On Sunday, June 13, 2004, 11:49:21 PM, Matt wrote: M> Pete,
M> I've been seeing a good deal of Experimental hits on bounce messages, M> primarily with the Nazi spam that has been forging recipients, but I've M> seen these on other messages that seemingly don't have any spam content, M> though most of course do involve spam. M> I was wondering if this is due to IP's being logged for spamtrap hits M> from these bounces, or if it was due to something else. If these are IP M> related, it would likely be problematic. There may be a few IPs involved but I suspect it's a new message-id rule we have in place. It seems that the Nazi spam is delivered with a forged qmail header that qmail would never produce. The rule is somewhat broad so we've left it in the experimental group - just in case something about it turns out to be problematic. Most of the Nazi spam rules are actually coded for known subjects and generalizations of these. M> And another related question regarding the Nazi spam. Would it be M> possible to move these rules from Experimental to another category such M> as Malware or General? Personally I have grown accustomed to M> Experimental being a category for rules that are not as reliable and M> more likely to hit on personal E-mail so I weight it low, on the other M> hand this Nazi stuff is certainly problematic and I'm hoping that your M> rules are tight enough to place in another category. I do have a filter M> that deals with bounce messages from Joe-Jobs by testing for both a M> Sniffer hit or other content related filter along with indications of a M> null sender or other sign of a bounce, but I was excluding M> Sniffer-Experimental from this. It's a close call but I think the rules we have are in the right places - at least for now. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
