CHINABLACKHOLE ip4r china.blackholes.us 127.0.0.2
Todd
At 03:51 PM 8/27/2003 -0400, you wrote:
Hi Todd:
Attached is the IMail blacklist file. It has the detail of all the tests
that we run. As stated earlier we do our tests in IMail and then add the
header to be later evaluated by Declude as filter files.
If you want simply replace this file in the IMail directory (version 8 only)
and all tests should show up in the spam lists. We used to have these in
the Declude format with the IP's but since IMail does not need it we no
longer have that but I am sure if you want to use them in Declude they are
listed in the blackholes.us site..
BHOLE-BRAZIL* brazil.blackholes.us
BHOLE-CHINA* china.blackholes.us
BHOLE-CN-KR* cn-kr.blackholes.us
BHOLE-HONGKONG* hongkong.blackholes.us
BHOLE-JAPAN* japan.blackholes.us
BHOLE-KOREA* korea.blackholes.us
BHOLE-RUSSIA* russia.blackholes.us
BHOLE-CW* cw.blackholes.us
BHOLE-LEVEL3* level3.blackholes.us
BHOLE-RR* rr.blackholes.us
BHOLE-VERIO* verio.blackholes.us
BHOLE-XO* xo.blackholes.us
We have found good results with these...
Hope it helps.
Let me know if I can be of further assistance.
Regards,
Kami
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of [EMAIL PROTECTED]
Sent: Wednesday, August 27, 2003 3:24 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] OSRELAY question.
Kami,
Just to clarify, I wanted to know about your tests labeled
BHOLE-....
Todd
At 02:09 PM 8/27/2003 -0500, you wrote:
>Kami,
>
> Could please elaborate on some of the tests here and how I
> might
> use them in Declude config. You are rating them very high so I assume
> they are giving you good results.
>
>BHOLE-BRAZIL, BHOLE-BRAZIL etc...
>
>Thanks,
>
>Todd
>
>
>
>At 09:25 AM 8/27/2003 -0400, you wrote:
>>Hi Nick:
>>
>>This is what we have in our filter file. We use IMail to do the
>>testing and then use a filter file to give them weight. Just in case
>>it helps you this is what we have:
>>
>>We had all of what is listed in Declude site and wrote a program to
>>evaluate all the server logs for 5 months and pick up the frequency
>>that each test is triggered. We took the top so many and deleted the
>>ones that hardly return a positive. The following are the ones we use
>>now...
>>
>>HEADERS 8 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(BHOLE-BRAZIL
>>HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(BHOLE-BROADWING
>>HEADERS 10 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(BHOLE-CN-KR
>>HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL:
(BHOLE-CW
>>HEADERS 20 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(BHOLE-BRAZIL
>>HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(BHOLE-INFLOW
>>HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(BHOLE-JAPAN
>>HEADERS 10 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(BHOLE-KOREA
>>HEADERS 3 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(BHOLE-LEVEL3
>>HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL:
(BHOLE-RR
>>HEADERS 8 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(BHOLE-RUSSIA
>>HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(BHOLE-VERIO
>>HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(BHOLE-YIPES
>>HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (BLARS
>>HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (COMPU
>>HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL:
(DEADBEEF
>>HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (DELINK
>>HEADERS 6 CONTAINS X-IMAIL-SPAM-DNSBL: (DSBL
>>HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (DSBLALL
>>HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(FABELSOURCES
>>HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (fiveten
>>HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL:
(INTERSIL
>>HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(KUNDENSERVER
>>HEADERS 10 CONTAINS X-IMAIL-SPAM-DNSBL: (NJABL
>>HEADERS 9 CONTAINS X-IMAIL-SPAM-DNSBL: (ORDB
>>HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(SORBS-HTTP
>>HEADERS 15 CONTAINS X-IMAIL-SPAM-DNSBL:
(SpamCop
>>HEADERS 8 CONTAINS X-IMAIL-SPAM-DNSBL:
(SPAMHAUS
>>HEADERS 10 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(WIREHUB-DNSBL
>>HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL:
>>(WIREHUB-DYNA
>>HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (ybl
>>
>>Regards,
>>Kami
>>
>>-----Original Message-----
>>From: [EMAIL PROTECTED]
>>[mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer
>>Sent: Wednesday, August 27, 2003 8:57 AM
>>To: [EMAIL PROTECTED]
>>Subject: Re: [Declude.JunkMail] OSRELAY question.
>>
>>
>> >
>> > Actually, http://www.declude.com/junkmail/support/ip4r.htm shows
>> > that there are plenty of spam databases left. :)
>> >
>> > -Scott
>>
>>You are correct - BUT - besides the default ones listed in the
>>*old* manual how can we know which to use that give the most accurate
>>results and are not duplicates of each other? Would it be possible for
>>you to make a new recommended list?
>>
>> -Nick Hayer
>>
>>
>>
>>---
>>[This E-mail was scanned for viruses by Declude Virus
>>(http://www.declude.com)]
>>
>>---
>>This E-mail came from the Declude.JunkMail mailing list. To
>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
>>"unsubscribe Declude.JunkMail". The archives can be found at
>>http://www.mail-archive.com.
>>
>>---
>>[This E-mail was scanned for viruses by Declude Virus
>>(http://www.declude.com)]
>>
>>---
>>This E-mail came from the Declude.JunkMail mailing list. To
>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
>>"unsubscribe Declude.JunkMail". The archives can be found at
>>http://www.mail-archive.com.
>
>
>---
>[This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
>"unsubscribe Declude.JunkMail". The archives can be found at
>http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
