Steven Manross wrote: > For all interested.. I'm *NOT* looking to give this type of rule 5 > points. > > I want to give it something like .3 - .6 (but will play with it), as > noted by many, this isn't an indication of spam, but an indicator of a > possible spam-source. I believe that people who don't own their own > IP ranges, can be more likely to be spam-sources, whether by > misconfiguration, trojanned by some worm, or just some spammer that > changed ISPs every month because he gets shut down (I could only > hope), and reverse-lookup similarities seem to be a *good* indicator > of a "non-owned IP". > > I see everyone's concerns, and they are duly noted. Yes, real > businesses have IPs in dynamic/DSL ranges for real reasons. I totally > agree with that. (I'm a DSL customer at home and and have a "similar > reverse lookup" and have a mail server there.) I don't want to ban > these mails, but want to add to the total score. If this puts someone > over the top, so be it. But, their mail already looked close to spam > to begin with. Nuff said. > > Thanks for all the input. > > Steven
A problem here is that rules in SA are tuned to not hit ham as much as possible. I found a rule which is similar to what you want but it will cause False Positives. header RECV_DSL Received =~ /\.atlantabroadband\.com|customer|ppp|poole?s?|modem|cable|node|adsl|dial|ds l|client|(insight|tampabay|maine|nyc|nc|cinci|cfl|elp|ec|houston|ma|midsouth |neb|neo|nycap|ogw|rgv|sc|san|stx|texas)\.rr\.com|vc\.shawcable\.net|se\.cli ent..?\.attbi\.com|\.(east|west)\.verizon\.net|(nj|nm|pa|sc)\.comcast\.net|\ .dis.net|\.charter.com|metropolis\-inter\.com/i describe RECV_DSL Contains commonly abused DSL address in header score RECV_DSL 1.0 ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
