Does Spamassassin support FCrDNS tests?

2009-02-05 Thread Marc Perkel
Does the spamassassin infrastructure support RBL lookups based on forward confirmed RDNS? For example. I have a white lists based on good host names. What would a rule look like that looks up these host names from my DNS list? domain.com.hostkarma.junkemailfilter.com = 127.0.0.1

Re: Secure spamd server

2009-02-03 Thread Marc Perkel
Andre wrote: Hi, we run Exim (4.69) with mail scanned at smtp time via acl. We put an external spamd server to work (works fine). Now we want to extend that setup by permitting another mail server (Exim, same setup) to connect to the spamd server. However, that transport has to happen over

rule to check for non existing header

2009-01-28 Thread Marc Patermann
to accomplish this? Marc

Re: rule to check for non existing header

2009-01-28 Thread Marc Patermann
these links: http://wiki.apache.org/spamassassin/WritingRules http://spamassassin.apache.org/full/3.2.x/doc/Mail_SpamAssassin_Conf.html meta SYMBOLIC_TEST_NAME boolean expression Define a boolean expression test ... Thanks for the hint. It works now. Marc

Re: rule to check for non existing header

2009-01-28 Thread Marc Patermann
RW schrieb: I think the test needs to end in /m if you want to use ^ otherwise it'll see all the headers as one big string and only match when it's the first header. I tried so much, it must have been gone by the time I was testing. But Karsten already helped me out. Thanks Marc

Re: FreeMail.pm

2009-01-28 Thread Marc Perkel
I would be willing to maintain an RBL type list of freemail domains if this would be useful. I could set up a VPS for the front end and provide several servers and lots of bandwidth for a backend.

Re: How can this free MX backup service be exploited?

2009-01-22 Thread Marc Perkel
Steve Freegard wrote: Marc Perkel wrote: I'm doing an experimental free MX backup service and wondering if it will get exploited. I'm wondering if I'm overlooking anything obvious? Here's the info on it: http://www.free-mx-backup.com The idea is that it detects if we are the secondary

Re: How can this free MX backup service be exploited?

2009-01-22 Thread Marc Perkel
RobertH wrote: I'm doing an experimental free MX backup service and wondering if it will get exploited. I'm wondering if I'm overlooking anything obvious? Here's the info on it: http://www.free-mx-backup.com The idea is that it detects if we are the secondary and not the primary MX

How can this free MX backup service be exploited?

2009-01-21 Thread Marc Perkel
I'm doing an experimental free MX backup service and wondering if it will get exploited. I'm wondering if I'm overlooking anything obvious? Here's the info on it: http://www.free-mx-backup.com The idea is that it detects if we are the secondary and not the primary MX and will store and

Re: New type of scam?

2009-01-11 Thread Marc Perkel
Filter on upper case GOD BLESS. Igor Chudov wrote: http://igor.chudov.com/tmp/spam006.txt Not sure what will follow, maybe asking $250 processing fee or something. Obviously I am not in the mood to write to this guy.

Looking for a volunteer for MX Backup service test

2008-12-31 Thread Marc Perkel
Looking few a few domains to test and automated MX backup service with some spam filtering. What you do is this. Add these two MX records as your two highest MX records. mail.example.com 10 mxbackup1.junkemailfilter.com 20 mxbackup2.junkemailfilter.com 30 And in theory it will just work. If

Blacklisting IPs from HTTP hacker?

2008-12-23 Thread Marc Perkel
Just a thought on blacklists. Has anyone tried mining the IP data from HTTP servers that use modsecurity? I'm wondering if the same computers that are spamming blogs are also spamming with email? Would this be a new way to catch spammers?

