Re: Wow, that's a lot of spam

[Steve Linford]

From LuKreme, received 22/1/03, 12:59 pm -0700 (GMT):

% wc -l "Host is blacklisted per.21-Jan-2002"
152 Host is blacklisted per.21-Jan-2002

Now, that may not seem like a lot to some of you, but it is a LOT more than I used to get. I'm seeing 100-200 blacklists a day and I used to see 10-20.

Most of my spam is still getting blocked at my IMAP server, after SIMS since I run SpamAssassin on it.

I only have:
sbl.spamhaus.org "http://www.spamhaus.org/SBL Server you are SENDING FROM in blacklist"
dialups.relays.osirusoft.com "DIALUP USER BLOCK. Use your ISP to send mail."
korea.services.net "DIE KOREAN SPAMMER. DIE DIE DIE!"

I notice you don't have an Open Relay DNSBL in there, I would advise adding:

relays.ordb.org  " BLOCKED by ORDB - see: http://relays.ordb.org";

Also I would advise adding a good Open Proxies list, I use:

opm.blitzed.org  " BLOCKED by BOPM - see: http://www.blitzed.org/bopm/";

 If I added spews I could understand a huge increase like that.

Depends what type of spam you get as everyone's spam is different, but in general SBL and SPEWS are quite similar (both block spam sources) but the focus of SBL is to avoid false positives.

There aren't many blacklist statistics available but the main Blacklist Comparison site suggests that SBL blocks more spam than SPEWS anyway:
Blacklists Compared: http://www.sdsc.edu/~jeff/spam/cbc.html

At UXN I find we get the best spam-blocking with no false positives from this combination:

sbl.spamhaus.org " Sender BLOCKED by SBL: http://www.spamhaus.org/SBL";
relays.ordb.org " Sender BLOCKED by ORDB: http://relays.ordb.org";
opm.blitzed.org " Sender BLOCKED by BOPM: http://www.blitzed.org/bopm/";

--
Steve Linford
Ultradesign Xtreme Network
http://www.uxn.com

#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>