Re: [Declude.JunkMail] SURBL as RHSBL
Markus, if you want to test against all of the SURBLs, since it's only a single query to the multi zone, use: SURBL_ABrhsblmulti.surbl.org127.0.0.3210SURBL_JPrhsblmulti.surbl.org127.0.0.6410SURBL_OBrhsblmulti.surbl.org127.0.0.1610SURBL_PHrhsblmulti.surbl.org127.0.0.810SURBL_SCrhsblmulti.surbl.org127.0.0.210SURBL_WSrhsblmulti.surbl.org127.0.0.410 AB = AbuseButler data JP = Combination of Prolocation data Joe Wein's SpamSpy data OB = OutBlaze data PH = Combination of MailPolice "Fraud" list data MailSecurity "Phishing" list data SC = SpamCop top 200 hits data WS = William Stearns submitter data I have been testing this for about an hour, and am getting a few hits. We'll see how it goes over the next 24 hours... Bill - Original Message - From: Markus Gufler To: [EMAIL PROTECTED] Sent: Monday, November 22, 2004 11:41 PM Subject: RE: [Declude.JunkMail] SURBL as RHSBL Is this the correct configruation line for doing this?SURBLS-RHSBL rhsbl %MAILFROM%.sc.surbl.org 127.0.0.2 5 0Markus---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] SURBL as RHSBL
Modification, since I was not thinking, but Declude JunkMail does not support bitmasked responses. So instead of using the multi zone, you will need to use: SURBL_AB rhsbl ab.surbl.org127.0.0.2 1 0 SURBL_JP rhsbl jp.surbl.org127.0.0.2 1 0 SURBL_OB rhsbl ob.surbl.org127.0.0.2 1 0 SURBL_PH rhsbl ph.surbl.org127.0.0.2 1 0 SURBL_SC rhsbl sc.surbl.org127.0.0.2 1 0 SURBL_WS rhsbl ws.surbl.org127.0.0.2 1 0 Which will require six different queries if you want to use all SURBL lists. Bill - Original Message - From: Bill Landry To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 12:47 AM Subject: Re: [Declude.JunkMail] SURBL as RHSBL Markus, if you want to test against all of the SURBLs, since it's only a single query to the multi zone, use: SURBL_AB rhsbl multi.surbl.org127.0.0.32 1 0 SURBL_JP rhsbl multi.surbl.org127.0.0.64 1 0 SURBL_OB rhsbl multi.surbl.org127.0.0.16 1 0 SURBL_PH rhsbl multi.surbl.org127.0.0.8 1 0 SURBL_SC rhsbl multi.surbl.org127.0.0.2 1 0 SURBL_WS rhsbl multi.surbl.org127.0.0.4 1 0 AB = AbuseButler data JP = Combination of Prolocation data Joe Wein's SpamSpy data OB = OutBlaze data PH = Combination of MailPolice Fraud list data MailSecurity Phishing list data SC = SpamCop top 200 hits data WS = William Stearns submitter data I have been testing this for about an hour, and am getting a few hits. We'll see how it goes over the next 24 hours... Bill - Original Message - From: Markus Gufler To: [EMAIL PROTECTED] Sent: Monday, November 22, 2004 11:41 PM Subject: RE: [Declude.JunkMail] SURBL as RHSBL Is this the correct configruation line for doing this? SURBLS-RHSBL rhsbl %MAILFROM%.sc.surbl.org 127.0.0.2 5 0 Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SURBL as RHSBL
Hi Bill, You seem to always be one of the first to share new blacklists. Where do you find this info? Is there another list that would be worth joining? Thanks, man. Darin. - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 5:04 AM Subject: Re: [Declude.JunkMail] SURBL as RHSBL Modification, since I was not thinking, but Declude JunkMail does not support bitmasked responses. So instead of using the multi zone, you will need to use: SURBL_AB rhsbl ab.surbl.org127.0.0.2 1 0 SURBL_JP rhsbl jp.surbl.org127.0.0.2 1 0 SURBL_OB rhsbl ob.surbl.org127.0.0.2 1 0 SURBL_PH rhsbl ph.surbl.org127.0.0.2 1 0 SURBL_SC rhsbl sc.surbl.org127.0.0.2 1 0 SURBL_WS rhsbl ws.surbl.org127.0.0.2 1 0 Which will require six different queries if you want to use all SURBL lists. Bill - Original Message - From: Bill Landry To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 12:47 AM Subject: Re: [Declude.JunkMail] SURBL as RHSBL Markus, if you want to test against all of