Florian, I just wanted to share my success using your hosted_in rbl rules. So far, it's hit about 2 spam per day on my primary email account. One of those would have been a false negative, had it not been for your mod :)
Thanks! -- Chris Thielen Easily generate SpamAssassin rules to catch obfuscated spam phrases: http://www.sandgnat.com/cmos/ Florian L. Klein said: > > Since spammers often host their spamvertised sites at spamfriendly ISPs > (e. g. Chinanet), I've been doing some tests with "hat-checking" > spamvertised URLs. > > After resolving the URL hostname, the resulting IPs get RBL-checked > against *.blackholes.us to find if they belong to a known spamfriendly > ISP. If yes, the spam score will rise. For example, Chinanet is "worth" > 4.0 points, as almost any email containing a link to a site hosted at > Chinanet is spam. > > For high-traffic environments it is really useful to mirror all used > *.blackholes.us zones, if possible on a DNS running on the MTA host > itself. The amount of DNS lookups per email is quite high, but most > spammers spamvertise the same IP quite often, and *.blackholes.us uses > long TTL values. > > This way spammers will have a problem - they may choose a spamfriendly > ISP, but they'll have more of their spam emails filtered. Or they choose > a "white-hat" ISP and don't get filtered but kicked. > > > Sorry if a similar idea has been mentioned before, but IMHO it is quite > useful to beat spammers with their own weapons, of which black-hat ISPs > are a major one. > > My patch against SpamAssassin 2.60 (Debian/unstable: 2.60-2) > http://docsnyder.de/nospam/sa_check_blackhat_isps.patch.gz > <snip> ------------------------------------------------------- This SF.Net email sponsored by: ApacheCon 2003, 16-19 November in Las Vegas. Learn firsthand the latest developments in Apache, PHP, Perl, XML, Java, MySQL, WebDAV, and more! http://www.apachecon.com/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
