Jari Fredriksson wrote:
This looks worrying. I have it at 2.2 pts, and not caused any false positives,
but still, odd. Or is it? I know it is a SPAM indicator but a bulk indicator.
But it is triggered for example by some mailing list posts which are genuine
and not bulk.
and, fyi, if you have the commercial version of dcc, and not using
mark's new DCC.pm from the 3.0 alpha, the commercial version might
trigger a 'hit' if the reputation of the sending ip is > 20%
(as in, 20% bulk rate)
and, yes, you are ALWAYS told to whitelist your legit marketing lists
for dcc. either by ip, or something that can't be forged.
as an example, this mailing list scores 3%
http://www.rhyolite.com/cgi-bin/reps.cgi?tgt=140.211.11.3
MOSTLY BECAUSE THE SA ADMINS READING THIS LIST, either whitelisted the
list or don't use DCC.
(which still shows that 3% of you are still reporting this list as
'bulk'. )
--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259
> *| *SECNAP Network Security Corporation
* Certified SNORT Integrator
* 2008-9 Hot Company Award Winner, World Executive Alliance
* Five-Star Partner Program 2009, VARBusiness
* Best Anti-Spam Product 2008, Network Products Guide
* King of Spam Filters, SC Magazine 2008
_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
_________________________________________________________________________