the SURBLs, since it's only a single query to the multi zone, use: SURBL_AB rhsbl multi.surbl.org127.0.0.32 1 0 SURBL_JP rhsbl multi.surbl.org127.0.0.64 1 0 SURBL_OB rhsbl multi.surbl.org127.0.0.16 1 0 SURBL_PH rhsbl multi.surbl.org127.0.0.8 1 0 SURBL_SC rhsbl multi.surbl.org127.0.0.2 1 0 SURBL_WS rhsbl multi.surbl.org127.0.0.4 1 0 AB = AbuseButler data JP = Combination of Prolocation data Joe Wein's SpamSpy data OB = OutBlaze data PH = Combination of MailPolice Fraud list data MailSecurity Phishing list data SC = SpamCop top 200 hits data WS = William Stearns submitter data I have been testing this for about an hour, and am getting a few hits. We'll see how it goes over the next 24 hours... Bill - Original Message - From: Markus Gufler To: [EMAIL PROTECTED] Sent: Monday, November 22, 2004 11:41 PM Subject: RE: [Declude.JunkMail] SURBL as RHSBL Is this the correct configruation line for doing this? SURBLS-RHSBL rhsbl %MAILFROM%.sc.surbl.org 127.0.0.2 5 0 Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SURBL as RHSBL
I would rather not add six new tests to my config. Would you recommend a single SURBL test? Which one seems to work better? Regards, Jason - Original Message - From: Darin Cox [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 8:02 AM Subject: Re: [Declude.JunkMail] SURBL as RHSBL Hi Bill, You seem to always be one of the first to share new blacklists. Where do you find this info? Is there another list that would be worth joining? Thanks, man. Darin. - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 5:04 AM Subject: Re: [Declude.JunkMail] SURBL as RHSBL Modification, since I was not thinking, but Declude JunkMail does not support bitmasked responses. So instead of using the multi zone, you will need to use: SURBL_AB rhsbl ab.surbl.org127.0.0.2 1 0 SURBL_JP rhsbl jp.surbl.org127.0.0.2 1 0 SURBL_OB rhsbl ob.surbl.org127.0.0.2 1 0 SURBL_PH rhsbl ph.surbl.org127.0.0.2 1 0 SURBL_SC rhsbl sc.surbl.org127.0.0.2 1 0 SURBL_WS rhsbl ws.surbl.org127.0.0.2 1 0 Which will require six different queries if you want to use all SURBL lists. Bill - Original Message - From: Bill Landry To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 12:47 AM Subject: Re: [Declude.JunkMail] SURBL as RHSBL Markus, if you want to test against all of the SURBLs, since it's only a single query to the multi zone, use: SURBL_AB rhsbl multi.surbl.org127.0.0.32 1 0 SURBL_JP rhsbl multi.surbl.org127.0.0.64 1 0 SURBL_OB rhsbl multi.surbl.org127.0.0.16 1 0 SURBL_PH rhsbl multi.surbl.org127.0.0.8 1 0 SURBL_SC rhsbl multi.surbl.org127.0.0.2 1 0 SURBL_WS rhsbl multi.surbl.org127.0.0.4 1 0 AB = AbuseButler data JP = Combination of Prolocation data Joe Wein's SpamSpy data OB = OutBlaze data PH = Combination of MailPolice Fraud list data MailSecurity Phishing list data SC = SpamCop top 200 hits data WS = William Stearns submitter data I have been testing this for about an hour, and am getting a few hits. We'll see how it goes over the next 24 hours... Bill - Original Message - From: Markus Gufler To: [EMAIL PROTECTED] Sent: Monday, November 22, 2004 11:41 PM Subject: RE: [Declude.JunkMail] SURBL as RHSBL Is this the correct configruation line for doing this? SURBLS-RHSBL rhsbl %MAILFROM%.sc.surbl.org 127.0.0.2 5 0 Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SURBL as RHSBL
I would rather not add six new tests to my config. Would you recommend a single SURBL test? Which one seems to work better? I've running it now on my servers and can report the first results after 24 hours. I'll let you know how much and how accurate all 6 tests will perform. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SURBL as RHSBL
