Re: Mining fake MX and no QUIT for spambot project

2008-05-20 Thread Marc Perkel
... continued As I said in my last mesage. The High MX no quit spambot detectors will send UDP messages to a receiving server that listens for these messages and processes them into blacklists. What I'm doing is just using SOCAT to listen. But doing it right you might want to use a real

MySQL my.cnf file for innodb

2008-05-17 Thread Marc Perkel
Just looking for some my.cnf example files for SA. Server has 4 gigs of ram, dual core CPU. What do I want in my my.cnf file? Thanks in advance.

MySQL Unreliable

2008-05-16 Thread Marc Perkel
Need a little help for MySQL users. I'm running several servers that are using a common MySQL server for bayes for all the SA servers. What I'm seeing is that MySQL is just plain unreliable. The database is often corrupted and it does so in a manner that basically causes SA to hang until it

Re: MySQL Unreliable

2008-05-16 Thread Marc Perkel
SM wrote: At 06:30 16-05-2008, Marc Perkel wrote: I'm running several servers that are using a common MySQL server for bayes for all the SA servers. What I'm seeing is that MySQL is just plain unreliable. The database is often corrupted and it does so in a manner that basically causes SA

Re: How do I Test SpamAssassin

2008-05-16 Thread Marc Ferguson
the filters. I don't know if i'm saying it right. Mail does go to my junk box but i'd like more mail in my junkbox. I do not have full control over my mail server. Thanks. On Sun, 2008-05-11 at 11:32 +0200, Arvid Ephraim Picciani wrote: On Sunday 11 May 2008 09:13:28 Marc Ferguson wrote: Hi

Re: How do I Test SpamAssassin

2008-05-16 Thread Marc Ferguson
On Fri, 2008-05-16 at 22:10 -0600, Bob Proulx wrote: Please don't top-post. It makes it much harder to read. Marc Ferguson wrote: Arvid Ephraim Picciani wrote: just use spamc and feed a message manually, unless you want to test your MTA, in which case you need to check the manual

How do I Test SpamAssassin

2008-05-11 Thread Marc Ferguson
. I'm a regular user and I'm trying to apply this to my evolution application. Thanks for any clarification. Marc F.

Re: Experimental - use my server for your high fake MX record

2008-05-08 Thread Marc Perkel
ram wrote: IOn Wed, 2008-05-07 at 08:50 -0700, Marc Perkel wrote: Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free and mutual benefit. I (junkemailfilter.com) want to be your highest numbered

Re: Experimental - use my server for your high fake MX record

2008-05-08 Thread Marc Perkel
John Hardin wrote: On Thu, 8 May 2008, Marc Perkel wrote: To participate all you have to do is set your highest numbered MX to point to: tarbaby.junkemailfilter.com Several people have asked me how I'm doing this and can they have my code to do it themselves. My situation is unique

Re: Experimental - use my server for your high fake MX record

2008-05-08 Thread Marc Perkel
Kevin Parris wrote: Well now, if a spambot actually does start recognizing and avoiding his system, doesn't that mean he wins and the spammer loses? I would say YES! You should make an effort to clean it up so that others *can* install it as a standalone daemon, as I suggested. Why?

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread Marc Perkel
Randy Ramsdell wrote: DAve wrote: Marc Perkel wrote: Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free and mutual benefit. I (junkemailfilter.com) want to be your highest numbered fake MX record

Starting a URIBL - Howto? [OT]

2008-04-26 Thread Marc Perkel
I was just wondering from those of you who have done it - how to start a URIBL. I'm guessing the process (simplified) is: 1) Mine messages for links 2) Subtract out anything matching a fairly large white list So my first question here is - what do most of you used to mine the links in a

Help with SED [OT]

2008-04-26 Thread Marc Perkel
Trying to do something that should be simple. Using sed to remove the first part of a hostname but not working. I want: abc.def.com to become def.com I tried a lot of variations of the following but it's either greedy or does nothing. sed -e 's/^.*?[.]//' Thanks in advance.

Re: Looking for hosts to white list

2008-04-23 Thread Marc Perkel
Henrik K wrote: On Tue, Apr 22, 2008 at 07:50:33PM -0700, Marc Perkel wrote: What I'm looking to do with host name base white lists is use forward confirmed RDNS to keep certian domain from being accidentally blacklisted. What's funny is that you already mentioned this a bunch

Re: Looking for hosts to white list

2008-04-23 Thread Marc Perkel
Jon Armitage wrote: Justin Mason wrote: sorry Marc, you weren't the first to come up with that idea. He didn't say that he was, just that he was the first to raise it on the list. Jon It may have been 2001. But at the time I remember saying that all spam wants you to do something

Re: Looking for hosts to white list

2008-04-23 Thread Marc Perkel
Chris Santerre wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: 2008-04-23 10:48 To: Marc Perkel Cc: users@spamassassin.apache.org Subject: Re: Looking for hosts to white list Marc Perkel writes: Yep - one of the ideas I originated here

Re: Looking for hosts to white list

2008-04-23 Thread Marc Perkel
that are hitting stuff that other DNSBLs miss.. and which have low FPs... these are getting more and more rare these days. Therefore, I suspect that some of you are letting your weird biases against Marc (for whatever reason and however much deserved)... cause you to miss out on a good thing he has

Looking for hosts to white list

2008-04-22 Thread Marc Perkel
I'm looking for people who are running URI blacklists, but I'm more interested in your whitelist information. I have an extensive list myself and looking for partners to swap data with.

Re: Looking for hosts to white list

2008-04-22 Thread Marc Perkel
Benny Pedersen wrote: On Tue, April 22, 2008 23:47, Marc Perkel wrote: I'm looking for people who are running URI blacklists, but I'm more interested in your whitelist information. I have an extensive list myself and looking for partners to swap data with. hell no, dont give idears

Re: Looking for hosts to white list

2008-04-22 Thread Marc Perkel
stopping spammers from putting in amazon.com, google.com, yahoo.com, etc. and they can be pretty sure these domains are whitelisted already by the uribl organizations. On Wed, Apr 23, 2008 at 01:51:10AM +0200, Benny Pedersen wrote: On Tue, April 22, 2008 23:47, Marc Perkel wrote: I'm looking

No Blacklist DNS List

2008-04-17 Thread Marc Perkel
I've created a public no blacklist DNS list of host names and IP addresses that should never be blacklisted. Some of them are from my white list, some from my yellow list, and others are just names and IPs that you don't want to be on a blacklist. Here's the link that describes how to use it.

New DNS list for host information?

2008-04-03 Thread Marc Perkel
I'm considering a DNS list that would return strings as TXT records that contain key words that classify the Forward Confirmed rDNS name based on a number of flags. For example, if the host is yahoo.com it might contain yellow freemail indicating that it is yellow listed (mixed ham/spam) and

New DNS list for host information using strings instead of numbers

2008-04-03 Thread Marc Perkel
Theo Van Dinter wrote: I'm not saying anything positive or negative about the different lists, but there's a long precedent of doing this type of thing w/ bits in a standard DNS response. Look at SURBL and URIBL, for example -- a single response encodes multiple individual list entries, and

Re: FreeMail plugin

2008-03-24 Thread Marc Perkel
Henrik K wrote: Hello, I updated my FreeMail plugin with a big list of domains (http://www.rhyolite.com/anti-spam/freemail.html). Try it out: http://sa.hege.li/FreeMail.pm http://sa.hege.li/FreeMail.cf Pretty good hit ratio here, especially when you add some extra scores like FREEMAIL_FROM

Re: FreeMail plugin

2008-03-21 Thread Marc Perkel
Henrik K wrote: Hello, I updated my FreeMail plugin with a big list of domains (http://www.rhyolite.com/anti-spam/freemail.html). Try it out: http://sa.hege.li/FreeMail.pm http://sa.hege.li/FreeMail.cf Pretty good hit ratio here, especially when you add some extra scores like FREEMAIL_FROM

Re: Godaddy.com blacklisted (and deserves to be)

2008-03-20 Thread Marc Perkel
Michael Scheidell wrote: DNS ADMINS at godaddy need a lesson in RFC's. host -t mx godaddy.com godaddy.com mail is handled by 0 smtp.secureserver.net. godaddy.com mail is handled by 10 mailstore1.secureserver.net. host -t a smtp.secureserver.net smtp.secureserver.net is an alias for

Re: [spamassassin] Re: How to report 120,000 spams a day

2008-03-10 Thread Marc Perkel
SM wrote: At 17:51 08-03-2008, Tuc at T-B-O-H.NET wrote: As part of it all, I also want to try to keep disk usage and CPU down to as little as possible. With 120,000 per day, thats a junk mail every 3/4's of a second. Since I have it set to deliver to /dev/null, I reduce the amount of

Re: How many use CRM114?

2008-03-04 Thread Marc Perkel
that it works better than other learning methods. Any info would be appreciated. Hello I've only just started using it on a test server, I'll let you know how I find the results! CRM114? What's that? Can't quite figure out what it does. Is it a pony? :) -- Marc Perkel - Sales/Support [EMAIL

Wiki page on experimental spam fighting techniques

2008-03-03 Thread Marc Perkel
that in the past when I put ideas in the wiki that other people often pick up on them and do a better job than me. So - here's the link. Looking for constructive feedback. http://wiki.apache.org/spamassassin/MarcPerkelsExperiments -- Marc Perkel - Sales/Support [EMAIL PROTECTED] http://www.junkemailfilter.com

Re: Time to blacklist google.

2008-02-29 Thread Marc Perkel
. Either case, till google fixes their network and attitude, we should blacklist them. Some people might think you are over reacting I can only imagine what it would be like trying to control outgoing spam at Google. -- Marc Perkel - Sales/Support [EMAIL PROTECTED] http

Sorry for the duplicate messages

2008-02-29 Thread Marc Perkel
. -- Marc Perkel - Sales/Support [EMAIL PROTECTED] http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3401

Hostkarma List Compatibility

2008-02-28 Thread Marc Perkel
BTW, I appreciate it that you are interested enough in my black/white/yellow lists that you're writing code for it. If there's anything you would like me to do on my end to make it easier let me know. Also, I don't know if you can do this in Postfix or Spam Assassin but my lists do more than

Using Name Based Hostkarma lookups in Spam Assassin

2008-02-28 Thread Marc Perkel
it. -- Marc Perkel - Sales/Support [EMAIL PROTECTED] http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3401

Re: Quick Postfix Question [OT]

2008-02-27 Thread Marc Perkel
Matthias Leisi wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 mouss schrieb: | Does Postfix allow you to use white lists? If so - what's the syntax? | I'm about to publish my whitelist for Postfix. | | | No. DNSWL offer an rsync access. That's the exact reason we offer rsync access

New Postfix compatible BLACK LIST

2008-02-27 Thread Marc Perkel
Hello Everyone, My hostkarma black/white/yellow lists were too complex to be accessed by Postfix. So I have created a Postfix compatible blacklist for those of you who want to bounce a lot of spam before routing it into SA. reject_rbl_client blacklist.junkemailfilter.com If you're using

Quick Postfix Question [OT]

2008-02-26 Thread Marc Perkel
Postfix allows you to use blacklists as follows: reject_rbl_client blacklist.junkemailfilter.com Does Postfix allow you to use white lists? If so - what's the syntax? I'm about to publish my whitelist for Postfix.

Re: Bogus MX - blacklist service viable?

2008-02-25 Thread Marc Perkel
Rob McEwen wrote: Aaron Wolfe wrote: I have 24 hours of data to play with.. at first results seemed promising. I found over 300,000 hosts that had connected only to my highest MX and did not issue a quit. But.. of that group: 96.0% are listed on spamhaus (zen, i did not breakdown onto the

Re: Bogus MX - blacklist service viable?

2008-02-22 Thread Marc Perkel
Aaron Wolfe wrote: On Thu, Feb 21, 2008 at 11:47 PM, Marc Perkel [EMAIL PROTECTED] wrote: Steve Radich wrote: Sorry; apparently I was unclear. MX records I'm saying as follows: 100 - Real 200 - Real perhaps, as many real as you want 300 - Bogus - one

Re: [OT] Bogus MX opinions

2008-02-21 Thread Marc Perkel
Richard Frovarp wrote: We issue tcp-reset via iptables and have never heard of any problems. Doing this also makes connecting servers fail out quickest, instead of waiting to timeout. Interesting. How do you do that?

Re: [OT] Bogus MX opinions

2008-02-21 Thread Marc Perkel
as your primary MX nolisting.org - longterm use has yet to yield a single false positive Marc Perkel - YES - it works... I have had no false positives at all using this. I am interested in this technique, and have been for some time. It seems like every discussion of it leads to a group saying you

Re: [OT] Bogus MX opinions

2008-02-21 Thread Marc Perkel
Mark Johnson wrote: Marc Perkel wrote: Because there is occasionally some server doing something very weird you might have to open up port 25 one some specific IP who is running something really dumb. I think I've had to do this only once or twice. But once you open up port 25

Re: [OT] Bogus MX opinions

2008-02-21 Thread Marc Perkel
Mark Johnson wrote: Marc Perkel wrote: I'm using Exim and I have it listening on several IP addresses. If you aren't using Exim then you'll have to get someone to help you. defercondition = ${if match{$interface_address}{69.50.231.160}} You could just point it to a dead IP address

Re: Bogus MX - blacklist service viable?

2008-02-21 Thread Marc Perkel
Steve Radich wrote: What's everyone's opinion on something like: defermx.domain.com bogusmx.domain.com provide this hosted (i.e. I'm thinking of offering), but instead of ONLY log it somehow feed / create a blacklist based on this? I'm not as familiar with blacklists as many of you, but the

Re: Bogus MX - blacklist service viable?

2008-02-21 Thread Marc Perkel
Steve Radich wrote: Sorry; apparently I was unclear. MX records I'm saying as follows: 100 - Real 200 - Real perhaps, as many real as you want 300 - Bogus - one that blocks port 25 with tcp reset for example 400 - accept port, logs ip - blacklist (not to be

Re: [OT] Bogus MX opinions

2008-02-20 Thread Marc Perkel
Let me clarify something about using bogus MX records. Let's assume the following. bogus0.domain.com - MX 10 real.domain.com - MX 20 backup.domain.com MX 30 bogus1.domain.com MX 40 bogus2.domain.com MX 50 The host bogus1 and bogus2 are 100% safe and effective. The bogus IPs can be dead on

Re: [OT] Bogus MX opinions

2008-02-20 Thread Marc Perkel
Michael Scheidell wrote: Didn't qmail have a problem if it hit a 'dead' primary mx server first? Qmail has a problem if it gets a 421 on the lowest MX. But if the lowest MX is totally dead Qmail is fine with it.

Re: [OT] Bogus MX opinions - YES - it works!

2008-02-19 Thread Marc Perkel
? 2. Has it reduced significantly SPAM? I'd like to know if it's worth the (little) trouble of setup and verifying question #1. Thank you for your time. [Tom Replied With:] Isn't that what Marc Perkel had been working on? I'm sorry if I messed up the name. But I think I'm correct. You

Whois info?

2008-02-15 Thread Marc Perkel
Is there any place to easily query whois information to determine on a mass scale how old a domain is?

Exchange Question - OT

2008-02-05 Thread Marc Perkel
Looking for someone who is familiar with exchange. Is there a setting in Exchange (asking for someone else) so that mail to domain.com is routed to say mail.domain.com instead of where the MX records point? If so - can you explain it so that I can pass it on? Thanks in advance

Re: Increase on Spambots?

2008-01-25 Thread Marc Perkel
Anthony Peacock wrote: Hi, Marc Perkel wrote: I'm wondering if anyone is noticing an increase in the number of virus infected computers sending spam? Last month my hostkarma blacklist had about 700,000 IPs of infected computers. Today it's 1,200,000. I do have some new customers who have

Postfix Question with front end filtering [OT]

2008-01-12 Thread Marc Perkel
Sorry for the OT question but just need a quick answer from a postfix expert. Here's the problem. I run a front end spam filtering service. Email from the world comes in, I clean it, and send the good email to the original server. However sometimes because my service is now the primary MX

Re: Postfix Question with front end filtering [OT]

2008-01-12 Thread Marc Perkel
Ralf Hildebrandt wrote: * Marc Perkel [EMAIL PROTECTED]: Sorry for the OT question but just need a quick answer from a postfix expert. Here's the problem. I run a front end spam filtering service. Email from the world comes in, I clean it, and send the good email to the original server

