Re: Barracuda RBL in first place

2009-08-14 Thread Marc Perkel
Mike Cardwell wrote: Marc Perkel wrote: http://www.sdsc.edu/~jeff/spam/cbc.html It appears from Jeff's Blacklists Compared list the Barracuda has overtaken spamhaus for the #1 position. Not sure about the accuracy of the list as compared to spamhaus but seams reasonably good to me. I

Re: Barracuda RBL in first place

2009-08-14 Thread Marc Perkel
rich...@buzzhost.co.uk wrote: On Fri, 2009-08-14 at 06:30 -0700, Marc Perkel wrote: http://www.sdsc.edu/~jeff/spam/cbc.html It appears from Jeff's Blacklists Compared list the Barracuda has overtaken spamhaus for the #1 position. Not sure about the accuracy of the list

Re: Barracuda RBL in first place

2009-08-14 Thread Marc Perkel
Aaron Wolfe wrote: On Fri, Aug 14, 2009 at 11:24 AM, Chris Owenow...@hubris.net wrote: On Aug 14, 2009, at 10:13 AM, Mike Cardwell wrote: The comparisons on that page are useless. What matters is list policy, reliability and reputation. SpamHaus is hands down

Re: Backscatter.org used as RBL??

2009-08-07 Thread Marc Perkel
Matus UHLAR - fantomas wrote: On 06.08.09 15:37, Marc Perkel wrote: This might be an advanced concept for you but what I meant was - deliberately send spam. Everyone doing sender verification is someone who is trying to BLOCK spam, and therefore are the good guys. I also

Re: Backscatter.org used as RBL??

2009-08-06 Thread Marc Perkel
Mike Cardwell wrote: Marc Perkel wrote: Backscatter.org is the worst RBL on the planet. If you use it you will get a lot of false positives. Lets compare backscatterer's recommended usage of their list in your favourite MTA against your own recommendation for usage of your hostkarma RBL

Re: Backscatter.org used as RBL??

2009-08-06 Thread Marc Perkel
Mike Cardwell wrote: Marc Perkel wrote: Backscatter.org is the worst RBL on the planet. If you use it you will get a lot of false positives. Lets compare backscatterer's recommended usage of their list in your favourite MTA against your own recommendation for usage of your hostkarma RBL

Re: Backscatter.org used as RBL??

2009-08-05 Thread Marc Perkel
d.h...@yournetplus.com wrote: Quoting LuKreme krem...@kreme.com: On Aug 4, 2009, at 6:35, d.h...@yournetplus.com wrote: Quoting LuKreme krem...@kreme.com: On 3-Aug-2009, at 18:36, Dennis G German wrote: Is Backscatter.org http://www.backscatterer.org/index.php used by any rules?

Hostkarma Blacklist Climbing the Charts

2009-07-09 Thread Marc Perkel
For what it's worth I'm now ahead of Barracuda on Jeff Makey's blacklist comparison chart. Not a scientific comparison but it's about all there is to compare blacklists. Now only abuseat.org and spamhaus have me beat. (apews doesn't count because they blacklist everything)

Re: Short URL provider list?

2009-07-09 Thread Marc Perkel
Thanks for the lists. I'm not sure what I'm going to do with it but I'm going to see if I can find a way to use it.

Short URL provider list?

2009-07-08 Thread Marc Perkel
Does anyone have a list of all domains that provide short url redirection?

Re: Hostkarma whitelist problem

2009-06-18 Thread Marc Perkel
Mike Cardwell wrote: Bowie Bailey wrote: I couldn't find any place on junkmailfilter website to report this, so I'll put it here. I received a 419 scam email with this whitelist hit: * -3.0 RCVD_IN_JMF_W RBL: Sender listed in JMF-WHITE * [213.4.129.18 listed in

Re: Hostkarma whitelist problem

2009-06-17 Thread Marc Perkel
No list is perfect. Thanks for reporting it. Although I try to get everything right there will always be mistakes. Sometimes I do get to leaning white because false positives are 100 times worse than a few spams getting through. Probably what happened with that is that the sender does a pretty

