Re: hostkarma junkemailfilter

2008-11-18 Thread Marc Perkel
Henrik K wrote: On Sun, Nov 16, 2008 at 03:29:07PM -0500, Micah Anderson wrote: Over at another post about Phishing[0], Brent suggested setting up hostkarma.junkemailfilter to my RBL list, which I have done... However it seems to hit a lot of spams giving them a -5 scoring. I've either got

Re: Long scan times with ctyme.ixhash.net

2008-09-29 Thread Marc Perkel
Jan Doberstein wrote: Wolfgang Zeikat schrieb: Do others also see that effect with ctyme.ixhash.net? yes, thats why i added ixhash_timeout 10 to my configuration (maybe hardware/bandwith on ctyme will be upgraded) regards jd For what it's worth I'm the one who is providing

Trying out a new concept

2008-09-22 Thread Marc Perkel
I don't know how this will work but I'm building the data now. For those of you who are familiar with Day old bread lists to detect new domains, as you know there's a lag time in the data and they often don't have data from all the registries. So - here's a different solution. What I'm

Re: Trying out a new concept

2008-09-22 Thread Marc Perkel
Ken A wrote: Marc Perkel wrote: I don't know how this will work but I'm building the data now. For those of you who are familiar with Day old bread lists to detect new domains, as you know there's a lag time in the data and they often don't have data from all the registries. So - here's

Re: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-22 Thread Marc Perkel
McDonald, Dan wrote: Henrik K wrote: On Mon, Sep 22, 2008 at 09:23:45AM -0500, Daniel J McDonald wrote: On Mon, 2008-09-22 at 10:14 -0400, Justin Piszcz wrote: On Mon, 22 Sep 2008, Daniel J McDonald wrote: On Sun, 2008-09-21 at 18:18 -0500, Len Conrad

Re: Trying out a new concept

2008-09-22 Thread Marc Perkel
McDonald, Dan wrote: On Mon, 2008-09-22 at 15:44 -0700, Marc Perkel wrote: Ken A wrote: Marc Perkel wrote: I don't know how this will work but I'm building the data now. For those of you who are familiar with Day old bread lists to detect new domains, as you know there's

Re: Trying out a new concept

2008-09-22 Thread Marc Perkel
Blaine Fleming wrote: John Hardin wrote: Why is it so flippin' difficult to get a feed of newly-registered domain names? Because the TLDs hate giving people access to the data and certainly won't provide a feed without a bunch of cash involved. Even worse, all the ccTLDs pretty much

I've created a new Day Old Bread type list RBL

2008-09-17 Thread Marc Perkel
I've been working with Blaine Flemming and he's compiling his own DOB data and I'm publishing it for him. I'm throwing it out there to see if any of you find it as useful as I am finding it. The list can be accessed as follows: hostkarma.junkemailfilter.com = 127.0.0.6 What I'm catching is

rbldnsd blacklist question

2008-09-16 Thread Marc Perkel
Looking from opinions from people running rbl blacklists. I have a list that contains a lot of name based information. I'm about to add a lot more information to the list and what will happen is that when you look up a name you might get several results. For example, a hostname might be

New Day old Bread list trick

2008-09-15 Thread Marc Perkel
I just discovered the Day old Bread list of host names under 5 days old. I don't know where they get it but the list is very useful. As many of you know I also track hosts that don't use the QUIT command to close connections. So it occurred to me that if a domain is less than 5 days old AND

Re: New Day old Bread list trick

2008-09-15 Thread Marc Perkel
Great minds think alike. :) What I'm doing is a modification of this. I'm using the Day old Bread list but only adding IF they also skip the QUIT to close the connection AND I'm subtracting out my white list. Curtis LaMasters wrote: This is quite an interesting trick. Never actually thought

Re: New Day old Bread list trick

2008-09-15 Thread Marc Perkel
Blaine Fleming wrote: Marc Perkel wrote: I just discovered the Day old Bread list of host names under 5 days old. I don't know where they get it but the list is very useful. I remember playing with this list a few years ago but now they seem to lag a few days behind. For example