Re: URIBL Removal [OT]

2008-12-14 Thread Marc Perkel
My fault - never mind. I was doing something wrong. Karsten Bräckelmann wrote: On Sat, 2008-12-13 at 21:23 -0800, Marc Perkel wrote: I'm trying to get collaborate.com off of the URIBL list and I've submitted it for removal several times and nothing happens. Log in to your URIBL

URIBL Removal [OT]

2008-12-13 Thread Marc Perkel
I'm trying to get collaborate.com off of the URIBL list and I've submitted it for removal several times and nothing happens. Does anyone know why removal doesn't work? Thanks in advance

Looking for people to test free MX backup

2008-12-04 Thread Marc Perkel
I think I have it all ready to go. Looking for some volunteers to test my new email backup service. Contact me privately if you're interested. I'm looking for people with: 1) No greylisting - unless you exempt *.junkemailfilter.com from your greylisting. If you do that I want at least one

Re: Bug in iXhash plugin - fixed version available

2008-12-04 Thread Marc Perkel
Bill Landry wrote: Giampaolo Tomassoni wrote: -Original Message- From: Marc Perkel [mailto:[EMAIL PROTECTED] Sent: Wednesday, December 03, 2008 12:04 AM it's WORKING Well, it hangs my SA 3.2.4 setup on waiting for a reply from ctyme.ixhash.net . The strange thing

I'm thinking about offering a free MX backup service

2008-12-02 Thread Marc Perkel
Tell me if you think this is a good idea. I'm thinking about offering a free MX backup service that people without backup servers can use. I'm thinking about doing this as a way of promoting my spam filtering business because users will see a significant reduction in spam and might want to

Re: I'm thinking about offering a free MX backup service

2008-12-02 Thread Marc Perkel
Aaron Wolfe wrote: On Tue, Dec 2, 2008 at 2:51 PM, Marc Perkel [EMAIL PROTECTED] wrote: Tell me if you think this is a good idea. I'm thinking about offering a free MX backup service that people without backup servers can use. I'm thinking about doing this as a way of promoting my spam

Twist on Day Old Bread list idea

2008-12-02 Thread Marc Perkel
I'm experimenting with a new list. Been testing it for a couple of months. Got a radical idea. The problem with lists like Day Old Bread which lists new domains that spammers use is that there's a delay between when they are activated and when they are listed. It's just too hard to get a list

Re: I'm thinking about offering a free MX backup service

2008-12-02 Thread Marc Perkel
SM wrote: At 11:51 02-12-2008, Marc Perkel wrote: Tell me if you think this is a good idea. Everything that helps to promote your business is a good idea. :-) Thanks - but there are some other benefits to me. It will help enhance my black lists which will make them more useful

Re: I'm thinking about offering a free MX backup service

2008-12-02 Thread Marc Perkel
Rick Macdougall wrote: Marc Perkel wrote: Thanks Aaron, that is a good point. But I'm running Exim and I think I can code it so that it will not generate backscatter. I'll have to design that in up front. Interesting, how would you do that without dropping email (which is BAD). Rick

Re: I'm thinking about offering a free MX backup service

2008-12-02 Thread Marc Perkel
Aaron Wolfe wrote: On Tue, Dec 2, 2008 at 3:59 PM, Marc Perkel [EMAIL PROTECTED] wrote: Rick Macdougall wrote: Marc Perkel wrote: Thanks Aaron, that is a good point. But I'm running Exim and I think I can code it so that it will not generate backscatter. I'll have

Re: Bug in iXhash plugin - fixed version available

2008-12-02 Thread Marc Perkel
it's WORKING Dirk Bonengel wrote: OK, I found the bug. I just released a fixed release. Thanks to Lars Uhlmann for finding the culprit and delivering a fix. Problem was the regular expression checking the IP returned if it belongs to the 127.x.x.x range. Hmm, I had this working

Re: I'm thinking about offering a free MX backup service

2008-12-02 Thread Marc Perkel
RobertH wrote: If the recipient is bad then no one would have got the email anyway. But there wouldn't a a notification to the sender. I suppose I could make it smarter so that if the message is blessed in one of my many white lists then I would do a bounce message, otherwise not.

Re: New version of iXhash plugin available

2008-12-01 Thread Marc Perkel
I noticed this morning that I also had 0 ixhash hits. Is something wrong? Rose, Bobby wrote: Has anyone who switched to 1.5 of iXHash received any hits? I haven't seen any since switching. One thing that I've noticed is if I pass the same message thru SA using the old iXhash, the hash is

Re: Bug in iXhash plugin - fixed version available

2008-12-01 Thread Marc Perkel
Hi Dirk, I'm not getting any hits on the new version either. Dirk Bonengel wrote: Folks, as some of you already noticed I f... up the last (1.5) release of the iXhash plugin. Plain simple a wrong regular expression practically disables hash #1. I just uploaded a fixed version to

Re: Is spam volume really down

2008-11-21 Thread Marc Perkel
I noticed the size of my black list dropped by more that 1/3 this last week.

