Im glad someone is doing the testing :) please let us know of the FP rate -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Friday, September 05, 2003 7:00 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Configuration Question -
I just installed SORBS last night and am busy monitoring the results. I have found that they mostly tagg what others are tagging thus far, but what will take more time to figure out is if they are finding stuff that has been slipping through the others. I monitor things that fail with a score of between 10-14 in order to determine the validity of this test. I had pretty good results before SORBS and without Oriusoft, so just catching another 1% of all spam would mean a 20% reduction of what gets through. SORBS-BADCONF hasn't been tripped on the first 1,500 messages that it was checked for, but other SORBS tests are definitely producing positives...508 out of 1,500, and my server rejected 849 for being spam. Mostly it catches open relays of one sort or another. My SORBS config is as follows: SORBS-HTTP ip4r dnsbl.sorbs.net 127.0.0.2 5 0 SORBS-SOCKS ip4r dnsbl.sorbs.net 127.0.0.3 5 0 SORBS-MISC ip4r dnsbl.sorbs.net 127.0.0.4 5 0 SORBS-SMTP ip4r dnsbl.sorbs.net 127.0.0.5 5 0 SORBS-SPAM ip4r dnsbl.sorbs.net 127.0.0.6 5 0 SORBS-WEB ip4r dnsbl.sorbs.net 127.0.0.7 5 0 SORBS-ZOMBIE ip4r dnsbl.sorbs.net 127.0.0.9 5 0 SORBS-DUL ip4r dnsbl.sorbs.net 127.0.0.10 5 0 SORBS-BADCONF ip4r dnsbl.sorbs.net 127.0.0.11 3 0 SORBS-NOMAIL ip4r dnsbl.sorbs.net 127.0.0.12 5 0 The scores are only a starting point, and I scored SORBS-BADCONF lower because I thought it might get tripped by the same data that HELOBOGUS does (this hasn't been confirmed because that SORBS filter has not been tripped). Matt Chuck Schick wrote: >I am trying to use Sorbs as a new black list. > >I put this line in my Global config file. > >SORBS-BADCONF ip4r dnsbl.sorbs.net 127.0.0.11 4 0 > >And I put in the following lines in both the Junkmail and the Global file > >SORBS-BADCONF WARN > >After running this for 24 hours I did not find the test had been triggered >once. > >Here are my questions: > >1) Is my configuration incorrect? > >2) Is it a waste of my time to use SORBS as a Blacklist? > >Chuck Schick >Warp 8, Inc. >303-421-5140 >www.warp8.com > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > > > > -- =================================================== Matthew S. Bramble President and Technical Coordinator iGaia Incorporated, Operator of NYcars.com --------------------------------------------------- Office Phone: (518) 862-9042 Cellular: (518) 229-3375 Fax: (518) 862-9044 E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED] =================================================== --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