Re: Postfix Question with front end filtering [OT]

2008-01-12 Thread Marc Perkel
Bill Randle wrote: On Sat, 2008-01-12 at 08:14 -0800, Marc Perkel wrote: Ralf Hildebrandt wrote: * Marc Perkel [EMAIL PROTECTED]: Sorry for the OT question but just need a quick answer from a postfix expert. Here's the problem. I run a front end spam filtering service

Re: Postfix Question with front end filtering [OT]

2008-01-12 Thread Marc Perkel
Gary V wrote: Sorry for the OT question but just need a quick answer from a postfix expert. Here's the problem. I run a front end spam filtering service. Email from the world comes in, I clean it, and send the good email to the original server. However sometimes because my service is now the

Re: Postfix Question with front end filtering [OT]

2008-01-12 Thread Marc Perkel
postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin config_directory = /etc/postfix content_filter = amavis:[$myhostname]:10024 daemon_directory = /usr/libexec/postfix debug_peer_level = 2 home_mailbox =

What MTAs to spammers (not) use?

2008-01-10 Thread Marc Perkel
Just a thought. I'm wondering if there are any clues the th received lines that indicate the MTA that might be used for spam detection, or rather ham detection. Do spammers ever use Exim, Qmail, Postfix?

Re: Bypassing MX

2008-01-08 Thread Marc Perkel
Peter Smith wrote: Here's my situation: server1: mail gateway, runs Spamassassin server2: multi-purpose server. hosts http, mail boxes, pop/imap, runs sendmail and Spamassassin. example.org: my domain. The MX record points to server1, A record points to server2 The problem with this setup of

Re: Question about getting a blacklist included in SA

2008-01-03 Thread Marc Perkel
Matthias Leisi wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matt Kettler wrote: Comparatively speaking, 6 might be inadequate. I don't know how much of that scale is really necessary for minimal operation, and how much is just needed for scalability against DDoS attacks.

Question about getting a blacklist included in SA

2008-01-02 Thread Marc Perkel
I was wondering about how to get a blacklist included in the SA distribution. I have a blacklist and whitelist that are both very good. I've been publishing it for about a year now. But I have a few questions. What are the licensing requirements that I have to give to be included? I assume it

Re: Question about getting a blacklist included in SA

2008-01-02 Thread Marc Perkel
Matt Kettler wrote: Marc Perkel wrote: I was wondering about how to get a blacklist included in the SA distribution. I have a blacklist and whitelist that are both very good. I've been publishing it for about a year now. But I have a few questions. What are the licensing requirements

Re: good spamd box

2007-12-20 Thread Marc Perkel
jp wrote: I just built a new box with the AMD Phenom 9500 processor, gigabyte am2+ motherboard, and 8GB ram (ram is getting cheap!). It was all under $1000 for everything including power supply, cheesy video card, 2 sata drives. This thing rocks so hard for spamassassin, it's amazing.

Re: Razor Problems

2007-12-12 Thread Marc Perkel
Matt Kettler wrote: Michael Grant wrote: -report? Ahh, I had to do a razor-admin like this: su - root # razor-admin -create # razor-admin -register Even though I had done this initially as just 'su', it was using my homedir to create the .razor directory. Yep.

Re: Razor Problems

2007-12-11 Thread Marc Perkel
Theo Van Dinter wrote: On Wed, Dec 12, 2007 at 01:19:38AM +0100, Michael Grant wrote: Funny, I too just got this same error and yes, I did a razor-agent -create and -register. [88199] warn: reporter: razor2 report failed: No such file or directory report requires authentication at

Forward Conformed Reverse DNS troubleshooting tool

2007-11-28 Thread Marc Perkel
http://ipadmin.junkemailfilter.com/rdns.php You might want to bookmark this page. Try it out and see if your RDNS is really correct.

Anyone using URIDNSBL for weeding out referrer spam ?

2007-11-22 Thread Jean-Marc Liotier
to integrate the functionality into some script. - -- http://serendipity.ruwenzori.net/ Jean-Marc Liotier -- View this message in context: http://www.nabble.com/Anyone-using-URIDNSBL-for-weeding-out-referrer-spam---tf4855342.html#a13893856 Sent from the SpamAssassin - Users mailing list archive

Re: Anyone using URIDNSBL for weeding out referrer spam ?

2007-11-22 Thread Jean-Marc Liotier
://surblhost.sourceforge.net/ Now I'll adapt an existing script or adapt one to do the actual weeding out... - -- http://serendipity.ruwenzori.net/ Jean-Marc Liotier -- View this message in context: http://www.nabble.com/Anyone-using-URIDNSBL-for-weeding-out-referrer-spam---tf4855342.html#a13898907 Sent from

Re: List of 600,000 IP addresses of virus infected computers

2007-09-13 Thread Marc Perkel
Yeah - 127.0.0.1 means white listed. :) Rick Cooper wrote: My bad, I had 127.0.0.1 in the blacklist on that host instead of 127.0.0.2

Re: List of 600,000 IP addresses of virus infected computers

2007-09-12 Thread Marc Perkel
Per Jessen wrote: Marc Perkel wrote: If you're keen to share your development, why don't you explain to us how it works? /Per Jessen, Zürich The details are a little to complex for this forum but the new trick is mostly based on the fact that spam bots general don't issue

Re: List of 700,000 IP addresses of virus infected computers

2007-09-12 Thread Marc Perkel
Tuc at T-B-O-H wrote: That's as much detail as I'm going to go into here. But the result is that I have 720,000 IP addresses of virus infected computers and I'm fiultering about 1600 domains and I'm not getting any more than the normal few false positive complaints. And those are due to

Spam fighting technology techniques not welcome on Spamassassin list?

2007-09-12 Thread Marc Perkel
OK - Think about it people. People here are saying that spam fighting techniques are NOT WELCOME in the Spam Assassin list. Don't you people realize how absolutely stupid that sounds? I am sitting here with my mouth open in disbelief that anyone even suggest such a thing. So the observation

Re: List of 700,000 IP addresses of virus infected computers

2007-09-12 Thread Marc Perkel
Tuc at T-B-O-H.NET wrote: Tuc at T-B-O-H.NET wrote: Tuc at T-B-O-H wrote: That's as much detail as I'm going to go into here. But the result is that I have 720,000 IP addresses of virus infected computers and I'm fiultering about 1600 domains and I'm not getting any more than

Re: List of 600,000 IP addresses of virus infected computers

2007-09-11 Thread Marc Perkel
Per Jessen wrote: Marc Perkel wrote: I've developed an extremely accurate of detecting virus infected spam zombies. I think it's 100% accurate can catches them on the first try. Here is 600,000 IP addresses I've detected in the last 3 days. If you're keen to share your development

Re: List of 700,000 IP addresses of virus infected computers

2007-09-11 Thread Marc Perkel
Kenneth Porter wrote: On Tuesday, September 11, 2007 12:30 PM -0700 Marc Perkel [EMAIL PROTECTED] wrote: The details are a little to complex for this forum but the new trick is mostly based on the fact that spam bots general don't issue the QUIT command and when combined with other factors

Re: List of 600,000 IP addresses of virus infected computers

2007-09-11 Thread Marc Perkel
Screw you. Kai Schaetzl wrote: Marc, I'm getting tired of this. If you want to distribute blacklist data, please set up RBL and rsync and stop spamming here. Kai

List of 600,000 IP addresses of virus infected computers

2007-09-10 Thread Marc Perkel
I've developed an extremely accurate of detecting virus infected spam zombies. I think it's 100% accurate can catches them on the first try. Here is 600,000 IP addresses I've detected in the last 3 days. Enjoy http://iplist.junkemailfilter.com/virus.txt

Re: List of 600,000 IP addresses of virus infected computers

2007-09-10 Thread Marc Perkel
Duane Hill wrote: On Mon, 10 Sep 2007 at 10:26 -0700, [EMAIL PROTECTED] confabulated: I've developed an extremely accurate of detecting virus infected spam zombies. I think it's 100% accurate can catches them on the first try. Here You think it's 100% accurate? What about the systems that

Who wants my spam - seriously!

