Re: [Assp-user] invalid HELO

2009-11-08 Thread Hisham Al Saad
Hi, > > > > The "invalid HELO" option is very useful when enabled to reject large > amount > > of spam, but unfortunately also rejects lots of legitimate mail ;-( > > You'll have to tell us what you have in your config and what gets > blocked. > > The default setting blocks an IP address or a nam

Re: [Assp-user] Blacklists

2009-11-08 Thread Scott Haneda
On Nov 8, 2009, at 9:53 AM, Grayhat wrote: > bb.barracudacentral.org=>1 Do you have to pay for this? I heard that at some point they were going to, or were charging for the data based on the analytics they gather. > bl.spamcop.net=>1 In a binary mode, block or pass, I find them too aggressi

Re: [Assp-user] Blacklists

2009-11-08 Thread Paul Whelan
On 8 Nov 2009 at 18:53, Grayhat wrote: > my current DNSBL setup is the following > > zen.spamhaus.org=>1 > cbl.abuseat.org=>4 duplication here? -- Let Crystal Reports handle the reporting - Free Crystal Reports 2008

Re: [Assp-user] Blacklists

2009-11-08 Thread K Post
Grayhat, Where do you have the other settings in the DNSBL section like max replies, max hits, max time, socket timeout, etc. Thanks. On Sun, Nov 8, 2009 at 1:05 PM, K Post wrote: > Thanks for the update and explanation! > > On Sun, Nov 8, 2009 at 12:53 PM, Grayhat wrote: >>> Here's the list fr

Re: [Assp-user] Blacklists

2009-11-08 Thread K Post
Thanks for the update and explanation! On Sun, Nov 8, 2009 at 12:53 PM, Grayhat wrote: >> Here's the list from grayhat   I believe that karamsphere is no longer. > > Yes, karmasphere is discontinuing service, so remove it; also, > my current DNSBL setup is the following > > zen.spamhaus.org=>1 >

Re: [Assp-user] Blacklists

2009-11-08 Thread Grayhat
> Here's the list from grayhat I believe that karamsphere is no longer. Yes, karmasphere is discontinuing service, so remove it; also, my current DNSBL setup is the following zen.spamhaus.org=>1 bb.barracudacentral.org=>1 bl.spamcop.net=>1 ix.dnsbl.manitu.net=>1 combined.njabl.org=>1 dul.dnsbl.

[Assp-user] A quick question about black regex.

2009-11-08 Thread aja-lists
Hi all, I've just put this in the black regex (blackRe:) section : \b.cn/\b for wanting to score for the mention of .cn/ but testing this doesn't seem to score for this. Is the expression wrong, or are characters like / not possible in here ? Regards, A.

Re: [Assp-user] Blacklists

2009-11-08 Thread K Post
Here's the list from grayhat I believe that karamsphere is no longer. I've also found that the five-ten-sg has a lot of IP's like constantcontact on it. Hope this helps. zen.spamhaus.org=>1 bl.spamcop.net=>1 ix.dnsbl.manitu.net=>1 combined.njabl.org=>1 dul.dnsbl.sorbs.net=>1 bb.barracudacentra

Re: [Assp-user] invalid HELO

2009-11-08 Thread Paul Whelan
On 8 Nov 2009 at 13:45, Hisham Al Saad wrote: > Hi, > > The "invalid HELO" option is very useful when enabled to reject large amount > of spam, but unfortunately also rejects lots of legitimate mail ;-( You'll have to tell us what you have in your config and what gets blocked. The default set

Re: [Assp-user] invalid HELO

2009-11-08 Thread Scott Haneda
I do not know how to do it, but block on ehlo/helo does not contain one dot. This is my most effective rule on another server, accounts for something like 90% of all blocked email. Then make ehlo/ehlo look like dynamic ranges. Those get the rest. -- Scott * If you contact me off list replac

[Assp-user] invalid HELO

2009-11-08 Thread Hisham Al Saad
Hi, The "invalid HELO" option is very useful when enabled to reject large amount of spam, but unfortunately also rejects lots of legitimate mail ;-( What is the best way to enable it without having those legitimate senders gets rejected. I hope there is a workaround somehow. Appreciate your input.

Re: [Assp-user] Blacklists

2009-11-08 Thread paul+as
On 6 Nov 2009 at 13:28, Blaine Fleming wrote: > I'm curious what blacklists everyone uses and how many FPs there are on > average. Anyone want to post their config? Assuming you are talking about DNSBLs, check out the thread on this list titled 'SORBS' just under a month ago. Grayhat posted h