Re: Hostkarma whitelist problem

2009-06-17 Thread Marc Perkel
so we don't have to send these to the list. Bowie Marc Perkel wrote: No list is perfect. Thanks for reporting it. Although I try to get everything right there will always be mistakes. Sometimes I do get to leaning white because false positives are 100 times worse than a few spams getting

Re: Hostkarma whitelist problem

2009-06-17 Thread Marc Perkel
mouss wrote: Bowie Bailey a écrit : I couldn't find any place on junkmailfilter website to report this, so I'll put it here. I received a 419 scam email with this whitelist hit: so what? I keep getting 419 from google, yahoo, ... but they are still whitelisted. Actually

Re: EmailBL future

2009-05-28 Thread Marc Perkel
What do you need to make it survive? It works great for me. Yet Another Ninja wrote: As you all know, on July 1st the emailbl.me test zone will go dark. I helped Henrik test the plugin and find mirrors for the data which was being fed by feeds dedicated to this test only. Would be nice to

Re: EmailBL future

2009-05-28 Thread Marc Perkel
Yet Another Ninja wrote: On 5/28/2009 6:27 PM, Marc Perkel wrote: What do you need to make it survive? It works great for me. I won't be involved at all. It needs data, mirrors, zone, all what a RBL needs. I'll do the mirrors - provide server - I have data - I don't have what you

Looking for whitelist domain data

2009-05-28 Thread Marc Perkel
I'm looking for domains to whitelist that meet this criteria: All email from the domain is 100% good The FcRDNS matches the domain name Example: *.wellsfargo.com Silimarly I'd like domains for my yellow list. Yellow is mixed spam/hame sources like yahoo, gmail, hotmail, etc. Example:

Re: I want MORE SPAM - MORE SPAM

2009-05-26 Thread Marc Perkel
Thanks for your support everyone. In the last month my blacklist has doubled in size and trapping a lot more spam bots. But still looking for more spam so if any of you want to get a little less spam and help me build my spam bot list then here's the instructions:

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Marc Perkel
Mike Cardwell wrote: Marc Perkel wrote: BTW - for those who are curious, the lists are generated mostly from Exim rules. Exim has a feature that allows me to track hosts that don't use QUIT to close a connection. Thus the combination of fake mx, no quit, No or bad RDNS or dynamic IP

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Marc Perkel
Ned Slider wrote: Karsten Bräckelmann wrote: And I do have a goal of !00% accuracy although that is difficult to attain. While I guess most blacklist operators do aim at a perfect blacklist, regardless of specific definitions and whether others agree or not... That's probably one of the

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Marc Perkel
Henrik K wrote: On Wed, May 20, 2009 at 01:41:12PM +0100, Mike Cardwell wrote: Ned Slider wrote: I've also just recently enabled these lists in SA so am still in the very early stages of testing. I initially did get one FP hit against the whitelist (spam message sent through an

Using p0f to detect spam bots

2009-05-20 Thread Marc Perkel
Benny Pedersen wrote: On Wed, May 20, 2009 11:25, Mike Cardwell wrote: A cool idea would be an application in a similar vain to p0f, but which passively detected the SMTP client software, rather than operating system. It might then be possible to distribute signatures that identified

Re: one domain gets 99% of spam

2009-05-20 Thread Marc Perkel
option8 wrote: it is common for one domains to get an order of magnitude more spam than another that seems just like it. like mark said, it probably won't stop. low overhead techniques like greylisting or no listing can reduce the stress on your server quite a bit. configuring your mta

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Marc Perkel
Mike Cardwell wrote: Matus UHLAR - fantomas wrote: I've also just recently enabled these lists in SA so am still in the very early stages of testing. I initially did get one FP hit against the whitelist (spam message sent through an ISP smtp server in the whitelist) On 20.05.09 13:41,

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Marc Perkel
Mike Cardwell wrote: Matus UHLAR - fantomas wrote: I just think that a whitelist entry should be an absolute no spam comes from here unless something goes tits up type entry, and all hosts on it should be manually checked... IIUC this is whitelist of type don't blacklist these hosts...

Got dead domains that get a lot of spam?

