FUN PROJECT:
Help Rob McEwen test his new anti-spam tools!
(NOTE: I have been granted official permission from Jeff Chan to make this
announcement on the SURBL list!)
As many already know... I'm one of a **small** handful of organizations with
authority to blacklist and whitelist "at will" on SURBL and I've provided
much administrative assistance to SURBL for years, particularly in
preventing false positives. Of course, my efforts there are miniscule
compared to Jeff Chan's great work! Still, Jeff has thanked me countless
times for my assistance.
Most importantly, I have an "insider's view" and **uncommon expertise** into
what it takes to make a "world class" blacklist and, within the next few
business days, I will be officially releasing my 2 new "Invaluement Spam
Blocklists":
(1) The "Invaluement-URI" blocklist
(much like SURBL & URIBL)
..AND..
(2) The "Invaluement-SIP" blocklist, a Sender's IP blocklist
(a.k.a. an "RBL", like DSBL, SBL, etc.).
SIP = "Sender's IP"
Proverbs 15:22 says, "Without counsel plans fail, but with many advisers
they succeed." NOT that these two lists will be built by committee... but,
along these lines, I sure could use some feedback!
You may be asking:
--WHY SHOULD WE USE THESE LISTS?
--HOW ARE THEY HELPFUL?
--WHAT ARE THESE?
First, if you are already using SURBL & URIBL, continue to do so!
Invaluement-URI will NOT replace SURBL & URIBL as those lists WILL catch
things that Invaluement-URI will miss or not catch as quickly.
However...
**************************************
REGARDING: "Invaluement-URI" blocklist
**************************************
(A) The "Invaluement-URI" blocklist is catching over 1,000 URIs (per week)
minutes, hours, and even days BEFORE surbl or uribl or even uribl-red!
Did you catch that? Let me repeat:
****Invaluement-URI is listing over 1,000 URIs (per week) minutes, hours,
and even days BEFORE surbl or uribl or even uribl-red!****
(If a URI showed up on ANY 1 of these lists, I didn't count it towards that
tally. I ONLY counted items which were not on ANY of those other lists!)
Q: Why? How?
A: Mostly because Invaluement-URI is a "fast reacting" list! Often even
faster than URIBL-RED!!
Q: Why is this important?
A: Because many new series of spams are listed on Invaluement-URI lightening
fast and this will help you block much spam that would otherwise pass
through your spam filtering during those minutes/hours BEFORE the URI is
listed on SURBL or URIBL.
(B) The "False Positive Rate" for Invaluement-URI is extremely low -- and
might even be better than SURBL's already very low FP rate! I have yet to
spot a single egregious FP... and the **few** that I have spotted (and
removed) were VERY questionable to begin with!
NOTE: Being aggressive and fast is easy... but doing such **without** the
FPs is incredibly difficult. Years of programming and analysis went into the
development of these two lists!
(C) Additionally, Invaluement-URI is catching many URIs, particularly
phishes, that **might** NEVER be getting in SURBL or URIBL... or at least
that seems to be the case as several days have gone by without them being
listed.
NOTE: You might ask, "Rob, why haven't **you** placed these into SURBL or
requested them be listed in URIBL?" The answer is simple. In recent weeks,
finishing touches on these new lists have consumed most of my time and
energies. But I do plan to use this knowledge/data to do more submissions to
SURBL & URIBL. However, even then, for various reasons, such submissions
will have to be "hand-submitted" and "hand-checked". Therefore,
Invaluement-URI will STILL haVE the "upper hand" in being a fast-reaction
list.
**************************************
REGARDING: "Invaluement-SIP" blocklist
**************************************
I find that many Sender's IP blocklists (a.k.a. "RBLs"):
(1) tend to catch much spam without FPs, but also seem to have diminishing
returns... sort of an upper limit in their effectiveness... a "glass
ceiling"
...OR...
(2) block much legit mail and/or very credible sources... or even purposely
"punish" sources of legit mail for those ISP's/ESP's who are lacking in
their prevention of spams sent from their network.
So you are "stuck" with one type of Sender's IP blocklist being helpful, but
very limited... and the other type too aggressive to be used, requiring that
you "score" it very, very low in your filtering to prevent FPs... thus
minimizing its effectiveness!
IN CONTRAST... you'll find Invaluement-SIP to be a "best of both worlds"
Sender's IP Blocklist. It is as aggressive and "fast reacting" as many of
the best... listing MANY IPs that are not yet on other RBLs... but NOT
having the high FP rate found on many other "aggressive" IP blacklists.
**************************
REGARDING: BOTH blocklists
**************************
LOW MEMORY FOOTPRINT:
While both are "quick reacting"... both are also "quick expire time" lists.
If a spam hasn't been seen containing that URI or from that Sender's IP for
more than a few weeks, it gets expired and removed. This keeps the "memory
footprint" very low... and this opens up multiple possibilities... like
possible use in spam appliances or even routers which otherwise couldn't
efficiently work with lists that have almost a million or more entries...
many of which are so outdated that they include items practically never seen
"in the wild" anymore.