2007-09-06 Thread Marc Perkel
with it yourself and you just want the spam to go away. So - who wants in on this? Contact me privately if interested. Marc Perkel Junk Email Filter dot com http://www.junkemailfilter.com

Re: Is there a test on blacklisted nameservers

2007-09-05 Thread Marc Perkel
mouss wrote: ram wrote: I am using SA 3.2.3 and very few spam get thru But I can still see some spam with urls because the the urls are not yet listed in uribls I tried to do some analysis on my quarantine, I found atleast some spammer domains have the same NS records. Now in my spamassassin

Re: Need a plugin written relating to black/white/yellow lists

2007-08-28 Thread Marc Perkel
John Rudd wrote: Loren Wilton wrote: the last byte of the return is a number from 1-255. This is the hosts 1 means not only have we never seen ham come from this host, it has all kinds of danger signals that indicate you shouldn't ever trust them to do anything useful. You probably

Re: YAGI: Yet Another Great Idea

2007-08-28 Thread Marc Perkel
Giampaolo Tomassoni wrote: Hello everybody! I'm going to propose you another great idea which will probably radically change the spam-detection technics. No, come one: I'm just kitting. :) I think this idea could eventually help in better detecting the kind of spam in which some

Re: Need a plugin written relating to black/white/yellow lists

2007-08-28 Thread Marc Perkel
Bret Miller wrote: *From:* Marc Perkel [mailto:[EMAIL PROTECTED] Bret Miller wrote: Bret Miller wrote: * 127.0.0.1 - whilelist - trusted nonspam * 127.0.0.2 - blacklist - block spam * 127.0.0.3 - yellowlist - mix of spam and nonspam

And interesting way to detect spambots

2007-08-28 Thread Marc Perkel
I'm doing some interesting experimenting and discovered and interesting way to detect spam bots. It appears that spam bots cache DNS far longer than ordinary. And that is detectable. As you know I use several fake high numbered MX records to fool spam bots into hitting the back door and going

Re: And interesting way to detect spambots

2007-08-28 Thread Marc Perkel
continued It appears that spam bots do their own DNS caching. That reduces DNS calls and lets them send more spam over the same low bandwidth connection. You might have noticed that if you change the MX record for domain that the old IP is still hit with spam sometimes weeks later. I

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

2007-08-27 Thread Marc Perkel
David B Funk wrote: On Sun, 26 Aug 2007, Marc Perkel wrote: If you have one MX and you create a fake low MX and a fake high MX (or many fake high MX) about 75% to 95% of your spam goes away. It's that simple. How do you deal with the false-positives, legit servers that are blocked

Re: SPF-Compliant Spam

2007-08-27 Thread Marc Perkel
Jason Bertoch wrote: I think it's safe to say I'm not in the minority when I receive SPF-Compliant spam. I'm looking for opinions on what we can honestly derive from such messages regarding the sending server's IP and the sending address' domain name. Is it wise to blacklist both, or is this

Re: SPF-Compliant Spam

2007-08-27 Thread Marc Perkel
Justin Mason wrote: Marc Perkel writes: Jason Bertoch wrote: I think it's safe to say I'm not in the minority when I receive SPF-Compliant spam. I'm looking for opinions on what we can honestly derive from such messages regarding the sending server's IP and the sending address

Re: SPF-Compliant Spam

2007-08-27 Thread Marc Perkel
Kai Schaetzl wrote: Justin Mason wrote on Mon, 27 Aug 2007 14:35:39 +0100: On the contrary, we in SpamAssassin find it useful. I have to agree with Marc in this special case. It's not very useful. The reason I think this is that the amount of domains that use SPF is scarce

Re: SPF-Compliant Spam

2007-08-27 Thread Marc Perkel
Matt Kettler wrote: Marc Perkel wrote: SPF breaks email forwarding. SPF breaks mail forwarding services that are unwilling to expend a little effort to modify their MAIL FROM handling. There's documented ways to do this, you're just unwilling, and instead you'll continue to repeat

Re: SPF-Compliant Spam

2007-08-27 Thread Marc Perkel
Magnus Holmgren wrote: On Monday 27 August 2007 15:26, Marc Perkel wrote: Jason Bertoch wrote: I think it's safe to say I'm not in the minority when I receive SPF-Compliant spam. I'm looking for opinions on what we can honestly derive from such messages regarding the sending

