Thanks, will look at blackholes.us. My real problem is time. I've written a program and spreadsheet that extracts the domains and IP's of delivered messages and shows the unique IP's and how many messages came from them. But when I spend time cross-checking with SenderBase and ARIN, I can spend hours updating my IP filters. Cost/benefit isn't there.
Agree; have to be careful about blocking. Plan was to add points on /8 IP's, something below my subject tag score. Hopefully legit messages would come through ok, but the "kinky" ones, with the new scoring added, would be enough to at least trip the tag weight. John -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Tuesday, February 28, 2006 9:22 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Spam out of 86.* & 87.* Hi John, > What is my best bet - jack up >the score a number of points for any mail coming from 86 & 87? Many of >the messages hardly trip any of the regular tests. > > Wouldn't hurt - use blackholes.us and maybe score 40% of your hold weight? I would say though blocking a /8 is not a good idea. way too many false positives. My first question is why the leakage? My guess would be a new spam campaign that eventually will leak from other blocks. So first maybe figure out how to score these on header / body content, etc . Next examine the ip's that they are coming from and selectively block accordingly. Here are 2 blocks I have tagged in that range - 86.59.128.0 255.255.252.0 esnet.com ROKSO 20-May-2005 01:27 GMT 86.111.128.0 255.255.240.0 ROKSO Boris Mizhen Don't be discouraged. There will be a new campaign tomorrow :) -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
