[Mimedefang] Catching the porn spams

[John Scully]

We are running MD 2.45 beta-2 and spamassassin 3.0.0-RC3 (release candidate
3 of version 3), along with the full set of SARE (SpamAssassin Rules
Emporium) rule sets, other custom rule sets and DCC (not through SA, but
direct from MD using DCCIFD).

We have found that the combination of DCC, the surbl.org lookups on URIs in
the message bodies and the SARE rule sets block more than 99% of porn.  The
sare blacklists function particularly well.

There is no one solution to porn, just as there is not for general spam.
The combination of frequently updated blacklists, large rule sets and DCC
does work well.

And when I say large rule sets...my spamd children are 155 meg EACH, because
we have many thousands of rules.  

DCC does a particularly good job of catching image only porn spam, and
because it is faster then SA by a factor of 50 we run DCC first, then only
run SA if DCC did not see it as spam. That cut our SA server load by 50%
with no loss of accuracy.

We use a tight feedback loop from SA to DCC - if DCC did not report it as
spam, but it scored above 12 in SA we report it to the DCC network as spam.
Since we cut off at 12 there are never any false positives, but it means
that the first message of a spam blast is the only one with SA overhead -
all the others stop at DCC.

John Scully
www.isupportisp.com


-----Original Message-----
From: mimedefang-bounces at lists.roaringpenguin.com
[mailto:mimedefang-bounces at lists.roaringpenguin.com] On Behalf Of Kelson
Sent: Thursday, September 09, 2004 2:22 PM
To: mimedefang at lists.roaringpenguin.com
Subject: Re: [Mimedefang] Catching the porn spams

Keith Patton wrote:

> Maybe we need to think a little outside the box.  Porn spam's objective 
> is to get you to go to their website, subscribe etc.
> Now maybe we need to search the body for web links then match them 
> against a blacklist.

Actually, that's where this thread started -- with SURBL.  More info: 
www.surbl.org

-- 
Kelson Vibber
SpeedGate Communications <www.speed.net>

_______________________________________________
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
MIMEDefang at lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang