[SURBL-Discuss] Re: Start an IP list to block?

Jeff Chan jeffc at surbl.org
Fri Sep 10 19:13:38 CEST 2004


On Friday, September 10, 2004, 9:00:16 AM, Pete McNeil wrote:
> On Friday, September 10, 2004, 10:43:39 AM, Jeff wrote:

JC>> What I'm talking about is an internal process where we keep track
JC>> of resolved IP addresses and use that to add new domains to
JC>> SURBLs sooner if they resolve to a similar IP range (probably
JC>> /24s).  We would use the resolved IP addresses to add domains
JC>> to sc.surbl.org and possibly other lists sooner.  Most would
JC>> probably get added on the first report.  :-)

> I recommend a bit of caution on this point. My preliminary data on
> using /24s to drive recursive domain additions is that it is prone to
> false positives - The network surrounding a given web host is
> frequently populated with non-spam servers it seems... at least
> frequently enough that it's a challenge to generalize in this way.

Hi Pete,
Thanks for your comments.  By "recursive domain additions" to you
mean to initiate a proactive search of domains within a given
network?  What I'm proposing is not to actively try to search,
but simply to bias the inclusion of domains that are *actually
reported to us as being in spams*.

Hopefully my description of the difference makes some sense
and it can be seen why the potential for false inclusions
might be lower when the space is *actual spam reports*, and
not the space of all domains hosted in nearby networks.

Jeff C.



More information about the Discuss mailing list