Re: New Day old Bread list trick

2008-09-15 Thread Marc Perkel
Blaine Fleming wrote: Marc Perkel wrote: Blaine Fleming wrote: Marc Perkel wrote: I just discovered the Day old Bread list of host names under 5 days old. I don't know where they get it but the list is very useful. I remember playing with this list a few years ago but now they seem

Experimenting with QUIT and NOTQUIT - New DNS list

2008-09-07 Thread Marc Perkel
For those of you who want to experiment I've created a new dnsrbl list of IP addresses and host names that use QUIT to close connections and those who do not use QUIT. I have found that there are a few legitimate senders who are skipping using QUIT to close. Here's the rules. I have about 5

Re: Handy script for generating /etc/resolv.conf

2008-09-01 Thread Marc Perkel
Aaron Wolfe wrote: On Sun, Aug 31, 2008 at 10:59 PM, RobertH [EMAIL PROTECTED] wrote: It was explained somewhere earlier in the thread that he sometimes has to reboot his central dns servers and he apparently doesn't run local caching servers on the individual MX/SA nodes. I have to say

Re: Handy script for generating /etc/resolv.conf

2008-08-31 Thread Marc Perkel
Well, the code works for me. If someone has a better solution I'll switch to yours. I just created it because I needed it and thought I'd share it with others who might need it. But if any of you want to improve it or replace it with something better I'm always looking for new tricks.

Handy script for generating /etc/resolv.conf

2008-08-28 Thread Marc Perkel
Here's something I threw together to make sure the /etc/resolv.conf points to a working nameserver. I run this once a minute. It checks to see what name servers are up and creates /etc/resolv.conf. As you all know SA and mail servers need the first nameserver to always be working. #!/bin/bash

Re: Handy script for generating /etc/resolv.conf

2008-08-28 Thread Marc Perkel
Marc Perkel wrote: Here's something I threw together to make sure the /etc/resolv.conf points to a working nameserver. I run this once a minute. It checks to see what name servers are up and creates /etc/resolv.conf. As you all know SA and mail servers need the first nameserver to always

Re: Handy script for generating /etc/resolv.conf

2008-08-28 Thread Marc Perkel
Matus UHLAR - fantomas wrote: On 28.08.08 08:41, Marc Perkel wrote: Here's something I threw together to make sure the /etc/resolv.conf points to a working nameserver. do you have problems with nameservers? Do you run own one? I guess that setting timeout, rotate and attempts

Re: Handy script for generating /etc/resolv.conf

2008-08-28 Thread Marc Perkel
Matus UHLAR - fantomas wrote: We have 4 DNS servers behind L3 switch that monitors DNS servers... This script is a poor man's L3 switch. :)

Re: Handy script for generating /etc/resolv.conf

2008-08-28 Thread Marc Perkel
Ralf Hildebrandt wrote: * Matus UHLAR - fantomas [EMAIL PROTECTED]: I guess that setting timeout, rotate and attempts options in resolv.conf could help you more than such script Nice tip, but there's no option that will back off from a dead DNS. Of course timeout/attempts and

spamd: bad protocol: header error

2008-08-26 Thread Marc Perkel
Getting a lot of these: spamd: bad protocol: header error: (closed before headers) at /usr/bin/spamd line 2001. Not sure what this means. Thanks in advance for your help.

Re: Blacklist Mining Project - Project Tarbaby

2008-08-26 Thread Marc Perkel
Robert Schetterer wrote: Marc Perkel schrieb: Hi everyone, I'm launching a free spam reduction service to help build up my blacklists. It involves adding a fake high numbered MX record to your existing MX list that points to one of our servers. We always return a 451 error but we have

Re: Blacklist Mining Project - Project Tarbaby

2008-08-26 Thread Marc Perkel
Graham Murray wrote: Ralf Hildebrandt [EMAIL PROTECTED] writes: * Robert Schetterer [EMAIL PROTECTED]: thats could be seen as a security risk cause in rare cases you may recieve legal mails i.e at an network outage etc How? He tempfails all mails. Because some senders

Re: Blacklist Mining Project - Project Tarbaby

2008-08-26 Thread Marc Perkel
Ken A wrote: Ralf Hildebrandt wrote: * Robert Schetterer [EMAIL PROTECTED]: Project Tarbaby helps you reduce spam and helps us build our blacklist. This is done by adding a fake MX record to your existing MX lists thats could be seen as a security risk cause in rare cases you may

