Re: Got dead domains that get a lot of spam?

2009-05-21 Thread Michelle Konzack
Hai! you E-Mails are confusing because in the From: you have Karsten Bräckelmann but in teh signature you write guenther Thanks, Greetings and nice Day/Evening Michelle Konzack Systemadministrator Tamay Dogan Network Debian GNU/Linux Consultant -- Linux-User

Re: Got dead domains that get a lot of spam?

2009-05-21 Thread Karsten Bräckelmann
On Thu, 2009-05-21 at 14:09 +0200, Michelle Konzack wrote: you E-Mails are confusing because in the From: you have Focus on the content! Karsten Bräckelmann That's my real name. :) but in teh signature you write Actually, my sig decodes to my full email address. ;) guenther That

Re: Got dead domains that get a lot of spam?

2009-05-21 Thread LuKreme
On 21-May-2009, at 07:19, Karsten Bräckelmann wrote: Is it really that confusing? ;) Nah, I figured it was a nickname of some sort. Heck, for all I knew Guenther is a 'standard' nick for Karsten! -- Can I tell you the truth? I mean this isn't like TV news, is it?

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Lucio Chiappetti
On Tue, 19 May 2009, Marc Perkel wrote: Looking for people with dead domains that still get a lot of spam, If you have such a domain that you aren't using can you set the MX Sorry, but that's not dead enough ! We used to have one domain (mi.iasf.cnr.it) under one organization (CNR). When

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Mike Cardwell
Marc Perkel wrote: BTW - for those who are curious, the lists are generated mostly from Exim rules. Exim has a feature that allows me to track hosts that don't use QUIT to close a connection. Thus the combination of fake mx, no quit, No or bad RDNS or dynamic IP, and various HELO sins is

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Mike Cardwell
Marc Perkel wrote: Other than that, I recently enabled Hostkarma blacklists here, just to check. FWIW, it's scoring *really* good for me. So good, I seriously toned it down. I want to evaluate it first. For that, I need something even close to a considerable, diverse amount of ham. How,

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Ned Slider
Karsten Bräckelmann wrote: And I do have a goal of !00% accuracy although that is difficult to attain. While I guess most blacklist operators do aim at a perfect blacklist, regardless of specific definitions and whether others agree or not... That's probably one of the worst shift typos in

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Mike Cardwell
Ned Slider wrote: I've also just recently enabled these lists in SA so am still in the very early stages of testing. I initially did get one FP hit against the whitelist (spam message sent through an ISP smtp server in the whitelist) Can you let us know what that IP is please? Then Marc can

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Marc Perkel
Mike Cardwell wrote: Marc Perkel wrote: BTW - for those who are curious, the lists are generated mostly from Exim rules. Exim has a feature that allows me to track hosts that don't use QUIT to close a connection. Thus the combination of fake mx, no quit, No or bad RDNS or dynamic IP, and

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Marc Perkel
Ned Slider wrote: Karsten Bräckelmann wrote: And I do have a goal of !00% accuracy although that is difficult to attain. While I guess most blacklist operators do aim at a perfect blacklist, regardless of specific definitions and whether others agree or not... That's probably one of the

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Henrik K
On Wed, May 20, 2009 at 01:41:12PM +0100, Mike Cardwell wrote: Ned Slider wrote: I've also just recently enabled these lists in SA so am still in the very early stages of testing. I initially did get one FP hit against the whitelist (spam message sent through an ISP smtp server in the

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Benny Pedersen
On Wed, May 20, 2009 11:25, Mike Cardwell wrote: A cool idea would be an application in a similar vain to p0f, but which passively detected the SMTP client software, rather than operating system. It might then be possible to distribute signatures that identified specific zombie software, as

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Marc Perkel
Henrik K wrote: On Wed, May 20, 2009 at 01:41:12PM +0100, Mike Cardwell wrote: Ned Slider wrote: I've also just recently enabled these lists in SA so am still in the very early stages of testing. I initially did get one FP hit against the whitelist (spam message sent through an

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Matus UHLAR - fantomas
Ned Slider wrote: I've also just recently enabled these lists in SA so am still in the very early stages of testing. I initially did get one FP hit against the whitelist (spam message sent through an ISP smtp server in the whitelist) On 20.05.09 13:41, Mike Cardwell wrote: Can you let

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Ned Slider
Mike Cardwell wrote: Ned Slider wrote: I've also just recently enabled these lists in SA so am still in the very early stages of testing. I initially did get one FP hit against the whitelist (spam message sent through an ISP smtp server in the whitelist) Can you let us know what that IP is

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Mike Cardwell
Matus UHLAR - fantomas wrote: I've also just recently enabled these lists in SA so am still in the very early stages of testing. I initially did get one FP hit against the whitelist (spam message sent through an ISP smtp server in the whitelist) On 20.05.09 13:41, Mike Cardwell wrote: Can

