Never getting URIBL_PH_SURBL hits

[Quentin Campbell]

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 12 November 2004 14:11
>To: MAILSCANNER at JISCMAIL.AC.UK
>Subject: Re: Never getting URIBL_PH_SURBL hits
>
>I've only got 1 non-Solaris MX and that doesn't handle huge 
>amounts of mail.
>But no URIBL_PH_SURBL on there either.
>
>Maybe it is just a geographic thing. Sure glad I wrote my 
>"phishing net"
>code though!
>
[snip]

This is another UK.AC site but we have seen 130 URIBL_PH_SURBL hits in
the last 3.5 hours this morning.

These were all logged on the seven RH AS 3 mail gateways we operate.
They together handle about 1,000,000 messages/day for individual users. 

It is worth pointing out as a comparison that on two other identically
configured RH AS 3 mail gateways we operate to filter e-mail for another
university plus three small colleges (all in AC.UK), I have seen just 4
URIBL_PH_SURBL hits in the same period. The volume of mail handled in
these cases is significantly less than the figure given above.

Rather than being "geographical", it seems that the incidence of
phishing spam is related to the domain(s) you host and the volume of
mail you receive.   

Quentin 
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!