IP address reputation, BorderWare
itdept at fractalweb.com
Fri Mar 23 18:11:38 CET 2007
Rick Chadderdon wrote:
> Which is nearly always the case in a "flood". I don't recall ever
> seeing a spam flood that consisted of ten thousand different spam
> messages to the same name. Ten thousand different names on the same
> domain? All of the time. Even if address reuse in a flood *were*
> common, your response would only apply if all milters and other methods
> for doing SAV cached the lookups.
My understanding is that milters like SMF-SAV do cache the lookups. So
if one of your users gets "joe-jobbed" and a spammer sends 10k messages
to our server, a server using SAV only check the address once, and use
that data to deal with the rest of the flood.
More information about the MailScanner