Re: Blacklist Mining Project - Project Tarbaby

2008-08-26 Thread Marc Perkel
Ken A wrote: Ralf Hildebrandt wrote: * Ken A [EMAIL PROTECTED]: How? He tempfails all mails. Are you asking how sending your customer, or company email off someplace you don't control might be a security risk? It's in no way more dangerous than using Postini... Have you compared

Re: Blacklist Mining Project - Project Tarbaby

2008-08-26 Thread Marc Perkel
Aaron Wolfe wrote: On Tue, Aug 26, 2008 at 12:26 PM, Marc Perkel [EMAIL PROTECTED] wrote: You continue to miss the point, or maybe you just don't want to understand it. Sending my client's email to your servers is irresponsible at best and possibly even a violation of contract or illegal

Blacklist Mining Project - Project Tarbaby

2008-08-25 Thread Marc Perkel
Hi everyone, I'm launching a free spam reduction service to help build up my blacklists. It involves adding a fake high numbered MX record to your existing MX list that points to one of our servers. We always return a 451 error but we have a very good way of detecting virus infected spam

Re: Blacklist Mining Project - Project Tarbaby

2008-08-25 Thread Marc Perkel
Jean-Paul Natola wrote: Hi everyone, I'm launching a free spam reduction service to help build up my blacklists. It involves adding a fake high numbered MX record to your existing MX list that points to one of our servers. We always return a 451 error but we have a very good way of

Looking for dead domains that still get a lot of spam

2008-08-21 Thread Marc Perkel
We are harvesting data for our blacklists. Do you have an old dead domain that gets a lot of spam? We could use it. Just point your MX record to us. tarbaby.junkemailfilter.com Here's the details of what we are doing with it. It also covers using us as your fake highest MX record.

Re: Looking for dead domains that still get a lot of spam

2008-08-21 Thread Marc Perkel
Whoops - Here's the real link. http://wiki.junkemailfilter.com/index.php/Project_tarbaby Marc Perkel wrote: We are harvesting data for our blacklists. Do you have an old dead domain that gets a lot of spam? We could use it. Just point your MX record to us. tarbaby.junkemailfilter.com

Free Spam Reduction Service - Project Tarbaby

2008-08-18 Thread Marc Perkel
Hi everyone, I'm launching a free spam reduction service to help build up my blacklists. It involves adding a fake high numbered MX record to your existing MX list that points to one of our servers. We always return a 451 error but we have a very good way of detecting virus infected spam

I'd like to get my blacklist/whitelist included in SA

2008-07-25 Thread Marc Perkel
I'm referring to the Hostkarma list from junk email filter. http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists What is the procedure/requirements to make this happen? I have 4 servers running rbldnsd. Questions What kind of license do I need to provide to be SA compatible? What

Re: [OT] Odd spammer tactic?

2008-07-22 Thread Marc Perkel
There's people out there who are better and faster programmers than I am. I need a simple utility written We can post it on the SA Wiki when we're done. I don't care what it's written in but I'm thinking that xinetd might be easiest. What I want is something to record the IP address of any

Re: [OT] Odd spammer tactic?

2008-07-22 Thread Marc Perkel
Ramprasad wrote: Marc Perkel wrote: There's people out there who are better and faster programmers than I am. I need a simple utility written We can post it on the SA Wiki when we're done. I don't care what it's written in but I'm thinking that xinetd might be easiest. What I want

Re: [OT] Odd spammer tactic?

2008-07-22 Thread Marc Perkel
be. Jonas Eckerman wrote: Marc Perkel wrote: I don't care what it's written in but I'm thinking that xinetd might be easiest. What I want is something to record the IP address of any host connection to port 25. You don't really need to accept the connection. Just logging connection attenmpts

Re: [OT] Odd spammer tactic?

2008-07-21 Thread Marc Perkel
Christopher Bort wrote: This is really not a SpamAssassin issue, but since this list is populated by people who are interested in spammer behavior, I'm throwing it out for comment. If it's too far off topic, my apologies and I'll let it go at that. At $DAYJOB I run a mail server and a name

Sendmail Question [OT]

2008-07-18 Thread Marc Perkel
Just a quick sendmail question I'm asking for a friend. If they want to make sendmail listen on port 2525 instead of 25 - what do they meed to change? Email me privately off list. Thanks in advance

Re: Is ASN information useful?

