here is also a list of rbl's that we trust and directly bounce:
(most of them are spam traps, open relay lists or filters by country so you
should be safe)
dul.dnsbl.sorbs.net,
list.dsbl.org,
xbl.spamhaus.org,
sbl.spamhaus.org,
KR.rbl.cluecentral.net,
RU.rbl.cluecentral.net,
CN.rbl.cluecentral.net,
JP.rbl.cluecentral.net,
BR.rbl.cluecentral.net,
TW.rbl.cluecentral.net,
GE.rbl.cluecentral.net,
HU.rbl.cluecentral.net,
relays.ordb.org,
zombie.dnsbl.sorbs.net,
socks.dnsbl.sorbs.net,
http.dnsbl.sorbs.net,
BG.rbl.cluecentral.net,
cbl.abuseat.org,
VE.rbl.cluecentral.net,
PL.rbl.cluecentral.net,
PH.rbl.cluecentral.net,
relays.visi.com,
UA.rbl.cluecentral.net,
CL.rbl.cluecentral.net,
TR.rbl.cluecentral.net,
AZ.rbl.cluecentral.net,
MY.rbl.cluecentral.net,
TH.rbl.cluecentral.net
Adrian
-------------------------------------------------
----- Original Message -----
From: "marc catuogno" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, March 29, 2004 12:47 PM
Subject: RE: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!)
This could work for me. I have Whitelist Auth on so my users coming in from
RR and so on should get through. If I block these (or at least weight them
heavily) I can get spam- and even new viruses - coming in through zombies,
blocked or deleted. It may block a few hobbyists running smtp on their home
servers, but I basically only have to worry about my agents, I'm not hosting
anyone else really..
Thanks - this may make my life a bit less spammy~
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Adrian Hauri
Sent: Sunday, March 28, 2004 9:30 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!)
Our company blocks everything with reverse DNS entry from
*.client.comcast.net, *.rr.com, *.du.shawcable.net, *.eastlink.ca,
*.client.attbi.com, *client2.attbi.com, *cable.wanadoo.nl,
*.de.comcast.net, *.md.comcast.net, *.tn.comcast.net, *.va.comcast.net,
*.ipt.aol.com, *.east.verizon.net, *.vie.surfer.at, *.sprint-hsd.net,
*cable.wanadoo.nl etc.
Additionallly we block everything with *-number-* (like -26-), *.number.*,
*.cable.*, *.pp.*, *.ip.*, *modem*, *async*, *rback*, *dyn*, *dhcp*, *ppp*,
*dial*, *dsl* in the reverse DNS.
This blocks a lot of unwanted emails. It is rare that a reverse DNS entry of
a legal mailserver has dsl in the name. We just had one reverse DNS entry
that we had to whitelist: mailservers for swiftdsl.com.au. But it helped us
to minimize the rbl lookup and speed up the mail processing.
There were some people who rang us up because they got the bounce message
but all of them didn't have a proper reverse DNS entry for their mailserver.
It's up to you how strict you are with blocking emails. But because we do
not run a mail service for a lot of clients we can apply strict rules.
Adrian
-------------------------------------------------
ToadShow Pty Ltd
phone: 07 3004 7900
fax: 07 3846 1220
email: [EMAIL PROTECTED]
http://www.toadshow.com.au
-------------------------------------------------
----- Original Message -----
From: marc catuogno
To: [EMAIL PROTECTED]
Sent: Monday, March 29, 2004 9:32 AM
Subject: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!)
I just got this e-mail and I just feel like someone is targeting my domain
for a spam campaign. When I hit view source, it only said "test". Any
suggestions on how to block this?? I'm surprised that DUL or DYNA didn't
catch this at all, looks like it came in though a dynamic Comcast IP not one
of their SMTP servers.
I put "prod-infinitum.com" into the declude header filter with enough weight
to hold it, but I don't think that would be enough.
Thanks - Marc
-----Original Message-----
From: Shella Arrington [mailto:[EMAIL PROTECTED]
Sent: Sunday, March 28, 2004 5:10 AM
To: [EMAIL PROTECTED]
Subject: %RND_SUBJECTS
test
Headers:
Received: from c-24-13-168-241.client.comcast.net [24.13.168.241] by
mail.prudentialrand.com
(SMTPD32-8.05) id AED14440132; Sun, 28 Mar 2004 17:16:49 -0500
Received: from 18.104.180.255 by 24.13.168.241; Sun, 28 Mar 2004 11:13:22
+0100
Message-ID: <[EMAIL PROTECTED]>
From: "Shella Arrington" <[EMAIL PROTECTED]>
Reply-To: "Shella Arrington" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: %RND_SUBJECTS
Date: Sun, 28 Mar 2004 13:10:22 +0300
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--0825904990538747225"
X-Mailer: PIPEX NetMail 2.2.0-pre13
X-IP: 221.134.57.232
X-IMAIL-SPAM-VALFROM: (71565618)
X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" [2-18-9000]
X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]" [2-19-9800]
X-RBL-Warning: IPNOTINMX: [2-25-c800]
X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command . [2-32-10000]
X-Declude-Sender: [EMAIL PROTECTED] [24.13.168.241]
X-Declude-Spoolname: D4ed1044401323a46.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, IPNOTINMX, NOLEGITCONTENT,
CMDSPACE [9]
X-Country-Chain:
X-Note: This E-mail was sent from c-24-13-168-241.client.comcast.net
([24.13.168.241]).
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 380366455
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
