Re: DNSBL Comparison 20091010

2009-10-13 Thread Benny Pedersen
On tir 13 okt 2009 16:22:55 CEST, "McDonald, Dan" wrote On Tue, 2009-10-13 at 15:42 +0200, Matus UHLAR - fantomas wrote: > On søn 11 okt 2009 02:31:58 CEST, John Rudd wrote >> On Sat, Oct 10, 2009 at 16:44, Warren Togami wrote: >>> Given that zen.spamhaus.org is a combination of XBL and PBL, t

Re: DNSBL Comparison 20091010

2009-10-13 Thread McDonald, Dan
On Tue, 2009-10-13 at 15:42 +0200, Matus UHLAR - fantomas wrote: > > On søn 11 okt 2009 02:31:58 CEST, John Rudd wrote > >> On Sat, Oct 10, 2009 at 16:44, Warren Togami wrote: > >>> Given that zen.spamhaus.org is a combination of XBL and PBL, this > >>> data seems to confirm the good reputation of

Re: DNSBL Comparison 20091010

2009-10-13 Thread Matus UHLAR - fantomas
> On søn 11 okt 2009 02:31:58 CEST, John Rudd wrote >> On Sat, Oct 10, 2009 at 16:44, Warren Togami wrote: >>> Given that zen.spamhaus.org is a combination of XBL and PBL, this >>> data seems to confirm the good reputation of Spamhaus. >> Er.. Zen is a combination of SBL, XBL, and PBL. Not just t

Re: [SA] DNSBL Comparison 20091010

2009-10-11 Thread Henrik K
On Sun, Oct 11, 2009 at 01:10:17PM -0400, Adam Katz wrote: > > Here are the default scores for the DNSWLs I know of: > > RCVD_IN_DNSWL_LOW 0 -1 0 -1 > RCVD_IN_DNSWL_MED 0 -4 0 -4 > RCVD_IN_DNSWL_HI 0 -8 0 -8 > RCVD_IN_HOSTKARMA_W -5 # (nondefault rule, Marc's suggested score) You have to remembe

Re: [SA] DNSBL Comparison 20091010

2009-10-11 Thread Adam Katz
Matthias Leisi wrote (accidentally off-list): > Adam Katz schrieb: > >> My last report was sent at 2009-04-10 17:50:30 UTC to ad...@dnswl.org >> with subject "Suggested Change DNSWL Id 3523" > > That's cvent-planner.com. Based on your report and others we received, > we lowered the score for thei

Re: [SA] DNSBL Comparison 20091010

2009-10-11 Thread Adam Katz
Matthias Leisi wrote: > Did you report them to us? If there are *myriads*, there must be some > serious error which we need to fix (IPs/ranges falsely listed, > inappropriate trust levels listed, sometimes also errors in eg how > trusted_networks are set up). My last report was sent at 2009-04-10

Re: [SA] DNSBL Comparison 20091010

2009-10-11 Thread Adam Katz
Benny Pedersen wrote: > On søn 11 okt 2009 07:19:47 CEST, Adam Katz wrote > >> different return code to indicate the hit anyway so that I can act on it >> anyway. *Especially* while DNSWLs lack an abuse-reporting mechanism. > > spamassassin have firsttrusted for dnsbl same can go for dnswl testi

Re: [SA] DNSBL Comparison 20091010

2009-10-11 Thread Matthias Leisi
Adam Katz schrieb: > I've had myriads of falsely whitelisted messages hit DNSWL (.org) and Did you report them to us? If there are *myriads*, there must be some serious error which we need to fix (IPs/ranges falsely listed, inappropriate trust levels listed, sometimes also errors in eg how trus

Re: [SA] DNSBL Comparison 20091010

2009-10-11 Thread Adam Katz
Henrik K wrote: > On Sun, Oct 11, 2009 at 01:19:47AM -0400, Adam Katz wrote: >> *Especially* while DNSWLs lack an abuse-reporting mechanism. >> >> I have seen SO much DNSWL'd spam that I've had to migrate to using > > Just to be clear, what DNSWLs are you talking about? It's a bit > confusing as t

