[Mimedefang] Sober virus highlights problem

Jonathan Maliepaard jon at enetworks.co.za
Thu May 19 09:46:58 EDT 2005


Hi

The reason that we embarked on whitelisting many domains was because of
all the false positives. We would come in to the office in the moring
and have to sort through 1000 messages in the spam trap. (right now it
is mainly SPAM and 300-400)

As happy as our customers are with this arrangement, (we are an ISP) it
was putting an over-head on us. It actually was working very well until
this virus came along and I noticed the flaw in my plan.

I have installed the custom rules and thousands of mails have been
blocked, but if a whitelisted domain is spoofed then it comes through.

One of the problems that we have seen has been indigenous languages. The
get caught by the chickpox rules quite often, I have been feeding the
messages to bayes, but so hopefully things will get better soon as out
bayesian filter copes with our 11 official languages! Also people use a
lot of foul language and sexual references, they get nabbed every time.

Thanks for all the feed-back I am going to have to rethink a lot, and
try to work out why we get so many false positives, and as Joseph so
rightly said fix my filters ;-)

Regards Jon.







More information about the MIMEDefang mailing list