-----Original Message----- From: Dave Navarro [mailto:dave@basicguru.com] Sent: Friday, June 25, 2004 12:53 AM To: discuss@lists.surbl.org Subject: [SURBL-Discuss] rDNS entries
One thing I notice is that the IP addresses of blacklisted domains are not always listed in the BL as well.
For example, when I look up:
ghcclccc.biz.multi.surbl.org
It's listed. However, when I look up:
72.2.139.221.multi.surbl.org
it's not listed.
Might I suggest that all domains listed in the BL also include corresponding IP addresses?
That might hurt a lot of virtually hosted and legit sites. We only list IPs if a spam URL explicitly lists the IP.
--Chris
Chris Santerre wrote:
That might hurt a lot of virtually hosted and legit sites.
well, if the scoring is appropriate I don't see it's worse than the way smtp rbl's are handled.
It might also encourage the webhosting companies to clamp down on spammers hosting content with them.
As an aside maybe an email address rbl could also be devised, this would make sense for 419 "in body" email addresses etc.
Regards,
Rob
El 28 Jun 2004 a las 17:19, Robert Brooks escribió:
Chris Santerre wrote:
That might hurt a lot of virtually hosted and legit sites.
well, if the scoring is appropriate I don't see it's worse than the way smtp rbl's are handled.
But, for me, SURBL is much better than plain smtp rbls because its collateral damage is very, very, very low... regretfully, I can't play the BOFH and I have to let pass legit e-mail from 'bad' or 'regular' ISPs (most ISPs in Argentina, including the largest ones would be in these categories, and I can't reject e-mail from the largest ISPs in the country).
I'm using relatively high scores for SURBL (between 3.0 and 4.0) and couldn't be doing this with a higher rate of FPs...
See the thread 'Rule for email of "$43321" ?' in SpamAssassin-Users list... SURBL caught most or all of them because it was highly scored...
It might also encourage the webhosting companies to clamp down on spammers hosting content with them.
I'll happily let SPEWS and the other IP RBLs deal with this.
Regards.
-- Mariano Absatz El Baby ---------------------------------------------------------- Don't worry. I forgot your name, too!
Mariano Absatz wrote:
But, for me, SURBL is much better than plain smtp rbls because its collateral damage is very, very, very low... regretfully, I can't play the BOFH and I have to let pass legit e-mail from 'bad' or 'regular' ISPs (most ISPs in Argentina, including the largest ones would be in these categories, and I can't reject e-mail from the largest ISPs in the country).
this is why I'd suggest a separate data source and usage/scoring to suit your needs.
I'm using relatively high scores for SURBL (between 3.0 and 4.0) and couldn't be doing this with a higher rate of FPs...
yes, personaly I'd probably only want to add 1.0 for such data but if it keeps a dirty email out of bayes it makes my life easier.
See the thread 'Rule for email of "$43321" ?' in SpamAssassin-Users list... SURBL caught most or all of them because it was highly scored...
yes, unfortunately uri blacklists are looking to be the "best last defence" against spam.
It might also encourage the webhosting companies to clamp down on spammers hosting content with them.
I'll happily let SPEWS and the other IP RBLs deal with this.
I'd don't care who provides the data if it's valid, however the uri plugin would have to support ip resolution :)
ok, I think I've had my $0.02's worth :-)
-
Chris Santerre -
Mariano Absatz -
Robert Brooks