Re: hostkarma junkemailfilter

2008-11-18 Thread Marc Perkel
? I still maintain my position. Good for point or two, but way too many big legimate smtp gateways and listservers listed for my traffic. Almost 30% of hits are FPs. Marc has good ideas, but the execution is lacking. http://marc.info/?l=spamassassin-usersm=120611144819910 If we had

Re: Long scan times with ctyme.ixhash.net

2008-09-29 Thread Marc Perkel
Jan Doberstein wrote: Wolfgang Zeikat schrieb: Do others also see that effect with ctyme.ixhash.net? yes, thats why i added ixhash_timeout 10 to my configuration (maybe hardware/bandwith on ctyme will be upgraded) regards jd For what it's worth I'm the one who is providing

Trying out a new concept

2008-09-22 Thread Marc Perkel
I don't know how this will work but I'm building the data now. For those of you who are familiar with Day old bread lists to detect new domains, as you know there's a lag time in the data and they often don't have data from all the registries. So - here's a different solution. What I'm

Re: Trying out a new concept

2008-09-22 Thread Marc Perkel
Ken A wrote: Marc Perkel wrote: I don't know how this will work but I'm building the data now. For those of you who are familiar with Day old bread lists to detect new domains, as you know there's a lag time in the data and they often don't have data from all the registries. So - here's

Re: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-22 Thread Marc Perkel
McDonald, Dan wrote: Henrik K wrote: On Mon, Sep 22, 2008 at 09:23:45AM -0500, Daniel J McDonald wrote: On Mon, 2008-09-22 at 10:14 -0400, Justin Piszcz wrote: On Mon, 22 Sep 2008, Daniel J McDonald wrote: On Sun, 2008-09-21 at 18:18 -0500, Len Conrad

Re: Trying out a new concept

2008-09-22 Thread Marc Perkel
McDonald, Dan wrote: On Mon, 2008-09-22 at 15:44 -0700, Marc Perkel wrote: Ken A wrote: Marc Perkel wrote: I don't know how this will work but I'm building the data now. For those of you who are familiar with Day old bread lists to detect new domains, as you know there's

Re: Trying out a new concept

2008-09-22 Thread Marc Perkel
Blaine Fleming wrote: John Hardin wrote: Why is it so flippin' difficult to get a feed of newly-registered domain names? Because the TLDs hate giving people access to the data and certainly won't provide a feed without a bunch of cash involved. Even worse, all the ccTLDs pretty much

I've created a new Day Old Bread type list RBL

2008-09-17 Thread Marc Perkel
I've been working with Blaine Flemming and he's compiling his own DOB data and I'm publishing it for him. I'm throwing it out there to see if any of you find it as useful as I am finding it. The list can be accessed as follows: hostkarma.junkemailfilter.com = 127.0.0.6 What I'm catching is

rbldnsd blacklist question

2008-09-16 Thread Marc Perkel
Looking from opinions from people running rbl blacklists. I have a list that contains a lot of name based information. I'm about to add a lot more information to the list and what will happen is that when you look up a name you might get several results. For example, a hostname might be

New Day old Bread list trick

2008-09-15 Thread Marc Perkel
I just discovered the Day old Bread list of host names under 5 days old. I don't know where they get it but the list is very useful. As many of you know I also track hosts that don't use the QUIT command to close connections. So it occurred to me that if a domain is less than 5 days old AND

Re: New Day old Bread list trick

2008-09-15 Thread Marc Perkel
Great minds think alike. :) What I'm doing is a modification of this. I'm using the Day old Bread list but only adding IF they also skip the QUIT to close the connection AND I'm subtracting out my white list. Curtis LaMasters wrote: This is quite an interesting trick. Never actually thought