2008-07-15 Thread Marc Perkel
Matthias Leisi wrote: Marc Perkel schrieb: Has anyone determined if ASN information is useful in determining if a message is/is not spam? Unfortunately, it does not seem to be *that* useful: http://matthias.leisi.net/archives/176-Where-does-your-spam-come-from.html -- Matthias

Suggestion for Freemail Plugin Enhancements

2008-07-14 Thread Marc Perkel
May I suggest that the test for reply_to and email addresses in the body of the email be separate routins and separate rules and separate scores. Also perhaps there should be a rule to see if the from is freemail but no freemail in received headers. For example, from is yahoo.com but no yahoo

Is ASN information useful?

2008-07-14 Thread Marc Perkel
Has anyone determined if ASN information is useful in determining if a message is/is not spam?

Re: Detecting the Registrar of the sending host?

2008-07-07 Thread Marc Perkel
Yet Another Ninja wrote: On 7/2/2008 6:05 PM, Marc Perkel wrote: Is there an easy way to detect the registrar of a domain through DNS? For example - can I easilly figure out if an email I'm processing is hosted by GoDaddy or Tucows? Here's what I'm thinking. I think there's some expensive

Re: Better whitelisting with DNSWL

2008-07-03 Thread Marc Perkel
Henrik K wrote: On Thu, Jul 03, 2008 at 10:48:07AM +0200, Matus UHLAR - fantomas wrote: On 03.07.08 11:35, Henrik K wrote: I'd like to encourage people to take more advantage of DNSWL. I'm currently converting DNSWL entries into trusted_networks and using shortcircuited

Re: Detecting the Registrar of the sending host?

2008-07-03 Thread Marc Perkel
Matus UHLAR - fantomas wrote: On 03.07.08 13:22, Henrik K wrote: If lesser registrar means that it's probably ham, why couldn't someone use that to add some negative scores or use it as a part of whitelist trustworthiness? Even if it's handful of domains, it's useful. If you could get the

Re: Detecting the Registrar of the sending host?

2008-07-03 Thread Marc Perkel
Michele Neylon wrote: On 2 Jul 2008, at 19:56, Marc Perkel wrote: Again - it's not to figure out where spam comes from. It's figuring out where non-spam comes from. I think there are registrars out there that don't have any spam domains registered. What are you trying to prove

Re: Detecting the Registrar of the sending host?

2008-07-03 Thread Marc Perkel
Richard Frovarp wrote: Marc Perkel wrote: Michele Neylon wrote: On 2 Jul 2008, at 19:56, Marc Perkel wrote: Again - it's not to figure out where spam comes from. It's figuring out where non-spam comes from. I think there are registrars out there that don't have any spam domains

Detecting the Registrar of the sending host?

2008-07-02 Thread Marc Perkel
Is there an easy way to detect the registrar of a domain through DNS? For example - can I easilly figure out if an email I'm processing is hosted by GoDaddy or Tucows? Here's what I'm thinking. I think there's some expensive and highly secure registrars out there who are the registrar of

Re: Detecting the Registrar of the sending host?

2008-07-02 Thread Marc Perkel
John Hardin wrote: On Wed, 2 Jul 2008, Marc Perkel wrote: Is there an easy way to detect the registrar of a domain through DNS? For example - can I easilly figure out if an email I'm processing is hosted by GoDaddy or Tucows? Registrar != hosted by. Here's what I'm thinking. I think

Re: Detecting the Registrar of the sending host?

2008-07-02 Thread Marc Perkel
Martin Gregorie wrote: On Wed, 2008-07-02 at 17:05, Marc Perkel wrote: Is there an easy way to detect the registrar of a domain through DNS? For example - can I easilly figure out if an email I'm processing is hosted by GoDaddy or Tucows? Even if it was possible I don't think its

Re: Detecting the Registrar of the sending host?