How are the results stacking up against your other RHSBL tests? Very promising. Near the top of the class for RHSBL tests. Here are my results: From 11/11/2004 throught 11/22: CatchallMails 53741 total 40835 spam (76%) AHBL-Domains 4580 total4188 spam (91.4%) Mailpolice Bulk 10629 total 10558 spam (99.3%) Mailpolice Porn 20 total20 spam (100%) RFCI badwhois domain 1326 total 1105 spam (83.3%) RFCI badwhois tld2228 total 1705 spam (76.5%) RFCI bogus mx 816 total752 spam (92.3%) RFCI DSN 2312 total 2282 spam (98.7%) RFCI No abuse 8187 total 6578 spam (80.4%) RFCI No postmaster 5915 total 5225 spam (88.4%) SecuritySage 1731 total1652 spam (95.5%) Sorbs BadConf191 total 191 spam (100%) Sorbs Nomail 0 total SURBL Multi 7957 total7921 spam (99.5%) Looking at the .5% of the SURBL-Multi that fell under my hold category, the bulk of these 36 definitely fall into the grey area of could be spam, might be legit. E-mail promoting training, surveys, compliance seminars and such. None of the .5% looks to be solidly legit. Starting 11/20 I broke out the tests and was looking at them individual... From 11/20 Noonish through 11/22: SURBL Multi 1741 total1733 spam (99.6%) SURBL Abuse Butler 11 total11 spam (100%) SURBL Bigevil 1585 total1577 spam (99.5%) SURBL Spamcop 46 total46 spam (100%) SURBL Outblaze 928 total 928 spam (100%) I don't believe the Jon Wein and the Phish are testable on their own. I haven't received an hits on jp.surbl.org. I did download Jon Wein's domains and Mailfrom's from his website and put them into my DNS for rhsbl and mfbl testing. Yesterday since 10 AM I had Jon Wein Domain 573 total 573 spam (100%) Jon Wein Mailfrom1 total 1 spam (100%) - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, November 22, 2004 6:12 PM Subject: Re: [Declude.JunkMail] SURBL as RHSBL Hmmm, that could possibly render some decent results if spammers use the same domain in the MAIL FROM: address in the SMTP envelope as they us in the URI listed in the body of the message. How are the results stacking up against your other RHSBL tests? Bill - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, November 22, 2004 2:59 PM Subject: [Declude.JunkMail] SURBL as RHSBL I know it is not the intended use of the SURBL list, but is anyone else using the SURBL test as a RHSBL test? I just figured if the URL is used for spam, do I really want to be receiving e-mail from that domain? So far it has been 99.5% effective. I'm just curious to see if anyone else has tried it? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SURBL as RHSBL
It's info gleaned from several different lists. I always try to report anything new to this list anyway... Bill - Original Message - From: Darin Cox To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 6:02 AM Subject: Re: [Declude.JunkMail] SURBL as RHSBL Hi Bill,You seem to always be one of the first to share new blacklists. Where doyou find this info? Is there another list that would be worth joining?Thanks, man.Darin.- Original Message - From: "Bill Landry" [EMAIL PROTECTED]To: [EMAIL PROTECTED]Sent: Tuesday, November 23, 2004 5:04 AMSubject: Re: [Declude.JunkMail] SURBL as RHSBLModification, since I was not thinking, but Declude JunkMail does notsupport bitmasked responses. So instead of using the multi zone, you willneed to use:SURBL_AB rhsbl ab.surbl.org 127.0.0.2 1 0SURBL_JP rhsbl jp.surbl.org 127.0.0.2 1 0SURBL_OB rhsbl ob.surbl.org 127.0.0.2 1 0SURBL_PH rhsbl ph.surbl.org 127.0.0.2 1 0SURBL_SC rhsbl sc.surbl.org 127.0.0.2 1 0SURBL_WS rhsbl ws.surbl.org 127.0.0.2 1 0Which will require six different queries if you want to use all SURBL lists.Bill- Original Message - From: Bill LandryTo: [EMAIL PROTECTED]Sent: Tuesday, November 23, 2004 12:47 AMSubject: Re: [Declude.JunkMail] SURBL as RHSBLMarkus, if you want to test against all of the SURBLs, since it's only asingle query to the multi zone, use:SURBL_AB rhsbl