You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@spamassassin.apache.org by Justin Mason <jm...@jmason.org> on 2004/09/09 23:17:03 UTC

Re: Start an IP list to block?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Raymond Dijkxhoorn writes:
> Hi!
> 
> > Chris, Raymond ,
> >
> > I went thru a random few of these and they're were listed at Spamhaus.
> > Using spamhaus at SMTP level or SA doing RBL lookups would have caught and 
> > stopped them... Spamcop probably has quite a few of them listed as well
> 
> No, that wont work. The spams are sended in via trojans/proxys only the 
> websites are static. SOME are blocked with DSBL and so but most of the 
> time they start a spamrun with a fresh set it seems.
> 
> So yes, they are inside spamhaus, but only the websites, didnt see mails 
> sended out from there (yet).

Are their NS records listed in the SBL?

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFBQMhPQTcbUG5Y7woRAu01AJ4rqP8QVUgTZuo3DN31kywM6WyQEQCdEXRX
15RR2pv13qVwaWhXXyQgc4Y=
=3nsN
-----END PGP SIGNATURE-----

Re: Start an IP list to block?

Posted by Jeff Chan <je...@surbl.org>.

On Thursday, September 9, 2004, 2:17:03 PM, Justin Mason wrote:
> Raymond Dijkxhoorn writes:
>> Hi!
>> 
>> > Chris, Raymond ,
>> >
>> > I went thru a random few of these and they're were listed at Spamhaus.
>> > Using spamhaus at SMTP level or SA doing RBL lookups would have caught and 
>> > stopped them... Spamcop probably has quite a few of them listed as well
>> 
>> No, that wont work. The spams are sended in via trojans/proxys only the 
>> websites are static. SOME are blocked with DSBL and so but most of the 
>> time they start a spamrun with a fresh set it seems.
>> 
>> So yes, they are inside spamhaus, but only the websites, didnt see mails 
>> sended out from there (yet).

> Are their NS records listed in the SBL?

Speaking generally, many are.  I have not tested these, but
Raymond or Bill could and should.

If these domains have name servers listed in SBL, then use
uridnsbl to stop them.

Jeff C.

Re: Start an IP list to block?

Posted by Raymond Dijkxhoorn <ra...@prolocation.net>.

Hi!

>> No, that wont work. The spams are sended in via trojans/proxys only the
>> websites are static. SOME are blocked with DSBL and so but most of the
>> time they start a spamrun with a fresh set it seems.

>> So yes, they are inside spamhaus, but only the websites, didnt see mails
>> sended out from there (yet).

> Are their NS records listed in the SBL?

Some, not all i think. Could run some tests on a larger dataset and cut 
out the nameservers... to check.

Bye,
Raymond.