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

2007-08-27 Thread Marc Perkel
David B Funk wrote: On Mon, 27 Aug 2007, Marc Perkel wrote: David B Funk wrote: On Sun, 26 Aug 2007, Marc Perkel wrote: If you have one MX and you create a fake low MX and a fake high MX (or many fake high MX) about 75% to 95% of your spam goes away. It's that simple

Re: SPF-Compliant Spam

2007-08-27 Thread Marc Perkel
Bernd Petrovitsch wrote: On Mon, 2007-08-27 at 12:50 -0700, Marc Perkel wrote: [...] I don't support from mangling and I'm talking about email forwarded to us from other servers who also don't do from mangling. So not from-mangled forwarded email cannot be (technically and quite

Re: SPF-Compliant Spam

2007-08-27 Thread Marc Perkel
Meng Weng Wong wrote: On Aug 27, 2007, at 11:39 AM, Kelson wrote: Jason Bertoch wrote: Is it wise to blacklist both, or is this yet another case where SPF has failed to meet projections? It's a case where the spammer has just handed you useful information: You know for sure that the

Re: Need a plugin written relating to black/white/yellow lists

2007-08-27 Thread Marc Perkel
Bret Miller wrote: Before you look at this as just another blacklist - the real power is in the white and yellow lists. First - an overview. My list returns these codes: * 127.0.0.1 - whilelist - trusted nonspam * 127.0.0.2 - blacklist - block spam * 127.0.0.3 - yellowlist - mix of spam

Re: SPF-Compliant Spam

2007-08-27 Thread Marc Perkel
Bill Landry wrote: j o a r wrote: On 27 aug 2007, at 21.20, Kai Schaetzl wrote: That's wrong. Even if all servers in the world would check SPF you would achieve *nothing* as the big majority of mail doesn't have anything to check. Why would I, as a SPF publishing domain

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

2007-08-27 Thread Marc Perkel
Andy Sutton wrote: On Mon, 2007-08-27 at 12:59 -0700, Marc Perkel wrote: I've not run into a single instance where a legit server only tried the lowest MX. However, if I did there's a simple solution. If the fake lowest MX points to an IP on the same server as the working MX then you can

Re: Need a plugin written relating to black/white/yellow lists

2007-08-27 Thread Marc Perkel
Bret Miller wrote: * 127.0.0.1 - whilelist - trusted nonspam * 127.0.0.2 - blacklist - block spam * 127.0.0.3 - yellowlist - mix of spam and nonspam * 127.0.0.4 - brownlist - all spam - but not yet enough to blacklist And hotmail.com warrants being

Re: SPF-Compliant Spam

2007-08-27 Thread Marc Perkel
Luis Hernán Otegui wrote: 2007/8/27, Marc Perkel [EMAIL PROTECTED]: Meng Weng Wong wrote: On Aug 27, 2007, at 11:39 AM, Kelson wrote: Jason Bertoch wrote: Is it wise to blacklist both, or is this yet another case where SPF has failed to meet projections

Re: SPF-Compliant Spam

2007-08-27 Thread Marc Perkel
http://homepages.tesco.net/J.deBoynePollard/FGA/smtp-spf-is-harmful.html SPF is harmful. Adopt it. You've come to this page because you've said something similar to the following: SPF (sender permitted from a.k.a. sender policy framework) is a scheme designed to prevent forgery of

Re: Need a plugin written relating to black/white/yellow lists

2007-08-27 Thread Marc Perkel
Bret Miller wrote: Bret Miller wrote: * 127.0.0.1 - whilelist - trusted nonspam * 127.0.0.2 - blacklist - block spam * 127.0.0.3 - yellowlist - mix of spam and nonspam * 127.0.0.4 - brownlist - all spam - but not yet enough to blacklist

Re: SPF-Compliant Spam

2007-08-27 Thread Marc Perkel
Matt Kettler wrote: Marc Perkel wrote: Matt Kettler wrote: Marc Perkel wrote: SPF breaks email forwarding. SPF breaks mail forwarding services that are unwilling to expend a little effort to modify their MAIL FROM handling. There's documented ways to do

<    4   5   6   7   8   9   10   11   12   13   >