Gotcha. You're right, it would be much nicer if they had an auto-delist mechanism after reports stopped coming in from an IP....or possibly if it could be determined that an IP was no longer tied to a particular MAC address. Spammers might use auto-delist mechanisms to their advantage (by rotating IPs under the radar or switching NICs or PCs periodically), but perhaps a scheme to do so could be designed to avoid manipulation.
Darin. ----- Original Message ----- From: "Dave Doherty" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, May 03, 2004 11:32 PM Subject: Re: [Declude.JunkMail] NJABL:NJABL Open Relay / Dynamic IP Conflict That is exactly right, Darin. It seems to me that any organization that knows that certain addresses are dynamic would want to expire the open proxy records on those IPs as quickly as possible. NJABL did respond to my query, basically by saying they keep open proxy records forever, but that "anybody can delist an open proxy," so apparently they do not consider it a problem. I pointed out that I did initiate a delisting of the IP, but only after I lost mail, and that their handling of this situation diluted the accuracy and value of the open proxy test. No reply. -Dave ----- Original Message ----- From: "Darin Cox" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Saturday, May 01, 2004 9:23 AM Subject: Re: [Declude.JunkMail] NJABL:NJABL Open Relay / Dynamic IP Conflict > This is a common occurrence with dynamic IPs. Some spammer sends while he > has it or it's an open proxy, then someone else gets the IP and is penalized > for the previous activity. > > I think what you're suggesting is that there needs to be some sort of > age-out mechanism for blocks against dynamic IPs, to remove them from open > proxy or spam blocks after a certain time if no further activity is > recorded. Can't be perfect, but might help of BLs implemented it. > Obviously the IP would remain in DYNABLOCK. > > Darin. > > > ----- Original Message ----- > From: "Dave Doherty" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Saturday, May 01, 2004 12:13 AM > Subject: [Declude.JunkMail] NJABL:NJABL Open Relay / Dynamic IP Conflict > > > Hi, all- > > I have a cable modem in my apartment with a dynamic IP. > > I sent a couple of emails tonight to others at my domain. These messages > FP'd. They were caught by NJABL, which has my current address listed as an > open proxy, with a listing date in January. This address is also listed > (correctly) in DYNABLOCK. > > But if it's a dynamic address, the IP of whatever open proxy existed in > January has certainly changed. > > Does anyone else see the illogic in NJABL's lists, or am I crazy? > > Anyway, I am adjusting the weights of the NJABL tests so that no combination > can result in a hold weight. > > -DaveDoherty > Skywaves, Inc. > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
