Scanning for Spam

[Scott Silva]

am.lists spake the following on 2/8/2007 3:19 PM:
> We've all seen the "investor alert" messages.
> 
> Thanks to Fuzzy OCR, I'm not getting them any more. The OCR scanning
> is picking them all up is very effective.
> 
> But now, I'm seeing the plain text ones coming in. I know, I'm getting
> pretty greedy to expect a 100% effectiveness rate of my spam
> filtering, but it seems it should be possible to stop this stuff.
> 
> My question for the list....
> 
> What is the consensus method for rolling these to a halt?
> 
> -- Are you tweaking existing rules that center on dial-up lists, bogus
> helo, invalid reverse dns?
> -- Are you using MCP for words like "investor" and other keywords?
> 
> I'm currently using pyzor, razor, dcc, rules du jour, and fuzzy ocr
> (with all [or most] of its plugin/helper apps).
> 
> Thanks in advance.
> 
> 
> Angelo
With good rules and the digests you have enabled, you should be catching most
of them. You might get a few at first until the they get reported to the
digests. The only other thing you could do is use a good blacklist or two at
the MTA.
I think you would be closer to unreasonable to expect 100% spam blocking, but
there is one way. Reach behind the server and unplug the network cable. That
is probably the only way to reach 100%, although you should easily be able to
get into the low to mid 90's.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!