2009-05-19 Thread Marc Perkel
Looking for people with dead domains that still get a lot of spam, especially spambot spam. I'm trying to get more spambot data for our hostkarma spam list. If you have such a domain that you aren't using can you set the MX to tarbaby.junkemailfilter.com. It will help stop spammers at the

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Marc Perkel
or accepting such a domain. I hope dead = 'has bounced 550 5.1.1 for at least a year to all attempts to previously valid addresses', otherwise, for all intents and purposes, especially this one, I'm not dead yet. On 19/05/09 8:59 AM, Marc Perkel m...@perkel.com wrote: Looking for people

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Marc Perkel
Neil Schwartzman wrote: On 19/05/09 10:55 AM, Marc Perkel m...@perkel.com wrote: That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition is any domain that has not current legitimate email. Good

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Marc Perkel
Ned Slider wrote: John Hardin wrote: On Tue, 19 May 2009, Neil Schwartzman wrote: On 19/05/09 10:55 AM, Marc Perkel m...@perkel.com wrote: That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Marc Perkel
Karsten Bräckelmann wrote: And I do have a goal of !00% accuracy although that is difficult to attain. While I guess most blacklist operators do aim at a perfect blacklist, regardless of specific definitions and whether others agree or not... That's probably one of the worst shift

Re: one domain gets 99% of spam

2009-05-19 Thread Marc Perkel
option8 wrote: on my small server setup, i host around 30 domains. between SA and a fairly aggressive exim setup, very little spam gets through to the end users. most of it doesn't even get far enough to hit my logs. however, one domain that i host gets constantly bombarded, and has since i

Re: one domain gets 99% of spam

2009-05-19 Thread Marc Perkel
Aaron Wolfe wrote: On Wed, May 20, 2009 at 1:09 AM, Marc Perkel m...@perkel.com wrote: option8 wrote: on my small server setup, i host around 30 domains. between SA and a fairly aggressive exim setup, very little spam gets through to the end users. most of it doesn't even get far

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Marc Perkel
LuKreme wrote: On 19-May-2009, at 20:34, Karsten Bräckelmann wrote: Other than that, I recently enabled Hostkarma blacklists here, just to check. FWIW, it's scoring *really* good for me. So good, I seriously toned it down. I want to evaluate it first. For that, I need something even close to

I want MORE SPAM - MORE SPAM

2009-05-18 Thread Marc Perkel
Hi Everyone, My blacklist hostkarma.junkemailfilter.com is rising in the charts. Here's a blacklist comparison chart. http://www.sdsc.edu/~jeff/spam/cbc.html So - I want to be #1. I want more spam. And you can lost some of your spam at the same time. All you have to do to help out is add a

Re: I want MORE SPAM - MORE SPAM

2009-05-18 Thread Marc Perkel
Chris Owen wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On May 18, 2009, at 10:36 AM, DAve wrote: Those results differ wildly with my stats over the past year. Barracuda throws far too many FP for me to use on the MTA, I have to use it in SA and let the better tests pull the score

Re: I want MORE SPAM - MORE SPAM

2009-05-18 Thread Marc Perkel
Aaron Wolfe wrote: +1 for the invaluement lists. they are excellent, sad that they aren't listed in that comparison. we seem to get better results with barracuda than you've seen, many of our clients choose to use the barracuda list to block. we offer the hostkarma lists as well but

Re: An SMTP transaction, SpamAssassin interface

2009-05-15 Thread Marc Perkel
Mike Cardwell wrote: Mike Cardwell wrote: Justin Mason wrote: hi -- this stuff is generally recorded in the Received header, and SA will act on it if it's there. that's the place to do it... The STARTTLS example is recorded in the received headers, yes. None of the other 3 examples are

Re: EmailBL plugin released

2009-05-14 Thread Marc Perkel
I would like to offer my help for your project. So far it's working well. I can offer you any of the following: Data - I have tons of spam if you need to harvest data. Computers - I have a lot of processing power if you need a VPS. Bandwidth - I have some bandwidth to spare rbldnsd servers - I

Re: EmailBL plugin released - I like it!

2009-05-12 Thread Marc Perkel
Yet Another Ninja wrote: On 5/12/2009 4:32 PM, Marc Perkel wrote: I'm not using your plugin yet but using it from Exim instead and it's working well. Lots of hist. I suppose we'll find out if there's any false positives. Here's how you do it in Exim set acl_c_from_address = ${lc:${address

Re: EmailBL plugin released - I like it!

2009-05-12 Thread Marc Perkel
I'm not using your plugin yet but using it from Exim instead and it's working well. Lots of hist. I suppose we'll find out if there's any false positives. Here's how you do it in Exim set acl_c_from_address = ${lc:${address:$h_From:}} set acl_c_from_address_hash = ${md5:$acl_c_from_address}

Re: EmailBL plugin released

2009-05-12 Thread Marc Perkel
Do you need more mirrors? I can offer you 4 additional servers. Henrik K wrote: Hi, EmailBL plugin is now available for testing. Small test zone has been running for a while, it contains trapped addresses from some of the most popular freemail domains. http://sa.hege.li/EmailBL.pm (see

Re: FreeMail plugin updated - banks

2009-05-11 Thread Marc Perkel
mouss wrote: Is phishing really a problem for banks? I don't think so. You're kidding right?

Re: FreeMail plugin updated - banks

2009-05-10 Thread Marc Perkel
Benny Pedersen wrote: On Sun, May 10, 2009 13:15, Ned Slider wrote: Or maybe I'm trying to reinvent a wheel someone already has up and running :-) a bank without SPF or DKIM signing is NOT worth using Yes - but I think what he's saying is that you have to start with a list of

Re: FreeMail plugin updated

2009-05-10 Thread Marc Perkel
Just curious - how did you build that list? Henrik K wrote: Hello, I've revamped fully the old code. Works still the same, but has some new functions. It's also a bit more careful when parsing body (new parser, emails inside are ignored, as well ones inside urls etc), so it might even reduce

Re: mcafee sees drop in spam?

2009-05-08 Thread Marc Perkel
Maybe it's an old story. I saw a drop last fall but it's come back since then. Jason Staudenmayer wrote: -Original Message- From: Michael Scheidell [mailto:scheid...@secnap.net] Sent: Friday, May 08, 2009 10:57 AM To: SpamAssassin Users List Subject: mcafee sees drop in spam?

Bot spam increasing?

2009-04-24 Thread Marc Perkel
Has anyone else noticed an increase in bot spam? My black list has grown by about 1/3 in the last month.

Registry Barrier code

2009-04-09 Thread Marc Perkel
What source file is the registry barrier code in? Thanks in advance.

Re: Registry Barrier code

2009-04-09 Thread Marc Perkel
Thanks - that was what I was looking for. Mark Martinec wrote: Marc, What source file is the registry barrier code in? Mail/SpamAssassin/Util/RegistrarBoundaries.pm but is slightly out of date, for example it does not include registered IDN tld names: XN--0ZWM56D XN--11B5BS3A9AJ6G

Re: simple script idea for checking reputation disagreement

2009-04-06 Thread Marc Perkel
Neil Schwartzman wrote: On 04/04/09 11:31 AM, RobertH robe...@abbacomm.net wrote: greetings... i am working at re-learning and applying SA fine tuning. in doing so, i have some across some real life SA scoring anomalies. it is interesting because one public reputaion service rule

Re: simple script idea for checking reputation disagreement

2009-04-06 Thread Marc Perkel
RobertH wrote: 0.2 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address [209.92.22.130 listed in dnsbl.sorbs.net] That would be incorrect. The IP is static, not dynamic. whois://209.92.22@whois.arin.net

Re: simple script idea for checking reputation disagreement

2009-04-06 Thread Marc Perkel
John Hardin wrote: On Mon, 6 Apr 2009, Marc Perkel wrote: as i noted in the last post, it was about the difference between JMF_Whitelist and RCVD in Barracuda barracusa says spam, jmf whitelist is obvious. I agree. In fact I removed that host from my white list. I am very interested