Re: DNSBL Comparison 20091010

2009-10-11 Thread Marc Perkel
Warren Togami wrote: The following is an apples to apples comparisons of DNSBL lastexternal rules against the October 10th, 2009 weekly_mass_check corpora. HOSTKARMA and SEM are new. Hopefully these masscheck results can help to identify problems so list quality can improve over time. http

Re: DNSBL Comparison 20091010

2009-10-11 Thread Karsten Bräckelmann
Just a few comments and corrections. On Sat, 2009-10-10 at 19:44 -0400, Warren Togami wrote: > The following is an apples to apples comparisons of DNSBL lastexternal Minor nit: Not entirely correct. Different lists have different listing policies and criteria. A PBL listing for example does NOT

Re: DNSBL Comparison 20091010

2009-10-11 Thread Benny Pedersen
On søn 11 okt 2009 07:19:47 CEST, Adam Katz wrote different return code to indicate the hit anyway so that I can act on it anyway. *Especially* while DNSWLs lack an abuse-reporting mechanism. spamassassin have firsttrusted for dnsbl same can go for dnswl testing that mean if you have none or

Re: DNSBL Comparison 20091010

2009-10-10 Thread Henrik K
On Sun, Oct 11, 2009 at 01:19:47AM -0400, Adam Katz wrote: > *Especially* while DNSWLs lack an abuse-reporting mechanism. > > I have seen SO much DNSWL'd spam that I've had to migrate to using Just to be clear, what DNSWLs are you talking about? It's a bit confusing as the official DNSWL is calle

Re: DNSBL Comparison 20091010

2009-10-10 Thread Adam Katz
Warren Togami wrote: > Overlap analysis shows the majority of XBL and PBL are also listed by > Barracuda. Furthermore Barracuda's list seems to have a similar hit > % as XBL + PBL combined. Is Barracuda known to aggregate Spamhaus > data with their own? If so we might be adding redundant scores

Re: DNSBL Comparison 20091010

2009-10-10 Thread Warren Togami
On 10/10/2009 09:10 PM, Benny Pedersen wrote: On søn 11 okt 2009 02:31:58 CEST, John Rudd wrote On Sat, Oct 10, 2009 at 16:44, Warren Togami wrote: Given that zen.spamhaus.org is a combination of XBL and PBL, this data seems to confirm the good reputation of Spamhaus. Er.. Zen is a combinatio

Re: DNSBL Comparison 20091010

2009-10-10 Thread Benny Pedersen
On søn 11 okt 2009 02:31:58 CEST, John Rudd wrote On Sat, Oct 10, 2009 at 16:44, Warren Togami wrote: Given that zen.spamhaus.org is a combination of XBL and PBL, this data seems to confirm the good reputation of Spamhaus. Er.. Zen is a combination of SBL, XBL, and PBL. Not just the XBL and P

DNSBL Comparison 20091010

2009-10-10 Thread Warren Togami
URIBL comparisons. http://ruleqa.spamassassin.org/20091010-r823821-n 128161 Spam 185199 Ham == URIBL Comparison by Safety == SPAM%HAM%RANK RULE 50.5349% 0% 1.00 URIBL_AB_SURBL 60.4256% 0.0059% 0.99 URIBL_JP_SURBL 55.0542% 0.0113% 0.98

Re: DNSBL Comparison 20091010

2009-10-10 Thread Warren Togami
On 10/10/2009 08:55 PM, João Gouveia wrote: Hi Warren, If you don't mind me asking, how does this kind of comparison take into account the dynamic nature of zombie infected machines? For example, an IP address may be infected at some point, and be listed in XBL, but later the client IP address c

Re: DNSBL Comparison 20091010

2009-10-10 Thread John Rudd
On Sat, Oct 10, 2009 at 16:44, Warren Togami wrote: > Given that zen.spamhaus.org is a combination of XBL and PBL, this > data seems to confirm the good reputation of Spamhaus. Er.. Zen is a combination of SBL, XBL, and PBL. Not just the XBL and PBL.

DNSBL Comparison 20091010

2009-10-10 Thread Warren Togami
The following is an apples to apples comparisons of DNSBL lastexternal rules against the October 10th, 2009 weekly_mass_check corpora. HOSTKARMA and SEM are new. Hopefully these masscheck results can help to identify problems so list quality can improve over time. http://ruleqa.spamassassin.o