spf-discuss
[Top] [All Lists]

Re: related to "mxout": a 3-step antispam rule that stops zombie spam

2004-04-21 17:07:38
On Wed, Apr 21, 2004 at 11:29:34PM +0000, Mark wrote:
I would like to mention that our single most successful antispam
rule at Pobox is "does it look like a broadband host". We can tell if a
machine is a broadband host simply by checking if the hostname
contains the IP address. Broadband machines usually PTR to
something like

FYI, I did a quick test using my own corpus of mail.  Looking for the
IP in PTR or if the PTR matches "^h[a-f0-9]{12}" results in a decently
high FP rate:

 25.640  25.8214   1.7344    0.937   1.00    0.01  T_BROADBAND_RCVD_FIRST

Which basically says, 25.8% of spam, 1.7% of ham, overall accuracy
of 93.7%.

-- 
Randomly Generated Tagline:
"If I want to hear the pitter patter of little feet, I'll put shoes on my
 cats." - Unknown