Re: [Fwd: Preliminary investigation were started]

[Wayne Topa <brittman@capital.net>]

Travis Crump(pretzalz@techhouse.org) is reported to have said:
> Wayne Topa wrote:
> >Richard Lyons(richard@the-place.net) is reported to have said:
> >
> >>On Friday 16 January 2004 22:23, Wayne Topa wrote:
> >>[...]
> >>
> >>>I have a mailfilter rule that deletes mail without an
> >>>originating Message-ID: and it has not had a false positive in over 3
> >>>months now.
> >>
> >>[...]
> >>Would you care to share with those like me who can't immediately see how 
> >>to do it how exactly is that filter set up?
> >>
> >
> >^Message-Id:.*smtp[0-9]\.your\.isp
> >
> >It is easy if you can find a spam message with your ISP in the
> >Message-Id: header.  ie
> >egrep "^Message-Id:.*\.your\.isp" logs/mailfilterlog
> >
> >Note that my ISP, capital.net, is NOT what I found in the Message-ID.
> >It was their smtp server address and it varied, so I had to write the
> >rule accordingly.
> >
> >:-) HTH, YMMV, HAND :-)
> >Wayne
> >
> 
> That rule would match roughly one third of my legitimate non-list 
> mail...[and only one fifth of my spam by comparison]

SCORE=100
SCORE -100 =^Message-Id:.*smtp[0-9]\.your\.isp 

Is how I use it, and as I said, "no false positives in over 3 months"

I also said

HTH=Hope This Helps, YMMV=Your Mileage May Vary, HAND=Have A Nice Day

Wayne

-- 
Real programmers don't draw flowcharts.  Flowcharts are, after all, the
illiterate's form of documentation.  Cavemen drew flowcharts; look how
much good it did them.
_______________________________________________________