IP address reputation, BorderWare

[Rick Chadderdon]

Kevin Miller wrote:
> Rick Chadderdon wrote:
>   
>> If you have any
>> statistics showing the ratio of cache hits to new addresses, at least
>> in your case, I'd be interested in seeing them.
>>     
>
> Between 7 am yesterday and 7 am today I got the following results:
>
> Sender 1st time fails:	 4697
> Sender cache fails:	  547
> Total Sender fails:	 5244
>
> Recipient 1st time fail: 2355
> Recipient cache fails:	  766
> Total Recipient fails:	 3121
>
> I rejected 1735 due to greet-pause.  Those are dropped before SAV is
> attempted.
>
> Not overwhelming cache hits, but somewhere around 10% for the sender
> fails.

Thanks!  That's about what I'd have guessed.  I'd also guess that 
probably 50% of those cache hits are made up of less than ten different 
addresses.  Things like root at localhost or the defaults for various spam 
sending software packages.  Wanna count 'em for me?  :)

> I whole heartedly agree I should be doing recipient checks first - it
> will be interesting to see where the numbers fall when that change is
> implemented.
>   

I wait eagerly to hear more when that happens.

>>>> But NDRs are sent by servers administered by people who *should* know
>>>> better.  Like Yahoo and AOL.  If it was your average user sending them
>>>> out I'd agree with you but that's not who's configuring servers.

I can't recall ever noticing a bogus NDR from either of those providers, 
although I have three TOS notifications from AOL sitting in my 
global-postmaster mailbox because of joke one of my users sent to too 
many of his "friends".  I also have a few bogus NDRs from some .jp 
domain because of a persistent joe job I've had to deal with on and off 
for a couple of years on one of my domains.

> Now if they
> would just let us cane spammers we would see spam disappear overnight.
> But that's more of that idealism...
>   

I prefer the Russian approach of just beating them to death, but I'm a 
moral absolutist.  :)

Rick