Re: New Day old Bread list trick

2008-09-15 Thread Marc Perkel
Blaine Fleming wrote: Marc Perkel wrote: I just discovered the Day old Bread list of host names under 5 days old. I don't know where they get it but the list is very useful. I remember playing with this list a few years ago but now they seem to lag a few days behind. For example

Re: New Day old Bread list trick

2008-09-15 Thread Marc Perkel
Blaine Fleming wrote: Marc Perkel wrote: Blaine Fleming wrote: Marc Perkel wrote: I just discovered the Day old Bread list of host names under 5 days old. I don't know where they get it but the list is very useful. I remember playing with this list a few years ago but now they seem

Experimenting with QUIT and NOTQUIT - New DNS list

2008-09-07 Thread Marc Perkel
For those of you who want to experiment I've created a new dnsrbl list of IP addresses and host names that use QUIT to close connections and those who do not use QUIT. I have found that there are a few legitimate senders who are skipping using QUIT to close. Here's the rules. I have about 5

Re: Handy script for generating /etc/resolv.conf

2008-09-01 Thread Marc Perkel
Aaron Wolfe wrote: On Sun, Aug 31, 2008 at 10:59 PM, RobertH [EMAIL PROTECTED] wrote: It was explained somewhere earlier in the thread that he sometimes has to reboot his central dns servers and he apparently doesn't run local caching servers on the individual MX/SA nodes. I have to say

Re: Handy script for generating /etc/resolv.conf

2008-08-31 Thread Marc Perkel
Well, the code works for me. If someone has a better solution I'll switch to yours. I just created it because I needed it and thought I'd share it with others who might need it. But if any of you want to improve it or replace it with something better I'm always looking for new tricks.

Handy script for generating /etc/resolv.conf

2008-08-28 Thread Marc Perkel
Here's something I threw together to make sure the /etc/resolv.conf points to a working nameserver. I run this once a minute. It checks to see what name servers are up and creates /etc/resolv.conf. As you all know SA and mail servers need the first nameserver to always be working. #!/bin/bash

Re: Handy script for generating /etc/resolv.conf

2008-08-28 Thread Marc Perkel
Marc Perkel wrote: Here's something I threw together to make sure the /etc/resolv.conf points to a working nameserver. I run this once a minute. It checks to see what name servers are up and creates /etc/resolv.conf. As you all know SA and mail servers need the first nameserver to always

Re: Handy script for generating /etc/resolv.conf

2008-08-28 Thread Marc Perkel
Matus UHLAR - fantomas wrote: On 28.08.08 08:41, Marc Perkel wrote: Here's something I threw together to make sure the /etc/resolv.conf points to a working nameserver. do you have problems with nameservers? Do you run own one? I guess that setting timeout, rotate and attempts

Re: Handy script for generating /etc/resolv.conf

2008-08-28 Thread Marc Perkel
Matus UHLAR - fantomas wrote: We have 4 DNS servers behind L3 switch that monitors DNS servers... This script is a poor man's L3 switch. :)

Re: Handy script for generating /etc/resolv.conf

2008-08-28 Thread Marc Perkel
Ralf Hildebrandt wrote: * Matus UHLAR - fantomas [EMAIL PROTECTED]: I guess that setting timeout, rotate and attempts options in resolv.conf could help you more than such script Nice tip, but there's no option that will back off from a dead DNS. Of course timeout/attempts and

spamd: bad protocol: header error

2008-08-26 Thread Marc Perkel
Getting a lot of these: spamd: bad protocol: header error: (closed before headers) at /usr/bin/spamd line 2001. Not sure what this means. Thanks in advance for your help.

