I would venture a word of caution about AHBL-- we found them to be an endless source of false-positives and eventually removed them from our blacklist repository. Clients of ours also had many, many problems with AHBL blacklisting entire Class C IP ranges. There was a rumor (maybe a joke?) that they had blacklisted most netranges in the country of Spain.
One of the biggest financial institutions in the world is still on their blacklist after nearly 2 years of trying to be removed. No response. We use: sbl.spamhaus.org bl.SpamCop.net List.dsbl.org dnsbl.njabl.org sbl-xbl.spamhaus.org opm.blitzed.org relays.ordb.org We don't ever recommend deleting after 1 or 2 BL matches. Best thing is to weight those BL's with Declude or similar product and filter anything above a match threshold, or at least only delete after 3+ matches. ---------- Original Message ---------------------------------- From: Martin Schaible <[EMAIL PROTECTED]> Reply-To: [email protected] Date: Tue, 25 Jan 2005 00:04:16 +0100 Hi Mike, V3net is now in the hands of the enemies. We're using DSBL, spamhaus, ahbl, spamcop, ordb sorbs and fiveten. fiveteen must be used with care. Their list is quite aggressive, especially in europe. Also SORBS is quite agressive. To avoid false/positives, we #1 exclude all ch-domains from SORBS #2 using only china and korea-stuff with fiveten. H~(X-IMAIL-SPAM-DNSBL)!AND!H!~(SORBS|FiveTen):[EMAIL PROTECTED] H~(X-IMAIL-SPAM-DNSBL)!AND!H~(SORBS)!AND!F!~(\.ch):[EMAIL PROTECTED] H~(X-IMAIL-SPAM-DNSBL)!AND!H~(FiveTen)!AND!H~(china\.spam):[EMAIL PROTECTED] H~(X-IMAIL-SPAM-DNSBL)!AND!H~(FiveTen)!AND!H~(korea\.spam):[EMAIL PROTECTED] I guess, 90% of all mails will be captured by this services. spamcop and spamhaus are moste effective. Unfortunately, all services are not quite good informed, what happens in our small country, eg. spamcop added our biggest ISP to the blacklist without any reason. To explain that: Only 1% of all spam is from our country itself. ============================================ Am Montag, 24. Januar 2005 um 23:44 schrieben Sie: > I too had a nasty surprise - all mail deleted! A hurried look at the logs > told me why; v6net. Can anyone recommend a set of reliable blacklists i.e. > those that can be trusted not to delete. > Many Thanks > Mike Forbes > METRIC UK > ----- Original Message ----- > From: "Mike Nice" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Monday, January 24, 2005 6:00 PM > Subject: Re: [IMail Forum] SPAM List Problem >> >From NANAE: >> >> "It appears that the registration for the domain v6net.org expired, and >> it was bought by a domain hoarding company (whois shows a registration >> date of last Friday), who have set it up with a DNS wildcard: >> $ host '*.v6net.org' >> *.v6net.org has address 65.77.130.111" >> >> ----- Original Message ----- >> From: "Martin Schaible" <[EMAIL PROTECTED]> >> To: "Jim Comerford" <[email protected]> >> Sent: Monday, January 24, 2005 12:32 PM >> Subject: Re: [IMail Forum] SPAM List Problem >> >> >>> Hi, >>> >>> This means v6net.org changed the sides? Or are the hijacked? >> >> >> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >> List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ >> > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ ============================================ -- Mit freundlichen Gr�ssen -------------------------------------------- Merlin Consulting Martin Schaible Bahnhofstrasse 27 CH-8702 Zollikon Phone: +41 1 391 30 00 Fax: +41 1 391 32 49 Mail: mailto:[EMAIL PROTECTED] URL: http://www.merlinconsulting.ch Support: http://support.merlinconsulting.ch GPS: N47 20.235 E8 34.226 -------------------------------------------- News - Neue Produkte: .:. Kiwi Syslog Monitor .:. Paessler GmbH .:. Sawmill Loganalyzer -------------------------------------------- To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