Looking for list of bank domains

2009-03-30 Thread Marc Perkel
I'd like to get a more complete list of banks or bank like institutions and sites where hackers are trying to steal passwords to log into people's accounts. Here's my small list. Like to get more. I might set up an rbldns list of banks if this works out. 2checkout.com 2co.com abbey.com

Re: Looking for list of bank domains

2009-03-30 Thread Marc Perkel
Matt Garretson wrote: Marc Perkel wrote: I'd like to get a more complete list of banks or bank like institutions and sites where hackers are trying to steal passwords to log into people's accounts. Here's my small list. Like to get more. I might set What about webmail sites

Re: Experimental Plugin: MetaSVM

2009-03-15 Thread Marc Perkel
decoder wrote: LuKreme wrote: This is an excellent idea, but it also needs rule hits on ham, right? You're right if you're saying that the method would work better if there were more ham rules. From what I have seen in my experiments however, the results are also very precise with the

Re: Experimental Plugin: MetaSVM

2009-03-13 Thread Marc Perkel
I'm going to bet that there will be static meta rules that will be discovered that can be just added to spamassassin. I'm interested in how this plays out. I'm very optimistic.

Re: 2 + 2 != 4 - Spamassassin needs a new paradigm

2009-03-10 Thread Marc Perkel
So - making any progress? :)

Re: 2 + 2 != 4 - Spamassassin needs a new paradigm

2009-03-05 Thread Marc Perkel
decoder wrote: Marc Perkel wrote: Good work so far but sounds like you need to throw more data at it. Also even though you indicate over 99% accuracy can you break that down better? 99.9% is 10 times as accurate as 99%. What do you mean by more data? Of course, some additional data might

Re: 2 + 2 != 4 - Spamassassin needs a new paradigm

2009-03-04 Thread Marc Perkel
Matus UHLAR - fantomas wrote: I should note that some policy rules and rules with manually updated scores (SPF_PASS, BAYES_*) may need to be exempted from this. We don't want SPF_PASS to generate high positive score, do we? The idea of all this is that we might discover things like

Re: 2 + 2 != 4 - Spamassassin needs a new paradigm

2009-03-04 Thread Marc Perkel
Justin Mason wrote: On Wed, Mar 4, 2009 at 00:43, Marc Perkel m...@perkel.com wrote: LuKreme wrote: On Mar 3, 2009, at 10:06, John Wilcock j...@tradoc.fr wrote: Le 03/03/2009 17:42, Matus UHLAR - fantomas a écrit : I have been already thinking about possibility

Re: 2 + 2 != 4 - Spamassassin needs a new paradigm

2009-03-04 Thread Marc Perkel
decoder wrote: decoder wrote: Justin Mason wrote: So you're volunteering to code it up, then? ;) I was planning to do at least some brainstorming+experiements as to what learning methods would seem suitable and how well the method performs, whenever I have time again. Unless someone

Re: 2 + 2 != 4 - Spamassassin needs a new paradigm

2009-03-03 Thread Marc Perkel
Yet Another Ninja wrote: On 3/3/2009 5:32 PM, Marc Perkel wrote: The important point here is that SA needs to evolve beyond the concept of using addition to compute scores. Ideally there should be more hard coded rule combinations or using baysian statistics to find how rule combinations

Re: 2 + 2 != 4 - Spamassassin needs a new paradigm

2009-03-03 Thread Marc Perkel
Karsten Bräckelmann wrote: I guess one would need a new plugin for the above yellow RBLs, due to the problem of limiting all hits per URI / IP as mentioned above. Also, of course, one first needs a reliably and publicly available do-not-blacklist RBL. I have such an RBL.

Re: 2 + 2 != 4 - Spamassassin needs a new paradigm

2009-03-03 Thread Marc Perkel
John Wilcock wrote: I wonder about the feasibility of a second Bayesian database, using the same learning mechanism as the current system, but keeping track of rule combinations instead of keywords. YES! That is something I think is worth trying.

