Good morning
Cloudmark's Spamnet does something like that. When installed on a
machine it collects data on the incoming mail from all the thousands of
clients that are running spamnet and continiously updates a database. It
also is now supporting sender id according to their website.
www.cloudmark.com
I running it here and of the 5 different systems we have used, it has
been by far the most effective.
We are not associated in any way with Cloudmark, just a very happy user.
-----Original Message-----
From: owner-spf-discuss(_at_)v2(_dot_)listbox(_dot_)com
[mailto:owner-spf-discuss(_at_)v2(_dot_)listbox(_dot_)com] On Behalf Of Chris
Haynes
Sent: Monday, August 16, 2004 7:41 AM
To: spf-discuss(_at_)v2(_dot_)listbox(_dot_)com
Subject: [spf-discuss] Co-operative 'bulk mail' alerting
It occurs to me that receivers with large numbers of
subscribers (AOL, MSN etc.), by caching and monitoring the
source IP address of received messages for a few minutes, can
alert themselves to probable sources of spam, viruses, etc. I
think I've seen AOL say that they do this as part of their
battery of anti-spam activities.
Those of us with smaller domains cannot gain the same
advantage from such an alerting process - it needs 'scale'.
It occurs to me to form a 'club' of small-scale MTA
operators. We find a way of collating current observed
activity, so that we can jointly be warned that a host is
spewing out large volumes of mail.
I don't plan any judgements about the messages, no spam vs.
ham decisions, no long-term history.
Just something very simple with, say, a 1 hour time horizon.
There may be some advantage in including in the alert details
of any SPF test results relating to the source.
This is much simpler and light-weight than GOSSiP.
I'm not asking at this time for comments on feasibility,
desirability, etc.
My one question is: Does anyone know of anything like this
that's already out there?
Thanks
Chris Haynes
-------
Sender Policy Framework: http://spf.pobox.com/
Archives at http://archives.listbox.com/spf-discuss/current/
http://www.InboxEvent.com/?s=d --- Inbox Event Nov 17-19 in
Atlanta features SPF and Sender ID. To unsubscribe, change
your address, or temporarily deactivate your subscription,
please go to
http://v2.listbox.com/member/?listname=spf->
discuss(_at_)v2(_dot_)listbox(_dot_)com