Re: trapping rubbish?

[ha...@t-online.de]

Hi,

if the same IP address is used every time, bayes will probably learn it.
If someone is using a random number generator for the IPs, a rule that detects impossible ones
might be nice. I have seen received headers with the same problem as well

Wolfgang Hamann

>> 
>> hamann.w@t-online.de wrote:
>> > looking at a piece of spam that was scored low, I noticed
>> >=20
>> > X-Originating-IP: [383.552.476.5]
>> >=20
>> > Wouldn't that be a nice thing to score on?
>> >=20
>> > Wolfgang Hamann
>> 
>> Bayes learns it. What's so nice in it in your opinion?
>> 
>> Various blacklists learn abuseable IP-addresses as well, and they get a =
>> score in SA.
>> 

>> 
>> 

Re: trapping rubbish?

[mouss <mo...@netoyen.net>]

jdow wrote:
> This might be a job for a simple plug-in.

or for a postfix header checks:

/^X-Originating-IP: \[([3-9].*)\]/      REJECT forged X-Originating-IP ($1)

one can get more "precise" using an if and only allowing valid forms. 
not sure it's worth the pain though...

> {o.o}
> ----- Original Message ----- From: <ha...@t-online.de>
>>
>>
>> Hi,
>>
>> if the same IP address is used every time, bayes will probably learn it.
>> If someone is using a random number generator for the IPs, a rule 
>> that detects impossible ones
>> might be nice. I have seen received headers with the same problem as 
>> well
>>
>> Wolfgang Hamann
>>
>>>>
>>>> hamann.w@t-online.de wrote:
>>>> > looking at a piece of spam that was scored low, I noticed
>>>> >=20
>>>> > X-Originating-IP: [383.552.476.5]
>>>> >=20
>>>> > Wouldn't that be a nice thing to score on?
>>>> >=20
>>>> > Wolfgang Hamann
>>>>
>>>> Bayes learns it. What's so nice in it in your opinion?
>>>>
>>>> Various blacklists learn abuseable IP-addresses as well, and they 
>>>> get a =
>>>> score in SA.
>>>>
>>
>>>>
>>>>
>>
>
>
>

Re: trapping rubbish?

[jdow <jd...@earthlink.net>]

This might be a job for a simple plug-in.
{o.o}
----- Original Message ----- 
From: <ha...@t-online.de>
>
>
> Hi,
>
> if the same IP address is used every time, bayes will probably learn it.
> If someone is using a random number generator for the IPs, a rule that 
> detects impossible ones
> might be nice. I have seen received headers with the same problem as well
>
> Wolfgang Hamann
>
>>>
>>> hamann.w@t-online.de wrote:
>>> > looking at a piece of spam that was scored low, I noticed
>>> >=20
>>> > X-Originating-IP: [383.552.476.5]
>>> >=20
>>> > Wouldn't that be a nice thing to score on?
>>> >=20
>>> > Wolfgang Hamann
>>>
>>> Bayes learns it. What's so nice in it in your opinion?
>>>
>>> Various blacklists learn abuseable IP-addresses as well, and they get a 
>>> =
>>> score in SA.
>>>
>
>>>
>>>
>