Re: Blacklist Mining Project - Project Tarbaby

2008-08-26 Thread Marc Perkel
Robert Schetterer wrote: Marc Perkel schrieb: Hi everyone, I'm launching a free spam reduction service to help build up my blacklists. It involves adding a fake high numbered MX record to your existing MX list that points to one of our servers. We always return a 451 error but we have

Re: Blacklist Mining Project - Project Tarbaby

2008-08-26 Thread Marc Perkel
Graham Murray wrote: Ralf Hildebrandt [EMAIL PROTECTED] writes: * Robert Schetterer [EMAIL PROTECTED]: thats could be seen as a security risk cause in rare cases you may recieve legal mails i.e at an network outage etc How? He tempfails all mails. Because some senders

Re: Blacklist Mining Project - Project Tarbaby

2008-08-26 Thread Marc Perkel
Ken A wrote: Ralf Hildebrandt wrote: * Robert Schetterer [EMAIL PROTECTED]: Project Tarbaby helps you reduce spam and helps us build our blacklist. This is done by adding a fake MX record to your existing MX lists thats could be seen as a security risk cause in rare cases you may

Re: Blacklist Mining Project - Project Tarbaby

2008-08-26 Thread Marc Perkel
Postini's contract to the one you get from Marc? Ummm.. just in case you have no luck finding that, what about a Privacy policy? See the link at bottom of http://wiki.junkemailfilter.com/index.php/Project_tarbaby for the Privacy Policy. It's currently a blank page. That doesn't give me a secure

Re: Blacklist Mining Project - Project Tarbaby

2008-08-26 Thread Marc Perkel
Aaron Wolfe wrote: On Tue, Aug 26, 2008 at 12:26 PM, Marc Perkel [EMAIL PROTECTED] wrote: You continue to miss the point, or maybe you just don't want to understand it. Sending my client's email to your servers is irresponsible at best and possibly even a violation of contract or illegal

Blacklist Mining Project - Project Tarbaby

2008-08-25 Thread Marc Perkel
Hi everyone, I'm launching a free spam reduction service to help build up my blacklists. It involves adding a fake high numbered MX record to your existing MX list that points to one of our servers. We always return a 451 error but we have a very good way of detecting virus infected spam

Re: Blacklist Mining Project - Project Tarbaby

2008-08-25 Thread Marc Perkel
Jean-Paul Natola wrote: Hi everyone, I'm launching a free spam reduction service to help build up my blacklists. It involves adding a fake high numbered MX record to your existing MX list that points to one of our servers. We always return a 451 error but we have a very good way of

Looking for dead domains that still get a lot of spam

2008-08-21 Thread Marc Perkel
We are harvesting data for our blacklists. Do you have an old dead domain that gets a lot of spam? We could use it. Just point your MX record to us. tarbaby.junkemailfilter.com Here's the details of what we are doing with it. It also covers using us as your fake highest MX record.

Re: Looking for dead domains that still get a lot of spam

2008-08-21 Thread Marc Perkel
Whoops - Here's the real link. http://wiki.junkemailfilter.com/index.php/Project_tarbaby Marc Perkel wrote: We are harvesting data for our blacklists. Do you have an old dead domain that gets a lot of spam? We could use it. Just point your MX record to us. tarbaby.junkemailfilter.com

Free Spam Reduction Service - Project Tarbaby

2008-08-18 Thread Marc Perkel
Hi everyone, I'm launching a free spam reduction service to help build up my blacklists. It involves adding a fake high numbered MX record to your existing MX list that points to one of our servers. We always return a 451 error but we have a very good way of detecting virus infected spam

I'd like to get my blacklist/whitelist included in SA

2008-07-25 Thread Marc Perkel
I'm referring to the Hostkarma list from junk email filter. http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists What is the procedure/requirements to make this happen? I have 4 servers running rbldnsd. Questions What kind of license do I need to provide to be SA compatible? What

Re: [OT] Odd spammer tactic?

2008-07-22 Thread Marc Perkel
There's people out there who are better and faster programmers than I am. I need a simple utility written We can post it on the SA Wiki when we're done. I don't care what it's written in but I'm thinking that xinetd might be easiest. What I want is something to record the IP address of any

Re: [OT] Odd spammer tactic?

2008-07-22 Thread Marc Perkel
Ramprasad wrote: Marc Perkel wrote: There's people out there who are better and faster programmers than I am. I need a simple utility written We can post it on the SA Wiki when we're done. I don't care what it's written in but I'm thinking that xinetd might be easiest. What I want

Re: [OT] Odd spammer tactic?

2008-07-22 Thread Marc Perkel
be. Jonas Eckerman wrote: Marc Perkel wrote: I don't care what it's written in but I'm thinking that xinetd might be easiest. What I want is something to record the IP address of any host connection to port 25. You don't really need to accept the connection. Just logging connection attenmpts

Re: [OT] Odd spammer tactic?