multi.surbl.org 127.0.0.32 1 0SURBL_JP rhsbl multi.surbl.org 127.0.0.64 1 0SURBL_OB rhsbl multi.surbl.org 127.0.0.16 1 0SURBL_PH rhsbl multi.surbl.org 127.0.0.8 1 0SURBL_SC rhsbl multi.surbl.org 127.0.0.2 1 0SURBL_WS rhsbl multi.surbl.org 127.0.0.4 1 0AB = AbuseButler dataJP = Combination of Prolocation data Joe Wein's SpamSpy dataOB = OutBlaze dataPH = Combination of MailPolice "Fraud" list data MailSecurity "Phishing"list dataSC = SpamCop top 200 hits dataWS = William Stearns submitter dataI have been testing this for about an hour, and am getting a few hits.We'll see how it goes over the next 24 hours...Bill- Original Message - From: Markus GuflerTo: [EMAIL PROTECTED]Sent: Monday, November 22, 2004 11:41 PMSubject: RE: [Declude.JunkMail] SURBL as RHSBLIs this the correct configruation line for doing this?SURBLS-RHSBL rhsbl %MAILFROM%.sc.surbl.org 127.0.0.2 5 0Markus---[This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] SURBL as RHSBL
- Original Message - From: Scott Fisher I don't believe the Jon Wein and the Phish are testable on their own. I haven't received an hits on jp.surbl.org. Yep, that does appear to be the case for the JP list - it was the last list added to SURBL, and since it was added after the creation of the MULTI bitmasked setup, it was apparently never setup as a separate zone. The PH list has a very low hit rate anyway, since it only contains a few hundred domains. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SURBL as RHSBL
WS is the heaviest hitter. You could add all of these lists as a single test which will hit on any response from any of the lists: SURBL rhsbl multi.surbl.org * 1 0 Bill - Original Message - From: Jason @ AreaTech To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 7:15 AM Subject: Re: [Declude.JunkMail] SURBL as RHSBL I would rather not add six new tests to my config. Would you recommend asingle SURBL test? Which one seems to work better?Regards,Jason- Original Message - From: "Darin Cox" [EMAIL PROTECTED]To: [EMAIL PROTECTED]Sent: Tuesday, November 23, 2004 8:02 AMSubject: Re: [Declude.JunkMail] SURBL as RHSBL Hi Bill, You seem to always be one of the first to share new blacklists. Where do you find this info? Is there another list that would be worth joining? Thanks, man. Darin. - Original Message - From: "Bill Landry" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 5:04 AM Subject: Re: [Declude.JunkMail] SURBL as RHSBL Modification, since I was not thinking, but Declude JunkMail does not support bitmasked responses. So instead of using the multi zone, you will need to use: SURBL_AB rhsbl ab.surbl.org 127.0.0.2 1 0 SURBL_JP rhsbl jp.surbl.org 127.0.0.2 1 0 SURBL_OB rhsbl ob.surbl.org 127.0.0.2 1 0 SURBL_PH rhsbl ph.surbl.org 127.0.0.2 1 0 SURBL_SC rhsbl sc.surbl.org 127.0.0.2 1 0 SURBL_WS rhsbl ws.surbl.org 127.0.0.2 1 0 Which will require six different queries if you want to use all SURBLlists. Bill - Original Message - From: Bill Landry To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 12:47 AM Subject: Re: [Declude.JunkMail] SURBL as RHSBL Markus, if you want to test against all of the SURBLs, since it's only a single query to the multi zone, use: SURBL_AB rhsbl multi.surbl.org 127.0.0.32 1 0 SURBL_JP rhsbl multi.surbl.org 127.0.0.64 1 0 SURBL_OB rhsbl multi.surbl.org 127.0.0.16 1 0 SURBL_PH rhsbl multi.surbl.org 127.0.0.8 1 0 SURBL_SC rhsbl multi.surbl.org 127.0.0.2 1 0 SURBL_WS rhsbl multi.surbl.org 127.0.0.4 1 0 AB = AbuseButler data JP = Combination of Prolocation data Joe Wein's SpamSpy data OB = OutBlaze data PH = Combination of MailPolice "Fraud" list data MailSecurity "Phishing" list data SC = SpamCop top 200 hits data WS = William Stearns submitter data I have been testing this for about an hour, and am getting a few hits. We'll see how it goes over the next 24 hours... Bill - Original Message - From: Markus Gufler To: [EMAIL PROTECTED] Sent: Monday, November 22, 2004 11:41 PM Subject: RE: [Declude.JunkMail] SURBL as RHSBL Is this the correct configruation line for doing this? SURBLS-RHSBL rhsbl %MAILFROM%.sc.surbl.org 127.0.0.2 5 0 Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] SURBL as RHSBL
