Re: [Razor-users] Questions about auto-submitting from spam traps (and trust) (fwd)

[Justin S. <lis...@nu...>]

Pardon my forwarding this mail to the list but this guy and I raise what I
think are interesting questions that are really mirrored by Pyzor.  

Justin

---------- Forwarded message ----------
Date: Thu, 25 Sep 2003 18:47:55 -0500 (CDT)
From: Justin Shore <lis...@nu...>
To: Bill Borton <bb...@co...>
Cc: raz...@li...
Subject: Re: [Razor-users] Questions about auto-submitting from spam traps
    (and trust)

I would like an answer to this question as well.  I am in the same boat as 
Bill only my boat is many times larger.  I field thousands of pieces of 
spam per day on my existing spamtraps.  I'm starting things back up again 
and fully expect the load to increase dramatically.

On Thu, 18 Sep 2003, Bill Borton wrote:

> Hi all,
> 
> I have a handful of addresses that I would like to set up to automatically
> pipe into razor-report via procmail.  I have been monitoring the addresses
> in question for a while now and it is all spam.  (20-100 a month each after
> spamcop.)
> 
> First question:
> Currently ~10% of the mails are a already identified as spam via razor.  If I
> set up my procmail to pipe into razor-check as suggested in the install docs
> It seems that all messages (including the ones already in the DB) would be
> processed. Does it hurt to re-submit those?  Or, does razor-report already
> take this into account and not re-submit existing signatures?

This is a good question.  Should incoming mail be "checked" first to see 
if it is already known or should it just be submitted regardless?  I 
currently have a procmail recipe that reports incoming spam with 
spamassassin -r and 'pyzor report.'  Knowing what is preferred here would 
be a big help.

> Second question:
> There is a bit of overlap in the spam received into the troll addresses.  Does
> it hurt to report the same message more than once as it comes into the
> different addresses?

When my spamtraps get spammed I tend to get hundreds or thousands of 
copies of the same spam.  They come from different proxies all over the 
world but they have the same body.  I don't know of a way for me to filter 
out duplicates in an auto-submission process.  I don't know if it's a 
possibility at all.

> Lastly, do either of the above situations hurt/help my trust rating?  I 
> have been
> adding a warning header to our inbound mails that are flagged by Razor.  It is
> working well, but not hitting much more that about 15% at best.  I would like
> to try to improve that with some solid reporting and building a good trust 
> level.
> I do not want to go though the trouble though if all my submissions remain
> ignored due to trust issues with automated re-reporting, duplicates, etc.

Agreed.  I'm doing this as a service to the community.  It would be nice 
to know if what I'm doing is actually getting through and having any 
effect.  Suggestions?

Justin