Additionally, this smaller "footprint" also allows for fast data transfers /
updates. These lists are ONLY available via RSYNC or BIND "zone transfers".
But because the dataset is so relatively small, the updates are (and can
be!) more frequent... allowing my "quick strike" capabilities to help you in
your "real time" spam filtering.
Amazingly I provide **2 minute update frequency** for RSYNC access and 4
minute expire time on zone transfers! (Compare this to some blacklists which
take longer than this just to get to complete a single transfer!)
QUALITY AND DISCERNMENT:
Both lists have an amazing ability to block the very dirty ESPs which are
more "pretenders" who are trying to "look" like legit ESPs, but haven't
really ever sent to a true confirmed opt-in subscriber. Yet, at the same
time, both Invaluement lists are very good at NOT targeting ESPs know to
have sent **some** amount of legit opt-in e-mail.
In other words, e-mail admins probably won't have to use that sledgehammer
as often if they would employ this "surgeon's scalpel".
Additionally, **spammers beware** messages are kept "on file" as "evidence"
for EVERY SINGLE LISTING. In the event of a suspicious listing being
questions by the sender, the intended recipients WILL be contacted to
confirm or deny that they opted in!
Also, MUCH behind the scenes auditing takes place to ensure quality!
***********************************
PRICE: What are the fees for usage?
***********************************
First, these lists are NOT for free. The are available ONLY via RSYNC or
BIND Zone Transfer. The price ranges from $12.50/month to $605/month,
depending on such things as # of users being protected, willingness to allow
us to list you as a subscriber, linking to our website, etc. I expect that
most subscribers will pay either the lowest price, or close to the lowest
price. The higher prices are more for exotic users and VERY large ISPs or
filtering providers. One price procures access to BOTH Invaluement-SIP
**and** Invaluement-URI.
ALSO: No anonymous usage allowed. Payments will be via paypal... but the
basic contact information provided at the time of signup must be legit and
authentic.
****************************
WEEKEND PROJECT INSTRUCTIONS
****************************
For the next 2-4 days, I'll provide FREE access to these lists.
Send me an e-mail with the following:
(1) Name & contact information, including phone number & e-mail address,
company, etc.
(2) Tell me the approximate number of mailboxes/users that your use of this
product will protect if/when you decide to officially subscribe.
(3) Let me know if you need RSYNC access, or Bind Zone Access, or both
(4) Include the IP address that I should grant permission for the access
type specified.
***************************************
STEEP DISCOUNTS IN RETURN FOR TESTING!!
***************************************
The first 10 people who post a thoughtful and detailed analysis of the
results of their testing went will get a special discount if/when they
decide to subscribe. The post must be to either the SpamAssassin list or the
SPAM-L list. Please refrain from further posts on the URIBL & SURBL lists as
I have permission to make this announcement there... but NOT to discuss this
in depth there since those lists are NOT for general spam fighting
techniques/tools.
The first 10 people who spot an egregious FP will get this same discount.
Sent the (munged) URI to my address along with the message it was spotted in
zipped.
SPECIAL DISCOUNT: If you protect less than 100,000 users/boxes, you'll get
the first 6 months at $1/month. If you protect more than 100,000 users,
you'll get the first 6 months at half the regular price (which would first
be calculated depending on other options chosen, THEN the ADDITIONAL
discount applied.
Testing access will be cut off soon after the product is "officially"
released... but these discounts will STILL be obtainable (to be applied to
subsequent months) until the 10 & 10 spots have filled up.
***************************
HOW TO JUDGE/TEST THIS DATA
***************************
Simple.
(1) Does using these lists cause your filtering to block MORE spams than it
otherwise would if you didn't use this list.
(2) Does it do with WITHOUT causing FPs... or is the FP rate low compared to
other such lists.
IMPORTANT: Testing must be done on "live" data and using constantly synced
datalists. Otherwise, you diminish many of the most important the advantages
that set this list apart from others. You can "score" the "hits" low on live
data if you want to test it in a "safe" way. Try to devise a system where
you can examine what both of these lists "hit" on that got overall missed by
your spam filter. Running the lists against recent corpuses will only work
for spotting FPs... but, even then, be sure it wasn't really a "False
Negative"!
Remember, if you are blocking 96% of all spam and use of these two lists
improves your catch rate to 97%... a one percent reduction might not seem
like a lot... but the key percentage is the drop in the spam that your users
SEE!! Therefore, if the amount of spam which gets past your filter through
drops from 4% down to 3%, this is a whopping 25% reduction in the amount of
spam that your users see. That is huge! If someone did that for you, what
would you do in return? You'd hug them... take them out to dinner... thank
them profusely.
I contend that these "Invaluement blacklists" will be "on par" with those
kind of results and you'll find the fees to be low compared to what you are
getting in return.
***************
GETTING STARTED
***************
Contact me, Rob McEwen, today and I'll provide you the access information.
For access, send the requested information to the following:
invaluement(a)PowerViewSystems.com
(PLEASE - keep discussion about this on the SURBL list to an absolute
minimum. SA and SPAM-L are more appropriate. Or e-mail me directly.)
Rob McEwen
PowerView Systems
invaluement(a)PowerViewSystems.com