Folks, apparently the PH and JP lists were never setup as separate SURBL zones, so I would recommend not querying those lists as you will never get a response from them until Declude JunkMail supports bitmasked responses. Bill - Original Message - From: Markus Gufler To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 7:32 AM Subject: RE: [Declude.JunkMail] SURBL as RHSBL I would rather not add six new tests to my config. Would you recommend a single SURBL test? Which one seems to work better?I've running it now on my servers and can report the first results after 24hours. I'll let you know how much and how accurate all 6 tests will perform.Markus---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] SURBL as RHSBL
thanks for pointing that out. Looking at the first hourly results from MDLP I can see some hits for WS. (around 15 per hour) OB, SC and AB has only one up to 4 hits per hour. The SURBL filter file has between 300 and 400 hits in the same time ranges. There was no SH result (SURBL says it's Spam but final weight say it's Ham) Nearly all messages catched by SURBL_xx has already a final weight above 200% of my hold weight. So don't expect too much, from SURBL - RHSBL lookups Markus From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill LandrySent: Tuesday, November 23, 2004 5:47 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] SURBL as RHSBL Folks, apparently the PH and JP lists were never setup as separate SURBL zones, so I would recommend not querying those lists as you will never get a response from them until Declude JunkMail supports bitmasked responses. Bill - Original Message - From: Markus Gufler To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 7:32 AM Subject: RE: [Declude.JunkMail] SURBL as RHSBL I would rather not add six new tests to my config. Would you recommend a single SURBL test? Which one seems to work better?I've running it now on my servers and can report the first results after 24hours. I'll let you know how much and how accurate all 6 tests will perform.Markus---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
[Declude.JunkMail] SURBL as RHSBL
I know it is not the intended use of the SURBL list, but is anyone else using the SURBL test as a RHSBL test? I just figured if the URL is used for spam, do I really want to be receiving e-mail from that domain? So far it has been 99.5% effective. I'm just curious to see if anyone else has tried it?
Re: [Declude.JunkMail] SURBL as RHSBL
Hmmm, that could possibly render some decent results if spammers use the same domain in the MAIL FROM: address in the SMTP envelope as they us in the URI listed in the body of the message. How are the results stacking up against your other RHSBL tests? Bill - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, November 22, 2004 2:59 PM Subject: [Declude.JunkMail] SURBL as RHSBL I know it is not the intended use of the SURBL list, but is anyone else using the SURBL test as a RHSBL test? I just figured if the URL is used for spam, do I really want to be receiving e-mail from that domain? So far it has been 99.5% effective. I'm just curious to see if anyone else has tried it? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SURBL as RHSBL
Is this the correct configruation line for doing this? SURBLS-RHSBL rhsbl %MAILFROM%.sc.surbl.org 127.0.0.2 5 0 Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
