Take a look at ASSP (http://assp.sourceforge.net). After training, it cut our spam down tremendously. I still block a lot of APNIC space as well as some selected networks in other parts of the world, but ASSP has been the best spam filter I've yet seen.
There is another program in development that looks very interesting called TarProxy (http://www.martiansoftware.com). Getting angry at mail admins is a waste of time and doesn't solve the problem. Randall Scott -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bud Durland Sent: Tuesday, December 30, 2003 12:50 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Blocking spam Jason wrote: >I would be angry also, but the question then becomes: Who should I be >angry with?. > >The theory here is that if you have a spammer hitting you from a class C >and the offending addresses span the class C as this one did (.250, .9), >then should I be mad at the mail admins that are sick and tired of >scanning provider subnets for spammers, or should I be mad at the >subscriber network that does almost nothing to stop the epidemic of >spam? > > > Unless I mis-understood (wouldn't be the first time!) Len's message, after getting spam from 207.218.67.9, what he did was search his logs for any other spam from the same class C range. After finding others there, the entire class C was blocked, without further research that all the hits were the same offender. In this particular case, the risk of a false positive is fairly small since the spam hits cover pretty much the entire range of the Class C. But, if a mail admin blocked 12.107.134.0/24 because he didn't do enough research to see that the sources were in 12.107.134.0/25, my mail server would be a collateral casualty. -- -------------------------------------------------------------------- The problem with the gene pool is there are no lifeguards -Steven Wright --------------------------------------------------------------------- Bud Durland, CNE Mold-Rite Plastics Network Administrator http://www.mrpcap.com --------------------------------------------------------------------- --- [This E-mail scanned for viruses by Declude Virus / Sophos AV] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
