-----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Thursday, September 09, 2004 5:14 PM To: SpamAssassin Users; SURBL Discuss Subject: Re: Start an IP list to block?
On Thursday, September 9, 2004, 2:05:28 PM, Alex Broens wrote:
Chris Santerre wrote:
OK, this isn't the first time we've had this discussion,
but Raymond and I
felt this should be made public again. He ran thru some
tests of 1500+
domains and found the following data. Looks like they maybe
send from
zombies, and never their hosts. IPs are similar across the board.
So is there a way to use the IP info in a good way? Could
SA or SURBL do a
quick ping of the URL and match against a URL? This would
allow us to simply
list 1 IP instead of all these domains.
(I'm well aware of virtual hosts! So only the filthiest of
spammers would be
put on this IP list. Then their IP better boot them or
anyone hosted on that
box would feel the rath of SURBL.)
--Chris
Chris, Raymond ,
I went thru a random few of these and they're were listed at
Spamhaus.
Using spamhaus at SMTP level or SA doing RBL lookups would
have caught
and stopped them...
Yes, that is a good answer. Use Spamhaus RBLs... :-)
No it isn't a good answer. They are NOT sending from these IPs. You can list them in all the RBLs from here to eternity. If they don't send from them, it doesn't matter.
They are hosting from them. Which means SURBL needs to convert the domain to IP, then use Spamhaus.
--Chris
-
Chris Santerre