I would be interested in your script also. Stu
At 08:27 AM 04/13/2004 -0700, you wrote: >I would be interested in your script until native support is added to >Declude. > >John Tolmachoff >Engineer/Consultant/Owner >eServices For You > > >> -----Original Message----- >> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- >> [EMAIL PROTECTED] On Behalf Of Roger Eriksson >> Sent: Tuesday, April 13, 2004 8:11 AM >> To: [EMAIL PROTECTED] >> Subject: Re: [Declude.JunkMail] Surbl.org >> >> > > However I hope to see SURBL soon as an additional Declude test. >> > >> >I just got caught up on this thread and checked out the website for SURBL >> >and I agree! This would help with the stuff that passes all of the other >> >tests. >> > >> >Sheldon >> > >> >> Hi, >> >> SURBL is surprisingly effective, considering the fact that it only >> contains about 450-500 entries. I have written a simple command >> script that downloads the rbldns zone file and converts it to a body >> filter. I have scheduled it to run once a day. Here are yesterday's >> stats with 9666 hits for the SURBL test (note that the individual >> tests show total number of hits, while the spam summary only counts >> one hit per message irrespective of the number of recipients): >> >> # Declude test results -- dec0412.log >> AHBL-PROXY 1857 >> AHBL-RHSBL 835 >> AHBL-SOURCE 302 >> BADHEADERS 1610 >> BASE64-PLUS 412 >> BASE64 786 >> CBL 10616 >> COMMENTS 54 >> DSBL 8875 >> DSN 1611 >> FORGEDLOCAL 781 >> GREYLIST 5 >> HELOBOGUS 2616 >> MAILFROM 487 >> MAILPOLICE 554 >> MESSAGE OK 2294 >> NETBL 463 >> OPM 554 >> ORDB 24 >> REVDNS 3028 >> RSL 673 >> SBL 571 >> SNIFFER-ADULT 897 >> SNIFFER-CASINO 35 >> SNIFFER-CREDIT 1057 >> SNIFFER-EMAIL 8 >> SNIFFER-EXP 578 >> SNIFFER-GEN 824 >> SNIFFER-GREY 2 >> SNIFFER-INSUR 571 >> SNIFFER-MAL 2 >> SNIFFER-MEDIA 2172 >> SNIFFER-OBFUSC 201 >> SNIFFER-PHARM 5279 >> SNIFFER-PRINT 0 >> SNIFFER-RICH 840 >> SNIFFER-SCAM 119 >> SNIFFER-TOOLS 0 >> SNIFFER-TRAVEL 43 >> SNIFFER 12628 >> SORBS-DUHL 7512 >> SPAMCOP 10546 >> SPAMDOMAINS 3380 >> SPAMHEADERS 293 >> SPAMTRAP 121 >> SPFFAIL 209 >> SURBL 9666 >> URLDBL 76 >> WEIGHT15-19 846 >> WEIGHT20 11987 >> WHITELISTED 110 >> -------------------- >> Unique messages for local delivery: 5812 >> Held spam: 4256 (73%) >> Marked spam: 455 (7%) >> Non-spam: 1101 (18%) >> >> >> Furthermore, SURBL has a rather low overlap with most other tests >> (only unique hits are counted here): >> >> #Test check - dec0412.log >> ---------------------------- >> Test: SURBL >> Number of unique hits: 2849 >> ---------------------------- >> Shared with SBL (421 hits): 69 (2%) >> Shared with DSBL (3018 hits): 1951 (68%) >> Shared with SPAMCOP (3673 hits): 2208 (77%) >> Shared with AHBL-SOURCE (261 hits): 49 (1%) >> Shared with CBL (3563 hits): 2232 (78%) >> Shared with AHBL-PROXY (683 hits): 420 (14%) >> Shared with OPM (200 hits): 132 (4%) >> Shared with RSL (240 hits): 163 (5%) >> Shared with ORDB (22 hits): 8 (0%) >> Shared with SORBS-DUHL (2510 hits): 1494 (52%) >> Shared with DSN (479 hits): 299 (10%) >> Shared with AHBL-RHSBL (346 hits): 184 (6%) >> Shared with MAILPOLICE (492 hits): 171 (6%) >> Shared with MAILFROM (161 hits): 67 (2%) >> Shared with BADHEADERS (682 hits): 290 (10%) >> Shared with HELOBOGUS (940 hits): 537 (18%) >> Shared with SPFFAIL (125 hits): 101 (3%) >> Shared with SPAMHEADERS (248 hits): 43 (1%) >> Shared with REVDNS (1528 hits): 645 (22%) >> Shared with COMMENTS (46 hits): 19 (0%) >> Shared with BASE64 (577 hits): 3 (0%) >> Shared with SNIFFER (4485 hits): 2830 (99%) >> Shared with SNIFFER-TRAVEL (7 hits): 7 (0%) >> Shared with SNIFFER-INSUR (66 hits): 44 (1%) >> Shared with SNIFFER-TOOLS (0 hits): 0 (0%) >> Shared with SNIFFER-MEDIA (360 hits): 323 (11%) >> Shared with SNIFFER-EMAIL (8 hits): 1 (0%) >> Shared with SNIFFER-PHARM (2188 hits): 1650 (57%) >> Shared with SNIFFER-SCAM (35 hits): 5 (0%) >> Shared with SNIFFER-ADULT (470 hits): 290 (10%) >> Shared with SNIFFER-MAL (2 hits): 0 (0%) >> Shared with SNIFFER-PRINT (0 hits): 0 (0%) >> Shared with SNIFFER-RICH (377 hits): 65 (2%) >> Shared with SNIFFER-CREDIT (249 hits): 172 (6%) >> Shared with SNIFFER-CASINO (14 hits): 5 (0%) >> Shared with SNIFFER-GREY (2 hits): 0 (0%) >> Shared with SNIFFER-OBFUSC (130 hits): 85 (2%) >> Shared with SNIFFER-EXP (234 hits): 108 (3%) >> Shared with SNIFFER-GEN (343 hits): 75 (2%) >> Shared with SPAMDOMAINS (970 hits): 630 (22%) >> Shared with SPAMTRAP (29 hits): 18 (0%) >> Shared with FORGEDLOCAL (330 hits): 75 (2%) >> Shared with NETBL (214 hits): 125 (4%) >> Shared with URLDBL (52 hits): 6 (0%) >> Shared with BASE64-PLUS (384 hits): 2 (0%) >> Shared with GREYLIST (5 hits): 0 (0%) >> Shared with WEIGHT15-19 (455 hits): 198 (6%) >> Shared with WEIGHT20 (4256 hits): 2519 (88%) >> ---------------------------- >> >> If anyone is interested, I can make the SURBL script available for >> download (together with some other scripts, e.g., the log analysis >> and test check scripts that generated the results seen above). The >> best solution is of course to have the SURBL test implemented >> directly in Declude, especially since it is a realtime blocklist, but >> until then this filter will do just fine. >> >> /Roger >> --- >> [This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > > ----------------------------------------------------------------------------- CSOnline Technical Support Normal hours - Monday thru Saturday 8am - 12pm CSOnline Technical Support Numbers Seneca 814-677-2447 Clarion 814-227-3638 Cochranton 814-425-1696 Parker 724-399-1158 GremLan 814-337-7060 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com http://www.gremlan.org ----------------------------------------------------------------------------- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