Re: 2 + 2 != 4 - Spamassassin needs a new paradigm

2009-03-03 Thread Marc Perkel
Justin Mason wrote: On Tue, Mar 3, 2009 at 17:40, Marc Perkel m...@perkel.com wrote: John Wilcock wrote: I wonder about the feasibility of a second Bayesian database, using the same learning mechanism as the current system, but keeping track of rule combinations instead of keywords

Re: 2 + 2 != 4 - Spamassassin needs a new paradigm

2009-03-03 Thread Marc Perkel
LuKreme wrote: On Mar 3, 2009, at 10:06, John Wilcock j...@tradoc.fr wrote: Le 03/03/2009 17:42, Matus UHLAR - fantomas a écrit : I have been already thinking about possibility to combine every two rules and do a masscheck over them. Then, optionally repeating that again, skipping

Re: Googlegroups related spam

2009-02-24 Thread Marc Perkel
Per Jessen wrote: Jason Bertoch wrote: -Original Message- From: Per Jessen [mailto:p...@computer.org] Sent: Tuesday, February 24, 2009 10:15 AM To: users@spamassassin.apache.org Subject: Re: Googlegroups related spam here's a couple of examples that made it through my filter:

Re: DNS MX Question [OT]

2009-02-15 Thread Marc Perkel
Dave Funk wrote: On Sat, 14 Feb 2009, Marc Perkel wrote: Dave Funk wrote: On Sat, 14 Feb 2009, Marc Perkel wrote: Marc Perkel wrote: Hi, I have a quick bind question. I want to set the MX records on a domain to something normal but I want to set the MX for all subdomains

Re: DNS MX Question [OT]

2009-02-15 Thread Marc Perkel
Dave Funk wrote: On Sat, 14 Feb 2009, Marc Perkel wrote: Lindsay Haisley wrote: On Sat, 2009-02-14 at 22:06 -0800, Marc Perkel wrote: Dave Funk wrote: Yes, it -is- that simple. ;) Not recommended for normal use but if you understand the risks involved, it does work that way

DNS MX Question [OT]

2009-02-14 Thread Marc Perkel
Hi, I have a quick bind question. I want to set the MX records on a domain to something normal but I want to set the MX for all subdomains to something else. example.com mail.example.com xxx.example.com blackhole.example.com Thanks in advance

Re: DNS MX Question [OT]

2009-02-14 Thread Marc Perkel
Marc Perkel wrote: Hi, I have a quick bind question. I want to set the MX records on a domain to something normal but I want to set the MX for all subdomains to something else. example.com mail.example.com xxx.example.com blackhole.example.com Thanks in advance I should be more

Re: DNS MX Question [OT]

2009-02-14 Thread Marc Perkel
Dave Funk wrote: On Sat, 14 Feb 2009, Marc Perkel wrote: Marc Perkel wrote: Hi, I have a quick bind question. I want to set the MX records on a domain to something normal but I want to set the MX for all subdomains to something else. example.com mail.example.com xxx.example.com

Re: DNS MX Question [OT]

2009-02-14 Thread Marc Perkel
Dave Funk wrote: On Sat, 14 Feb 2009, Marc Perkel wrote: Marc Perkel wrote: Hi, I have a quick bind question. I want to set the MX records on a domain to something normal but I want to set the MX for all subdomains to something else. example.com mail.example.com xxx.example.com

Re: DNS MX Question [OT]

2009-02-14 Thread Marc Perkel
Lindsay Haisley wrote: On Sat, 2009-02-14 at 22:06 -0800, Marc Perkel wrote: Dave Funk wrote: Yes, it -is- that simple. ;) Not recommended for normal use but if you understand the risks involved, it does work that way. Thanks Dave, but I already tried that and it didn't

ips.backscatterer.org - black list or white list?

2009-02-08 Thread Marc Perkel
I'm experimenting with ips.backscatterer.org and it seems to only hit on good email. Also - it might be more useful if it returned different codes based on the kind of backscatter detected.

Re: ips.backscatterer.org - black list or white list?

2009-02-08 Thread Marc Perkel
mouss wrote: Marc Perkel a écrit : I'm experimenting with ips.backscatterer.org and it seems to only hit on good email. it lists hosts that sent backscatter, be these legitimate hosts or not. but beware, it also lists hosts that do address verification callout probes. I'm

Looking for white list host name data

2009-02-05 Thread Marc Perkel
Ham is often easier to detect than spam and in order to reduce false positives I'm trying to increase my whitelist data of host names that never send spam. This is based on Forward Confirmed rDNS which can't be faked. I have a public white list of these host name available as follows:

Does Spamassassin support FCrDNS tests?

