potential blacklist stats

[Fred Broughton]

I had used Vispan until I was upgrading my MS and SA installations and
found MailWatch.

I was really hung up on the automatic updates to Sendmail access lists
and kept Vispan running for quite a while after I had installed
MailWatch for just that feature, but these caused issues at times once I
started using RBLs. I would at times have traveling users that were on
dynamic ISP addresses that were blacklisted. With it blocked at the
Sendmail access list, I had no way for them to authenticate for sending
so I finally shut Vispan off.



-----Original Message-----
From: Philip Parsons [mailto:pparsons at COLUMBIAFUELS.COM] 
Sent: Tuesday, July 13, 2004 1:12 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: potential blacklist stats

I am using a program called Vispan
http://www.while.homeunix.net/mailstats/ not only does it get you stats
but is scans your maillog file and adds people to your access list that
have spammed x amount of time or even sent you viruses x amount of times
all configured by numbers you tell it..It is very cool and works well. 

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
Behalf Of hermit921
Sent: Tuesday, July 13, 2004 10:45 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: potential blacklist stats

I intend to block at the MTA level when I add another blacklist.  But I
want to get an idea of the effects before I start using it.

I thought about extracting all the IP addresses that delivered mail and
running a script to check each of those against various lists, but I
hoped to find an easier way.

hermit921


At 03:48 PM 7/12/2004, Stephen Swaney wrote:
> > -----Original Message-----
> > Subject: potential blacklist stats
> >
> > I put one IP blacklist in place (postfix) and it is blocking about 
> > 20% of incoming mail attempts.  A good start.  Now I want to find 
> > the next most effective (and well documented, low false positive 
> > rate, etc) blacklist.  Is there a way for MailScanner to do a check 
> > against several blacklists such as XBL, CBL, SORBS, etc. and report 
> > how many connections come from an IP address on each list?  Then 
> > pick the best one and block that in postfix.  Repeat cycle as
feasible.
>
>
>We recommend blocking at the MTA level - on one RBL,
>
>         sbl.xbl.spamhaus.org (see www.spamhaus.org)
>
>Blocking reduces the load on MailScanner / SpamAssassin much more than 
>blacklisting. The email is never accepted for delivery so it never hits

>MailScanner, SpamAssassin or the virus scanner(s).
>
>Stephen Swaney
>President
>Fortress Systems Ltd.
>Steve.Swaney at FSL.com
>
> > This could provide us with some good data to persuade powers that be

> > to allow us to use more blacklists.  What I really want is to show 
> > that [make up a number here] 30% of what we tag as spam would have 
> > been rejected before it was allowed onto our mail server.
> >
> > hermit921
> >

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html