Re: trapping rubbish?

[jdow <jd...@earthlink.net>]

This might be a job for a simple plug-in.
{o.o}
----- Original Message ----- 
From: <ha...@t-online.de>
>
>
> Hi,
>
> if the same IP address is used every time, bayes will probably learn it.
> If someone is using a random number generator for the IPs, a rule that 
> detects impossible ones
> might be nice. I have seen received headers with the same problem as well
>
> Wolfgang Hamann
>
>>>
>>> hamann.w@t-online.de wrote:
>>> > looking at a piece of spam that was scored low, I noticed
>>> >=20
>>> > X-Originating-IP: [383.552.476.5]
>>> >=20
>>> > Wouldn't that be a nice thing to score on?
>>> >=20
>>> > Wolfgang Hamann
>>>
>>> Bayes learns it. What's so nice in it in your opinion?
>>>
>>> Various blacklists learn abuseable IP-addresses as well, and they get a 
>>> =
>>> score in SA.
>>>
>
>>>
>>>
> 

Re: trapping rubbish?

[mouss <mo...@netoyen.net>]

jdow wrote:
> This might be a job for a simple plug-in.

or for a postfix header checks:

/^X-Originating-IP: \[([3-9].*)\]/      REJECT forged X-Originating-IP ($1)

one can get more "precise" using an if and only allowing valid forms. 
not sure it's worth the pain though...

> {o.o}
> ----- Original Message ----- From: <ha...@t-online.de>
>>
>>
>> Hi,
>>
>> if the same IP address is used every time, bayes will probably learn it.
>> If someone is using a random number generator for the IPs, a rule 
>> that detects impossible ones
>> might be nice. I have seen received headers with the same problem as 
>> well
>>
>> Wolfgang Hamann
>>
>>>>
>>>> hamann.w@t-online.de wrote:
>>>> > looking at a piece of spam that was scored low, I noticed
>>>> >=20
>>>> > X-Originating-IP: [383.552.476.5]
>>>> >=20
>>>> > Wouldn't that be a nice thing to score on?
>>>> >=20
>>>> > Wolfgang Hamann
>>>>
>>>> Bayes learns it. What's so nice in it in your opinion?
>>>>
>>>> Various blacklists learn abuseable IP-addresses as well, and they 
>>>> get a =
>>>> score in SA.
>>>>
>>
>>>>
>>>>
>>
>
>
>