2009-02-05 Thread Marc Perkel
Does the spamassassin infrastructure support RBL lookups based on forward confirmed RDNS? For example. I have a white lists based on good host names. What would a rule look like that looks up these host names from my DNS list? domain.com.hostkarma.junkemailfilter.com = 127.0.0.1

Re: Secure spamd server

2009-02-03 Thread Marc Perkel
Andre wrote: Hi, we run Exim (4.69) with mail scanned at smtp time via acl. We put an external spamd server to work (works fine). Now we want to extend that setup by permitting another mail server (Exim, same setup) to connect to the spamd server. However, that transport has to happen over

Re: FreeMail.pm

2009-01-28 Thread Marc Perkel
I would be willing to maintain an RBL type list of freemail domains if this would be useful. I could set up a VPS for the front end and provide several servers and lots of bandwidth for a backend.

Re: How can this free MX backup service be exploited?

2009-01-22 Thread Marc Perkel
Steve Freegard wrote: Marc Perkel wrote: I'm doing an experimental free MX backup service and wondering if it will get exploited. I'm wondering if I'm overlooking anything obvious? Here's the info on it: http://www.free-mx-backup.com The idea is that it detects if we are the secondary

Re: How can this free MX backup service be exploited?

2009-01-22 Thread Marc Perkel
RobertH wrote: I'm doing an experimental free MX backup service and wondering if it will get exploited. I'm wondering if I'm overlooking anything obvious? Here's the info on it: http://www.free-mx-backup.com The idea is that it detects if we are the secondary and not the primary MX

How can this free MX backup service be exploited?

2009-01-21 Thread Marc Perkel
I'm doing an experimental free MX backup service and wondering if it will get exploited. I'm wondering if I'm overlooking anything obvious? Here's the info on it: http://www.free-mx-backup.com The idea is that it detects if we are the secondary and not the primary MX and will store and

Re: New type of scam?

2009-01-11 Thread Marc Perkel
Filter on upper case GOD BLESS. Igor Chudov wrote: http://igor.chudov.com/tmp/spam006.txt Not sure what will follow, maybe asking $250 processing fee or something. Obviously I am not in the mood to write to this guy.

Looking for a volunteer for MX Backup service test

2008-12-31 Thread Marc Perkel
Looking few a few domains to test and automated MX backup service with some spam filtering. What you do is this. Add these two MX records as your two highest MX records. mail.example.com 10 mxbackup1.junkemailfilter.com 20 mxbackup2.junkemailfilter.com 30 And in theory it will just work. If

Blacklisting IPs from HTTP hacker?

2008-12-23 Thread Marc Perkel
Just a thought on blacklists. Has anyone tried mining the IP data from HTTP servers that use modsecurity? I'm wondering if the same computers that are spamming blogs are also spamming with email? Would this be a new way to catch spammers?

Re: URIBL Removal [OT]

2008-12-14 Thread Marc Perkel
My fault - never mind. I was doing something wrong. Karsten Bräckelmann wrote: On Sat, 2008-12-13 at 21:23 -0800, Marc Perkel wrote: I'm trying to get collaborate.com off of the URIBL list and I've submitted it for removal several times and nothing happens. Log in to your URIBL

URIBL Removal [OT]

2008-12-13 Thread Marc Perkel
I'm trying to get collaborate.com off of the URIBL list and I've submitted it for removal several times and nothing happens. Does anyone know why removal doesn't work? Thanks in advance

Looking for people to test free MX backup

2008-12-04 Thread Marc Perkel
I think I have it all ready to go. Looking for some volunteers to test my new email backup service. Contact me privately if you're interested. I'm looking for people with: 1) No greylisting - unless you exempt *.junkemailfilter.com from your greylisting. If you do that I want at least one