2008-07-21 Thread Marc Perkel
Christopher Bort wrote: This is really not a SpamAssassin issue, but since this list is populated by people who are interested in spammer behavior, I'm throwing it out for comment. If it's too far off topic, my apologies and I'll let it go at that. At $DAYJOB I run a mail server and a name

Sendmail Question [OT]

2008-07-18 Thread Marc Perkel
Just a quick sendmail question I'm asking for a friend. If they want to make sendmail listen on port 2525 instead of 25 - what do they meed to change? Email me privately off list. Thanks in advance

Re: Is ASN information useful?

2008-07-15 Thread Marc Perkel
Matthias Leisi wrote: Marc Perkel schrieb: Has anyone determined if ASN information is useful in determining if a message is/is not spam? Unfortunately, it does not seem to be *that* useful: http://matthias.leisi.net/archives/176-Where-does-your-spam-come-from.html -- Matthias

Suggestion for Freemail Plugin Enhancements

2008-07-14 Thread Marc Perkel
May I suggest that the test for reply_to and email addresses in the body of the email be separate routins and separate rules and separate scores. Also perhaps there should be a rule to see if the from is freemail but no freemail in received headers. For example, from is yahoo.com but no yahoo

Is ASN information useful?

2008-07-14 Thread Marc Perkel
Has anyone determined if ASN information is useful in determining if a message is/is not spam?

Re: Detecting the Registrar of the sending host?

2008-07-07 Thread Marc Perkel
Yet Another Ninja wrote: On 7/2/2008 6:05 PM, Marc Perkel wrote: Is there an easy way to detect the registrar of a domain through DNS? For example - can I easilly figure out if an email I'm processing is hosted by GoDaddy or Tucows? Here's what I'm thinking. I think there's some expensive

Re: Better whitelisting with DNSWL

2008-07-03 Thread Marc Perkel
Henrik K wrote: On Thu, Jul 03, 2008 at 10:48:07AM +0200, Matus UHLAR - fantomas wrote: On 03.07.08 11:35, Henrik K wrote: I'd like to encourage people to take more advantage of DNSWL. I'm currently converting DNSWL entries into trusted_networks and using shortcircuited

Re: Detecting the Registrar of the sending host?

2008-07-03 Thread Marc Perkel
Matus UHLAR - fantomas wrote: On 03.07.08 13:22, Henrik K wrote: If lesser registrar means that it's probably ham, why couldn't someone use that to add some negative scores or use it as a part of whitelist trustworthiness? Even if it's handful of domains, it's useful. If you could get the

Re: Detecting the Registrar of the sending host?

2008-07-03 Thread Marc Perkel
Michele Neylon wrote: On 2 Jul 2008, at 19:56, Marc Perkel wrote: Again - it's not to figure out where spam comes from. It's figuring out where non-spam comes from. I think there are registrars out there that don't have any spam domains registered. What are you trying to prove

Re: Detecting the Registrar of the sending host?

2008-07-03 Thread Marc Perkel
Richard Frovarp wrote: Marc Perkel wrote: Michele Neylon wrote: On 2 Jul 2008, at 19:56, Marc Perkel wrote: Again - it's not to figure out where spam comes from. It's figuring out where non-spam comes from. I think there are registrars out there that don't have any spam domains

Detecting the Registrar of the sending host?

2008-07-02 Thread Marc Perkel
Is there an easy way to detect the registrar of a domain through DNS? For example - can I easilly figure out if an email I'm processing is hosted by GoDaddy or Tucows? Here's what I'm thinking. I think there's some expensive and highly secure registrars out there who are the registrar of

Re: Detecting the Registrar of the sending host?

2008-07-02 Thread Marc Perkel
John Hardin wrote: On Wed, 2 Jul 2008, Marc Perkel wrote: Is there an easy way to detect the registrar of a domain through DNS? For example - can I easilly figure out if an email I'm processing is hosted by GoDaddy or Tucows? Registrar != hosted by. Here's what I'm thinking. I think

Re: Detecting the Registrar of the sending host?