2008-07-02 Thread Marc Perkel
Martin Gregorie wrote: On Wed, 2008-07-02 at 18:46, Marc Perkel wrote: Martin Gregorie wrote: On Wed, 2008-07-02 at 17:05, Marc Perkel wrote: Is there an easy way to detect the registrar of a domain through DNS? For example - can I easilly figure out if an email I'm

Fremail Plugin Suggestion

2008-06-30 Thread Marc Perkel
I'd like to suggest an additional feature for the freemail plugin. If you test the sending host through FCrDNS and determine that the sending host is a freemail hostname (like google.com) then you should consider it a freemail sender. Thus if the sending host is Google, but the reply-to or an

Re: Fremail Plugin Suggestion

2008-06-30 Thread Marc Perkel
Henrik K wrote: On Sun, Jun 29, 2008 at 11:37:13PM -0700, Marc Perkel wrote: I'd like to suggest an additional feature for the freemail plugin. If you test the sending host through FCrDNS and determine that the sending host is a freemail hostname (like google.com) then you should

Re: Spam volumes down since last week

2008-06-24 Thread Marc Perkel
Daniel J McDonald wrote: On Tue, 2008-06-24 at 10:19 -0400, Randy Ramsdell wrote: ram wrote: I am seeing a clear downtrend in the number for spams hitting our servers, I am not sure why ? Since Last week spams are at 50% of what they used to be last month. Is this what you all are

Re: Fake MX Record(s) Trick

2008-06-23 Thread Marc Perkel
Marc Ferguson wrote: Hi, I'm a linux noob and a spam assassin noob so please reply in simplified language. Thanks. I saw on the wiki a trick to use fake mx records in order to weed out spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home and on my laptop

Odd number of elements in hash assignment

2008-06-10 Thread Marc Perkel
What would cause this? Jun 10 11:21:29 spamd0 spamd[20360]: Odd number of elements in hash assignment at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/BayesStore.pm line 322. Jun 10 11:21:29 spamd0 spamd[20360]: Use of uninitialized value in list assignment at

I need your spam!

2008-06-05 Thread Marc Perkel
Actually - I just need your spam attempts. I have a way to detect spambots on the first try and add them to my blacklist at hostkarma.junkemailfilter.com Sp - if you want to participate and lose a chunk of your virus spambot spam all you have to do is add us as your highest numbered MX

Re: List of Banks often spoofed in Phishing scams

2008-06-04 Thread Marc Perkel
Randal, Phil wrote: We should be marking ALL such behaviour as phishing and hope that the banks (etc) finally get a clue. I certainly wouldn't trust my money with an outfit that was that clueless about security. Cheers, Phil Actually in some ways this leads to an interesting idea. In

List of Banks often spoofed in Phishing scams

2008-06-03 Thread Marc Perkel
Here's a short list of banks often spoofed in phishing scams. I'm using this list as follows: If the FCrDNS matches one of these domains it is ham. If the sender or from address matches one of these domains and the domain doesn't appear in the Received headers - it's a phish. If anyone has

Re: List of Banks often spoofed in Phishing scams

2008-06-03 Thread Marc Perkel
Patrick McLean wrote: royalbankofcanada.com This is the wrong URL for the Royal Bank, it appears to be a domain camping site. Generally RBC's emails come from rbc.com, they also own royalbank.com, royalbank.ca, rbcroyalbank.ca and rbcroyalbank.com. Also you can add: desjardins.com I get

Proposal for free mail domain DNS list

2008-06-02 Thread Marc Perkel
In the freemail plugin rather that listing all the domains in the plugin I propose a network of DNS servers that list the names using rbldnsd. We also have a central location where we maintain the list. That way the list can be updated faster and people have current information. I suggest

Re: Proposal for free mail domain DNS list

2008-06-02 Thread Marc Perkel
Henrik K wrote: On Mon, Jun 02, 2008 at 08:09:40AM -0700, Marc Perkel wrote: In the freemail plugin rather that listing all the domains in the plugin I propose a network of DNS servers that list the names using rbldnsd. We also have a central location where we maintain the list

Re: google netblocks records etc

2008-06-02 Thread Marc Perkel
Robert - elists wrote: Since they seem to have zillions of outbound mx machines I did this in response to some email latency issues. dig google.com txt google.com. 31 IN TXT v=spf1 include:_netblocks.google.com ~all then i dig _netblocks.google.com txt

