>> For example, 212.227.126.135, scores 4 out of a 100 on senderscore. It
>> also currently hits just sorbs. The individual score for each would >> have to be so low, even with such a poor reputation, that it hardly >> makes it worthwhile. I can't reject just on the almost worst >> reputation as you can have or just on sorbs, and the combination of >> the two isn't significant enough either. >I also meant to point out that with a reputation like 4 out of a 100, >you'd think it would be listed on more RBLs than just sorbs. Something >is wrong there. A mail server doesn't receive an absolutely horrible >reputation without being blacklisted elsewhere. Senderscore is not >trustworthy. I disagree. In fact, you can run a report and see the graph of the past month of email which is more than you can see with other RBLs. If you setup senderscore weighting in postscreen like it has been posted on this list (like 6 out of 8 for that low of a score), then it would have been blocked in combination with SORBS. When you see the senderscore.org graph go up on volume (blue) and the score (red) go down, that server is definitely blasting out some spam. Also add it to your SA scoring so low reputation scores in senderscore.org will add some points to augment Bayes and other rules. Senderscore.org seems to be faster reacting than other RBLs, which is why you may not have seen that IP on RBLs at that time. However, look at it now... Wow! http://multirbl.valli.org/lookup/212.227.126.135.html I have a feeling that some major ISPs and commercial products utilize senderscore.org. They don't seem to have a query limit so they are wanting people to use them. I have not had a false positive yet as long as you setup weighting properly in postscreen and scoring in SA. Still Invaluement plus Zen has been the best combination. Senderscore.org is good to add to those since it seems to catch compromised servers quickly.