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Marc Perkel
Mike Cardwell wrote: Matus UHLAR - fantomas wrote: I've also just recently enabled these lists in SA so am still in the very early stages of testing. I initially did get one FP hit against the whitelist (spam message sent through an ISP smtp server in the whitelist) On 20.05.09 13:41,

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Matus UHLAR - fantomas
I've also just recently enabled these lists in SA so am still in the very early stages of testing. I initially did get one FP hit against the whitelist (spam message sent through an ISP smtp server in the whitelist) On 20.05.09 13:41, Mike Cardwell wrote: Can you let us know what that

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Mike Cardwell
Marc Perkel wrote: I just think that a whitelist entry should be an absolute no spam comes from here unless something goes tits up type entry, and all hosts on it should be manually checked... I started querying the whitelist from spamassassin 4 hours ago. I don't have a high volume of

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Ned Slider
Mike Cardwell wrote: Matus UHLAR - fantomas wrote: I've also just recently enabled these lists in SA so am still in the very early stages of testing. I initially did get one FP hit against the whitelist (spam message sent through an ISP smtp server in the whitelist) On 20.05.09 13:41,

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Mike Cardwell
Matus UHLAR - fantomas wrote: I just think that a whitelist entry should be an absolute no spam comes from here unless something goes tits up type entry, and all hosts on it should be manually checked... IIUC this is whitelist of type don't blacklist these hosts... maybe I'm wrong Nope.

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Marc Perkel
Mike Cardwell wrote: Matus UHLAR - fantomas wrote: I just think that a whitelist entry should be an absolute no spam comes from here unless something goes tits up type entry, and all hosts on it should be manually checked... IIUC this is whitelist of type don't blacklist these hosts...

Re: Got dead domains that get a lot of spam?

2009-05-20 Thread Karsten Bräckelmann
On Tue, 2009-05-19 at 20:06 -0700, Marc Perkel wrote: If you are going to use the blacklist it works best if you also use the tarbaby.junkemailfilter.com high numbered MX record as well because that way my blacklist will pick up the spambots that are targeting you. So feel free to use both.

Got dead domains that get a lot of spam?

2009-05-19 Thread Marc Perkel
Looking for people with dead domains that still get a lot of spam, especially spambot spam. I'm trying to get more spambot data for our hostkarma spam list. If you have such a domain that you aren't using can you set the MX to tarbaby.junkemailfilter.com. It will help stop spammers at the

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Neil Schwartzman
I think it would be a very good idea to define Œdead¹ before setting or accepting such a domain. I hope dead = Œhas bounced 550 5.1.1 for at least a year to all attempts to previously valid addresses¹, otherwise, for all intents and purposes, especially this one, ³I¹m not dead yet². On 19/05/09

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Marc Perkel
That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition is any domain that has not current legitimate email. Neil Schwartzman wrote: I think it would be a very good idea to define 'dead' before setting or

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Neil Schwartzman
On 19/05/09 10:55 AM, Marc Perkel m...@perkel.com wrote: That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition is any domain that has not current legitimate email. Good for you! You are one up on the

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread John Hardin
On Tue, 19 May 2009, Neil Schwartzman wrote: On 19/05/09 10:55 AM, Marc Perkel m...@perkel.com wrote: That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition is any domain that has not current legitimate

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Ned Slider
John Hardin wrote: On Tue, 19 May 2009, Neil Schwartzman wrote: On 19/05/09 10:55 AM, Marc Perkel m...@perkel.com wrote: That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition is any domain that has not

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Marc Perkel
Neil Schwartzman wrote: On 19/05/09 10:55 AM, Marc Perkel m...@perkel.com wrote: That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition is any domain that has not current legitimate email. Good

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Marc Perkel
Ned Slider wrote: John Hardin wrote: On Tue, 19 May 2009, Neil Schwartzman wrote: On 19/05/09 10:55 AM, Marc Perkel m...@perkel.com wrote: That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition is

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Karsten Bräckelmann
And I do have a goal of !00% accuracy although that is difficult to attain. While I guess most blacklist operators do aim at a perfect blacklist, regardless of specific definitions and whether others agree or not... That's probably one of the worst shift typos in history. ;-) Other than

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Marc Perkel
Karsten Bräckelmann wrote: And I do have a goal of !00% accuracy although that is difficult to attain. While I guess most blacklist operators do aim at a perfect blacklist, regardless of specific definitions and whether others agree or not... That's probably one of the worst shift

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread LuKreme
On 19-May-2009, at 20:34, Karsten Bräckelmann wrote: Other than that, I recently enabled Hostkarma blacklists here, just to check. FWIW, it's scoring *really* good for me. So good, I seriously toned it down. I want to evaluate it first. For that, I need something even close to a considerable,

Re: Got dead domains that get a lot of spam?

2009-05-19 Thread Marc Perkel
LuKreme wrote: On 19-May-2009, at 20:34, Karsten Bräckelmann wrote: Other than that, I recently enabled Hostkarma blacklists here, just to check. FWIW, it's scoring *really* good for me. So good, I seriously toned it down. I want to evaluate it first. For that, I need something even close to