Re: DNS ISP Host List Available

2008-05-31 Thread Marc Perkel
Henrik K wrote: On Thu, May 29, 2008 at 11:25:19AM -0700, Marc Perkel wrote: I've also created a DNS based list of domains that provide consumer dynamic IP address space. I'm using this list internally but thought I'd make it public in case others can use it. Trying to inspire

Re: DNS ISP Host List Available

2008-05-30 Thread Marc Perkel
Matus UHLAR - fantomas wrote: Marc Perkel wrote: I've also created a DNS based list of domains that provide consumer dynamic IP address space. I'm using this list internally but thought I'd make it public in case others can use it. Trying to inspire innovation. Example: dig

Freemail Domains DNS Lookup

2008-05-29 Thread Marc Perkel
I now have a name based DNS lookup for freemail domains. If anyone finds this useful let me know. example: dig yahoo.com.freemaildomains.junkemailfilter.com

DNS ISP Host List Available

2008-05-29 Thread Marc Perkel
I've also created a DNS based list of domains that provide consumer dynamic IP address space. I'm using this list internally but thought I'd make it public in case others can use it. Trying to inspire innovation. Example: dig comcast.com.isphosts.junkemailfilter.com This list was created by

Re: DNS ISP Host List Available

2008-05-29 Thread Marc Perkel
Ken A wrote: Marc Perkel wrote: I've also created a DNS based list of domains that provide consumer dynamic IP address space. I'm using this list internally but thought I'd make it public in case others can use it. Trying to inspire innovation. Example: dig

Interesting data - but is it good for anything?

2008-05-23 Thread Marc Perkel
I started collecting host names where the registry barrier part of the FCrDNS is the same as the registry barrier part of the helo. I don't know what it's good for - if anything - but looking for ideas as to what to do with it. Just have a gut level feeling that I'm on to something here.

Re: Experimental - use my server for your high fake MX record

2008-05-21 Thread Marc Perkel
mouss wrote: Jo Rhett wrote: On May 7, 2008, at 9:17 AM, mouss wrote: what if he comes back later to the same MX, again and again (AFAIK, this is the case with qmail)? mail will be lost. snarky comment Good. Time for qmail to die ;-) /snarky comment start by updating the RFCs.

Re: Experimental - use my server for your high fake MX record

2008-05-21 Thread Marc Perkel
Jo Rhett wrote: On May 7, 2008, at 9:17 AM, mouss wrote: what if he comes back later to the same MX, again and again (AFAIK, this is the case with qmail)? mail will be lost. snarky comment Good. Time for qmail to die ;-) /snarky comment Agreed. Qmail should die!

Mining fake MX and no QUIT for spambot project

2008-05-20 Thread Marc Perkel
Hi everyone, I'm back from vacation and want to pick up where I left off. I had offered to let anyone use one of my hosts. tarbaby.junkemailfilter.com as your highest numbered MX. The idea being that I would always return a 451 error. You would gain some spam reduction and I would gain

Re: Mining fake MX and no QUIT for spambot project

2008-05-20 Thread Marc Perkel
continuing This project is targeted mostly at harvesting the IP addresses of virus infected spambots. First - some background. I virus infected spambot sends email differently than SMTP servers and there is enough difference that they can usually be detected on the first attempt to

Re: Mining fake MX and no QUIT for spambot project

2008-05-20 Thread Marc Perkel
... continued As I said in my last mesage. The High MX no quit spambot detectors will send UDP messages to a receiving server that listens for these messages and processes them into blacklists. What I'm doing is just using SOCAT to listen. But doing it right you might want to use a real

MySQL my.cnf file for innodb

2008-05-17 Thread Marc Perkel
Just looking for some my.cnf example files for SA. Server has 4 gigs of ram, dual core CPU. What do I want in my my.cnf file? Thanks in advance.