2008-07-02 Thread Marc Perkel
Martin Gregorie wrote: On Wed, 2008-07-02 at 17:05, Marc Perkel wrote: Is there an easy way to detect the registrar of a domain through DNS? For example - can I easilly figure out if an email I'm processing is hosted by GoDaddy or Tucows? Even if it was possible I don't think its

Re: Detecting the Registrar of the sending host?

2008-07-02 Thread Marc Perkel
Martin Gregorie wrote: On Wed, 2008-07-02 at 18:46, Marc Perkel wrote: Martin Gregorie wrote: On Wed, 2008-07-02 at 17:05, Marc Perkel wrote: Is there an easy way to detect the registrar of a domain through DNS? For example - can I easilly figure out if an email I'm

Fremail Plugin Suggestion

2008-06-30 Thread Marc Perkel
I'd like to suggest an additional feature for the freemail plugin. If you test the sending host through FCrDNS and determine that the sending host is a freemail hostname (like google.com) then you should consider it a freemail sender. Thus if the sending host is Google, but the reply-to or an

Re: Fremail Plugin Suggestion

2008-06-30 Thread Marc Perkel
Henrik K wrote: On Sun, Jun 29, 2008 at 11:37:13PM -0700, Marc Perkel wrote: I'd like to suggest an additional feature for the freemail plugin. If you test the sending host through FCrDNS and determine that the sending host is a freemail hostname (like google.com) then you should

Re: Spam volumes down since last week

2008-06-24 Thread Marc Perkel
Daniel J McDonald wrote: On Tue, 2008-06-24 at 10:19 -0400, Randy Ramsdell wrote: ram wrote: I am seeing a clear downtrend in the number for spams hitting our servers, I am not sure why ? Since Last week spams are at 50% of what they used to be last month. Is this what you all are

Fake MX Record(s) Trick

2008-06-23 Thread Marc Ferguson
.example.com 30 Marc F. ..Grace to you and peace from Him who is and who was and who is to come.. -Rev1:4

Re: Fake MX Record(s) Trick

2008-06-23 Thread Marc Perkel
Marc Ferguson wrote: Hi, I'm a linux noob and a spam assassin noob so please reply in simplified language. Thanks. I saw on the wiki a trick to use fake mx records in order to weed out spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home and on my laptop

Odd number of elements in hash assignment

2008-06-10 Thread Marc Perkel
What would cause this? Jun 10 11:21:29 spamd0 spamd[20360]: Odd number of elements in hash assignment at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/BayesStore.pm line 322. Jun 10 11:21:29 spamd0 spamd[20360]: Use of uninitialized value in list assignment at

I need your spam!

2008-06-05 Thread Marc Perkel
Actually - I just need your spam attempts. I have a way to detect spambots on the first try and add them to my blacklist at hostkarma.junkemailfilter.com Sp - if you want to participate and lose a chunk of your virus spambot spam all you have to do is add us as your highest numbered MX

Re: List of Banks often spoofed in Phishing scams

2008-06-04 Thread Marc Perkel
Randal, Phil wrote: We should be marking ALL such behaviour as phishing and hope that the banks (etc) finally get a clue. I certainly wouldn't trust my money with an outfit that was that clueless about security. Cheers, Phil Actually in some ways this leads to an interesting idea. In

List of Banks often spoofed in Phishing scams

2008-06-03 Thread Marc Perkel
Here's a short list of banks often spoofed in phishing scams. I'm using this list as follows: If the FCrDNS matches one of these domains it is ham. If the sender or from address matches one of these domains and the domain doesn't appear in the Received headers - it's a phish. If anyone has

Re: List of Banks often spoofed in Phishing scams

2008-06-03 Thread Marc Perkel
Patrick McLean wrote: royalbankofcanada.com This is the wrong URL for the Royal Bank, it appears to be a domain camping site. Generally RBC's emails come from rbc.com, they also own royalbank.com, royalbank.ca, rbcroyalbank.ca and rbcroyalbank.com. Also you can add: desjardins.com I get

