Another idea of a stat to track

From: Murray S. Kucherawy <msk_at_blackops.org>
Date: Thu, 9 Sep 2010 16:52:56 -0700 (PDT)

The current stats tables track domains seen. Mostly this is a compression
mechansim, mapping domain names (up to 255 bytes) to integers (4 bytes).

We could also include in the domains table a timestamp of the first time
the domain is seen and reported. With a long enough data collection
period, it becomes possible to identify with some accuracy "new" domains
that might have been recently registered for spamming purposes and filter
accordingly, with or without correlation to DKIM results and spam scores.

It's easy to do this in the database without affecting the data already
there, except I'll have to go back and set that column to match the
timestamps in the messages table.

Comments welcome.

-MSK
Received on Thu Sep 09 2010 - 23:53:14 PST