Re: Corpus of Spam/Ham headers(Source IP) for research

[Reindl Harald]

Am 29.06.2016 um 12:35 schrieb Olivier:

Reindl Harald <h.rei...@thelounge.net> writes:

Am 29.06.2016 um 06:45 schrieb Olivier:

Though I have devised a mechanism to generate these blacklists,  I am
not
finding a suitable evaluation metric. It would be great if somebody
could
give me a dataset of source IP addresses of emails received by your
network
which have been marked as HAM/SPAM by Spamassassin for the year 2016.

Maybe you need to be a bit more specific in what you need: when you
write "source IP", do you mean the enveloppe? The first Received-by:, the
From hearder?

I think people would be less concerned about privacy if all you ask is
in a form:

Ham
list of ham IPs

Spam
List of spam IPs

with no name or personnal data attached (the list could even be posted
to pastebin through a proxy :)

he asked *exactly the same* with "dataset of source IP addresses of
emails received" but for a ton of relations you just need that IP and a
PTR combined with whois lookup to get relations one would not want to be
public

Your milleage may vary, but provided you have a large enough number of
users and you manage to send the corpus anonymously, all information you
give is that somewhere on Internet, a mail server did receive messages
from google.com and from hotmail.com and lists.oetiker.ch and also
gtzq.com sent you some spam.

a nice start for targeted phishings in the wrong hands

forget the big ones - just filter them out and look at the small ones where PTR/Sender is from the same domain, connect it to your destination domains which are easily to find out and voila you have comapny-to-company relations by looking at the business

The ratio spam/ham may indicate the approximate age of your server; you
may guess my country or my type of business from the ham; but that would
be about all of it. Unless you are engaged in high security activities,
I don't see much of a problem.

Lastly, would expect that Shivram keeps the data private, so it would not
be so much "in public".

waht one expects don't matter when he gives out data related to his users

But I can be corrected

signature.asc
Description: OpenPGP digital signature