[SURBL-Discuss] RE: Start an IP list to block?

Chris Santerre csanterre at merchantsoverseas.com
Thu Sep 9 23:21:05 CEST 2004



>-----Original Message-----
>From: Jeff Chan [mailto:jeffc at surbl.org]
>Sent: Thursday, September 09, 2004 5:14 PM
>To: SpamAssassin Users; SURBL Discuss
>Subject: Re: Start an IP list to block?
>
>
>On Thursday, September 9, 2004, 2:05:28 PM, Alex Broens wrote:
>> Chris Santerre wrote:
>
>>> OK, this isn't the first time we've had this discussion, 
>but Raymond and I
>>> felt this should be made public again. He ran thru some 
>tests of 1500+
>>> domains and found the following data. Looks like they maybe 
>send from
>>> zombies, and never their hosts. IPs are similar across the board. 
>>> 
>>> So is there a way to use the IP info in a good way? Could 
>SA or SURBL do a
>>> quick ping of the URL and match against a URL? This would 
>allow us to simply
>>> list 1 IP instead of all these domains.
>>> 
>>> (I'm well aware of virtual hosts! So only the filthiest of 
>spammers would be
>>> put on this IP list. Then their IP better boot them or 
>anyone hosted on that
>>> box would feel the rath of SURBL.)
>>> 
>>> --Chris
>
>> Chris, Raymond ,
>
>> I went thru a random few of these and they're were listed at 
>Spamhaus.
>> Using spamhaus at SMTP level or SA doing RBL lookups would 
>have caught 
>> and stopped them...
>
>Yes, that is a good answer.  Use Spamhaus RBLs...  :-)
>

No it isn't a good answer. They are NOT sending from these IPs. You can list
them in all the RBLs from here to eternity. If they don't send from them, it
doesn't matter.

They are hosting from them. Which means SURBL needs to convert the domain to
IP, then use Spamhaus.

--Chris


More information about the Discuss mailing list