MySQL Unreliable

2008-05-16 Thread Marc Perkel
Need a little help for MySQL users. I'm running several servers that are using a common MySQL server for bayes for all the SA servers. What I'm seeing is that MySQL is just plain unreliable. The database is often corrupted and it does so in a manner that basically causes SA to hang until it

Re: MySQL Unreliable

2008-05-16 Thread Marc Perkel
SM wrote: At 06:30 16-05-2008, Marc Perkel wrote: I'm running several servers that are using a common MySQL server for bayes for all the SA servers. What I'm seeing is that MySQL is just plain unreliable. The database is often corrupted and it does so in a manner that basically causes SA

Re: Experimental - use my server for your high fake MX record

2008-05-08 Thread Marc Perkel
ram wrote: IOn Wed, 2008-05-07 at 08:50 -0700, Marc Perkel wrote: Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free and mutual benefit. I (junkemailfilter.com) want to be your highest numbered

Re: Experimental - use my server for your high fake MX record

2008-05-08 Thread Marc Perkel
John Hardin wrote: On Thu, 8 May 2008, Marc Perkel wrote: To participate all you have to do is set your highest numbered MX to point to: tarbaby.junkemailfilter.com Several people have asked me how I'm doing this and can they have my code to do it themselves. My situation is unique

Re: Experimental - use my server for your high fake MX record

2008-05-08 Thread Marc Perkel
Kevin Parris wrote: Well now, if a spambot actually does start recognizing and avoiding his system, doesn't that mean he wins and the spammer loses? I would say YES! You should make an effort to clean it up so that others *can* install it as a standalone daemon, as I suggested. Why?

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread Marc Perkel
Randy Ramsdell wrote: DAve wrote: Marc Perkel wrote: Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free and mutual benefit. I (junkemailfilter.com) want to be your highest numbered fake MX record

Starting a URIBL - Howto? [OT]

2008-04-26 Thread Marc Perkel
I was just wondering from those of you who have done it - how to start a URIBL. I'm guessing the process (simplified) is: 1) Mine messages for links 2) Subtract out anything matching a fairly large white list So my first question here is - what do most of you used to mine the links in a

Help with SED [OT]

2008-04-26 Thread Marc Perkel
Trying to do something that should be simple. Using sed to remove the first part of a hostname but not working. I want: abc.def.com to become def.com I tried a lot of variations of the following but it's either greedy or does nothing. sed -e 's/^.*?[.]//' Thanks in advance.

Re: Looking for hosts to white list

2008-04-23 Thread Marc Perkel
Henrik K wrote: On Tue, Apr 22, 2008 at 07:50:33PM -0700, Marc Perkel wrote: What I'm looking to do with host name base white lists is use forward confirmed RDNS to keep certian domain from being accidentally blacklisted. What's funny is that you already mentioned this a bunch

Re: Looking for hosts to white list

2008-04-23 Thread Marc Perkel
Jon Armitage wrote: Justin Mason wrote: sorry Marc, you weren't the first to come up with that idea. He didn't say that he was, just that he was the first to raise it on the list. Jon It may have been 2001. But at the time I remember saying that all spam wants you to do something

Re: Looking for hosts to white list

2008-04-23 Thread Marc Perkel
Chris Santerre wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: 2008-04-23 10:48 To: Marc Perkel Cc: users@spamassassin.apache.org Subject: Re: Looking for hosts to white list Marc Perkel writes: Yep - one of the ideas I originated here

Re: Looking for hosts to white list

2008-04-23 Thread Marc Perkel
Robert - elists wrote: Snip If anyone has tested HostKarma already... and found it promising, but a little lacking... I suggest testing it again. It is even better now. In fact, most DNSBLs do not suddenly come on the scene perfect. Most have had MUCH growing pains. Therefore,

Looking for hosts to white list

2008-04-22 Thread Marc Perkel
I'm looking for people who are running URI blacklists, but I'm more interested in your whitelist information. I have an extensive list myself and looking for partners to swap data with.

