving to a different open relay will not allow them to get their message through... they must in-stead change their message - which is expensive for them and is likely to cause their message to be a less affective marketing tool. 2. The operator of a system does not necessarily suffer "collateral damage" as the result of being compromised by a spammer because other content from their system will not typically be trapped by Message Sniffer. As you point out, source based systems frequently cause collateral damage and open the door to a new kind of DoS attack depending upon the security and policies of the databases in use, and their footprint in the internet community. IMHO, source based tests have their place but must be carefully tempered with judgement as they are very "blunt" instruments. _M | -----Original Message----- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]]On Behalf Of Matthew Lohr | Sent: Thursday, February 28, 2002 4:40 PM | To: [EMAIL PROTECTED] | Subject: RE: SPAMCOP:Re: [IMail Forum] Spamcop | | | i have one question on this. What if there are multiple domains | on one ip address and only one of those domains is sending out | spam. Then all the domains are essentially listed because of one | bad apple right? How is this good then. I wouldn't want to be | one of the people on another virtual domain that got screwed or | is this not a possible scenario | | | ---------- Original Message ---------------------------------- | From: "R. Scott Perry" <[EMAIL PROTECTED]> | Reply-To: [EMAIL PROTECTED] | Date: Thu, 28 Feb 2002 16:05:58 -0500 | | > | >>they may not actually base good mail on the ip address but the domain. | > | >Sorry, but that just isn't possible. | > | >The SPAMCOP test works by looking up the IP address -- that's the only | >thing that the SPAMCOP test knows about you. When Declude saw | your E-mail | >here, it asked SPAMCOP what it knows about "63.172.199.25". That's how | >most DNS-based spam lookups work (there are a few that use | domains, such as | >http://www.rfc-ignorant.org , but that's the exception). | > | >Technically, they could look at the domain and find the MX records, and | >increase their count of legitimate mail, but that would be silly. Since | >they know the IP address sending the legitimate mail, why not | just increase | >the count of legitimate mail for the server that sent it? | > | >>Which doesn't make sense to me - but then most of spamcop | >>does not make sense to me. | >> | >>I stand by that it is a flawed system. | > | >Yes, it does have some flaws. Personally, I think that they | should have a | >variable legit-to-spam ratio (so that people could choose to only block | >mail if a mailserver was sending out 100% spam), and it would be nice if | >they had an easy way to get out once the problem was solved. But other | >than that, I think it's an excellent test, especially when used in | >conjunction with other tests. | > | > -Scott | >--- | >Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for | >IMail. http://www.declude.com | > | >--- | >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > >Please visit http://www.ipswitch.com/support/mailing-lists.html >to be removed from this list. > >An Archive of this list is available at: >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > ________________________________________________________________ Sent via the WebMail system at lohrtech.com Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