Re: Bug in iXhash plugin - fixed version available

2008-12-04 Thread Marc Perkel
Bill Landry wrote: Giampaolo Tomassoni wrote: -Original Message- From: Marc Perkel [mailto:[EMAIL PROTECTED] Sent: Wednesday, December 03, 2008 12:04 AM it's WORKING Well, it hangs my SA 3.2.4 setup on waiting for a reply from ctyme.ixhash.net . The strange thing

I'm thinking about offering a free MX backup service

2008-12-02 Thread Marc Perkel
Tell me if you think this is a good idea. I'm thinking about offering a free MX backup service that people without backup servers can use. I'm thinking about doing this as a way of promoting my spam filtering business because users will see a significant reduction in spam and might want to

Re: I'm thinking about offering a free MX backup service

2008-12-02 Thread Marc Perkel
Aaron Wolfe wrote: On Tue, Dec 2, 2008 at 2:51 PM, Marc Perkel [EMAIL PROTECTED] wrote: Tell me if you think this is a good idea. I'm thinking about offering a free MX backup service that people without backup servers can use. I'm thinking about doing this as a way of promoting my spam

Twist on Day Old Bread list idea

2008-12-02 Thread Marc Perkel
I'm experimenting with a new list. Been testing it for a couple of months. Got a radical idea. The problem with lists like Day Old Bread which lists new domains that spammers use is that there's a delay between when they are activated and when they are listed. It's just too hard to get a list

Re: I'm thinking about offering a free MX backup service

2008-12-02 Thread Marc Perkel
SM wrote: At 11:51 02-12-2008, Marc Perkel wrote: Tell me if you think this is a good idea. Everything that helps to promote your business is a good idea. :-) Thanks - but there are some other benefits to me. It will help enhance my black lists which will make them more useful

Re: I'm thinking about offering a free MX backup service

2008-12-02 Thread Marc Perkel
Rick Macdougall wrote: Marc Perkel wrote: Thanks Aaron, that is a good point. But I'm running Exim and I think I can code it so that it will not generate backscatter. I'll have to design that in up front. Interesting, how would you do that without dropping email (which is BAD). Rick

Re: I'm thinking about offering a free MX backup service

2008-12-02 Thread Marc Perkel
Aaron Wolfe wrote: On Tue, Dec 2, 2008 at 3:59 PM, Marc Perkel [EMAIL PROTECTED] wrote: Rick Macdougall wrote: Marc Perkel wrote: Thanks Aaron, that is a good point. But I'm running Exim and I think I can code it so that it will not generate backscatter. I'll have

Re: Bug in iXhash plugin - fixed version available

2008-12-02 Thread Marc Perkel
it's WORKING Dirk Bonengel wrote: OK, I found the bug. I just released a fixed release. Thanks to Lars Uhlmann for finding the culprit and delivering a fix. Problem was the regular expression checking the IP returned if it belongs to the 127.x.x.x range. Hmm, I had this working

Re: I'm thinking about offering a free MX backup service

2008-12-02 Thread Marc Perkel
RobertH wrote: If the recipient is bad then no one would have got the email anyway. But there wouldn't a a notification to the sender. I suppose I could make it smarter so that if the message is blessed in one of my many white lists then I would do a bounce message, otherwise not.

Re: New version of iXhash plugin available

2008-12-01 Thread Marc Perkel
I noticed this morning that I also had 0 ixhash hits. Is something wrong? Rose, Bobby wrote: Has anyone who switched to 1.5 of iXHash received any hits? I haven't seen any since switching. One thing that I've noticed is if I pass the same message thru SA using the old iXhash, the hash is

Re: Bug in iXhash plugin - fixed version available

2008-12-01 Thread Marc Perkel
Hi Dirk, I'm not getting any hits on the new version either. Dirk Bonengel wrote: Folks, as some of you already noticed I f... up the last (1.5) release of the iXhash plugin. Plain simple a wrong regular expression practically disables hash #1. I just uploaded a fixed version to

Re: Is spam volume really down

2008-11-21 Thread Marc Perkel
I noticed the size of my black list dropped by more that 1/3 this last week.

<    1   2   3   4   5   6   7   8   9   10   >