Proposal for free mail domain DNS list

2008-06-02 Thread Marc Perkel
In the freemail plugin rather that listing all the domains in the plugin I propose a network of DNS servers that list the names using rbldnsd. We also have a central location where we maintain the list. That way the list can be updated faster and people have current information. I suggest

Re: Proposal for free mail domain DNS list

2008-06-02 Thread Marc Perkel
Henrik K wrote: On Mon, Jun 02, 2008 at 08:09:40AM -0700, Marc Perkel wrote: In the freemail plugin rather that listing all the domains in the plugin I propose a network of DNS servers that list the names using rbldnsd. We also have a central location where we maintain the list

Re: google netblocks records etc

2008-06-02 Thread Marc Perkel
Robert - elists wrote: Since they seem to have zillions of outbound mx machines I did this in response to some email latency issues. dig google.com txt google.com. 31 IN TXT v=spf1 include:_netblocks.google.com ~all then i dig _netblocks.google.com txt

Re: DNS ISP Host List Available

2008-05-31 Thread Marc Perkel
Henrik K wrote: On Thu, May 29, 2008 at 11:25:19AM -0700, Marc Perkel wrote: I've also created a DNS based list of domains that provide consumer dynamic IP address space. I'm using this list internally but thought I'd make it public in case others can use it. Trying to inspire

Re: DNS ISP Host List Available

2008-05-30 Thread Marc Perkel
Matus UHLAR - fantomas wrote: Marc Perkel wrote: I've also created a DNS based list of domains that provide consumer dynamic IP address space. I'm using this list internally but thought I'd make it public in case others can use it. Trying to inspire innovation. Example: dig

Freemail Domains DNS Lookup

2008-05-29 Thread Marc Perkel
I now have a name based DNS lookup for freemail domains. If anyone finds this useful let me know. example: dig yahoo.com.freemaildomains.junkemailfilter.com

DNS ISP Host List Available

2008-05-29 Thread Marc Perkel
I've also created a DNS based list of domains that provide consumer dynamic IP address space. I'm using this list internally but thought I'd make it public in case others can use it. Trying to inspire innovation. Example: dig comcast.com.isphosts.junkemailfilter.com This list was created by

Re: DNS ISP Host List Available

2008-05-29 Thread Marc Perkel
Ken A wrote: Marc Perkel wrote: I've also created a DNS based list of domains that provide consumer dynamic IP address space. I'm using this list internally but thought I'd make it public in case others can use it. Trying to inspire innovation. Example: dig

Interesting data - but is it good for anything?

2008-05-23 Thread Marc Perkel
I started collecting host names where the registry barrier part of the FCrDNS is the same as the registry barrier part of the helo. I don't know what it's good for - if anything - but looking for ideas as to what to do with it. Just have a gut level feeling that I'm on to something here.

Re: Experimental - use my server for your high fake MX record

2008-05-21 Thread Marc Perkel
mouss wrote: Jo Rhett wrote: On May 7, 2008, at 9:17 AM, mouss wrote: what if he comes back later to the same MX, again and again (AFAIK, this is the case with qmail)? mail will be lost. snarky comment Good. Time for qmail to die ;-) /snarky comment start by updating the RFCs.

Re: Experimental - use my server for your high fake MX record

2008-05-21 Thread Marc Perkel
Jo Rhett wrote: On May 7, 2008, at 9:17 AM, mouss wrote: what if he comes back later to the same MX, again and again (AFAIK, this is the case with qmail)? mail will be lost. snarky comment Good. Time for qmail to die ;-) /snarky comment Agreed. Qmail should die!

Mining fake MX and no QUIT for spambot project

2008-05-20 Thread Marc Perkel
Hi everyone, I'm back from vacation and want to pick up where I left off. I had offered to let anyone use one of my hosts. tarbaby.junkemailfilter.com as your highest numbered MX. The idea being that I would always return a 451 error. You would gain some spam reduction and I would gain

Re: Mining fake MX and no QUIT for spambot project

2008-05-20 Thread Marc Perkel
continuing This project is targeted mostly at harvesting the IP addresses of virus infected spambots. First - some background. I virus infected spambot sends email differently than SMTP servers and there is enough difference that they can usually be detected on the first attempt to

<    3   4   5   6   7   8   9   10   11   12   >