Re: Looking for hosts to white list

2008-04-22 Thread Marc Perkel
Benny Pedersen wrote: On Tue, April 22, 2008 23:47, Marc Perkel wrote: I'm looking for people who are running URI blacklists, but I'm more interested in your whitelist information. I have an extensive list myself and looking for partners to swap data with. hell no, dont give idears

Re: Looking for hosts to white list

2008-04-22 Thread Marc Perkel
stopping spammers from putting in amazon.com, google.com, yahoo.com, etc. and they can be pretty sure these domains are whitelisted already by the uribl organizations. On Wed, Apr 23, 2008 at 01:51:10AM +0200, Benny Pedersen wrote: On Tue, April 22, 2008 23:47, Marc Perkel wrote: I'm looking

No Blacklist DNS List

2008-04-17 Thread Marc Perkel
I've created a public no blacklist DNS list of host names and IP addresses that should never be blacklisted. Some of them are from my white list, some from my yellow list, and others are just names and IPs that you don't want to be on a blacklist. Here's the link that describes how to use it.

New DNS list for host information?

2008-04-03 Thread Marc Perkel
I'm considering a DNS list that would return strings as TXT records that contain key words that classify the Forward Confirmed rDNS name based on a number of flags. For example, if the host is yahoo.com it might contain yellow freemail indicating that it is yellow listed (mixed ham/spam) and

New DNS list for host information using strings instead of numbers

2008-04-03 Thread Marc Perkel
Theo Van Dinter wrote: I'm not saying anything positive or negative about the different lists, but there's a long precedent of doing this type of thing w/ bits in a standard DNS response. Look at SURBL and URIBL, for example -- a single response encodes multiple individual list entries, and

Re: FreeMail plugin

2008-03-24 Thread Marc Perkel
Henrik K wrote: Hello, I updated my FreeMail plugin with a big list of domains (http://www.rhyolite.com/anti-spam/freemail.html). Try it out: http://sa.hege.li/FreeMail.pm http://sa.hege.li/FreeMail.cf Pretty good hit ratio here, especially when you add some extra scores like FREEMAIL_FROM

Re: FreeMail plugin

2008-03-21 Thread Marc Perkel
Henrik K wrote: Hello, I updated my FreeMail plugin with a big list of domains (http://www.rhyolite.com/anti-spam/freemail.html). Try it out: http://sa.hege.li/FreeMail.pm http://sa.hege.li/FreeMail.cf Pretty good hit ratio here, especially when you add some extra scores like FREEMAIL_FROM

Re: Godaddy.com blacklisted (and deserves to be)

2008-03-20 Thread Marc Perkel
Michael Scheidell wrote: DNS ADMINS at godaddy need a lesson in RFC's. host -t mx godaddy.com godaddy.com mail is handled by 0 smtp.secureserver.net. godaddy.com mail is handled by 10 mailstore1.secureserver.net. host -t a smtp.secureserver.net smtp.secureserver.net is an alias for

Re: [spamassassin] Re: How to report 120,000 spams a day

2008-03-10 Thread Marc Perkel
SM wrote: At 17:51 08-03-2008, Tuc at T-B-O-H.NET wrote: As part of it all, I also want to try to keep disk usage and CPU down to as little as possible. With 120,000 per day, thats a junk mail every 3/4's of a second. Since I have it set to deliver to /dev/null, I reduce the amount of

Re: How many use CRM114?

2008-03-04 Thread Marc Perkel
that it works better than other learning methods. Any info would be appreciated. Hello I've only just started using it on a test server, I'll let you know how I find the results! CRM114? What's that? Can't quite figure out what it does. Is it a pony? :) -- Marc Perkel - Sales/Support [EMAIL

Wiki page on experimental spam fighting techniques

2008-03-03 Thread Marc Perkel
that in the past when I put ideas in the wiki that other people often pick up on them and do a better job than me. So - here's the link. Looking for constructive feedback. http://wiki.apache.org/spamassassin/MarcPerkelsExperiments -- Marc Perkel - Sales/Support [EMAIL PROTECTED] http://www.junkemailfilter.com

Re: Time to blacklist google.

2008-02-29 Thread Marc Perkel
. Either case, till google fixes their network and attitude, we should blacklist them. Some people might think you are over reacting I can only imagine what it would be like trying to control outgoing spam at Google. -- Marc Perkel - Sales/Support [EMAIL PROTECTED] http

Sorry for the duplicate messages

2008-02-29 Thread Marc Perkel
. -- Marc Perkel - Sales/Support [EMAIL PROTECTED] http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3401

<    1   2   3   4   5   6   7   8   9   10   >