-----Original Message----- From: Kris Deugau [mailto:kdeu...@vianet.ca] Sent: Monday, June 10, 2013 2:21 PM To: spamassassin-users Subject: Re: Large # of Spam getting through all of a sudden.
>*nod* I recently flagged them as a nuisance netblock owner in the >internal DNSBL[1] here. I've been seeing them for years. >I have 54 netblocks of various sizes and distances from the regional IP >registry on file for them, plus far more suballocations to their >apparent customers. >I would recommend scoring RP_MATCHES_RCVD to -0.001; it may be useful >in combination with other factors, but as-is and with the default Bayes >autolearn thresholds it can cause bad Bayes autolearn results. I'd also >recommend dropping the Bayes autolearn-as-ham threshold below 0. >-kgd >[1] To maintain this local DNSBL, I feed IPs and whatever ARIN, RIPE, APNIC, >AfriNIC or LACNIC allocation and reallocation data I can find into a somewhat >rough-edged tool I wrote: >https://secure.deepnet.cx/trac/dnsbl. It's set up to preemptively tag >netblocks over time; if IPs keep getting reported in any given block, sooner >or later it will cross a threshold >and IPs not actually reported will still >have a bit set in the DNS result. >In closing in on three years, I think I've removed netblocks for >false-positives due to change in ownership of the block maybe twice. Thanks for the suggestions and information on your experience with maintaining your own DNSBL, I have adjusted my autolearn-as-ham below 0 (-5 for now) I can see how in this scenario that I am in how that was not helping me.. I also set my RP_MATCHES_RCVD to -0.001, I was going to do that anyhow based on other reading I have done. After this I am considering taking a look at building my own DNSBL, when I have more time later I will check out the tools you made, I took a quick look at the Perl scripts and they look like it makes it allot easier to do myself. Thanks for making that available to everyone. Brian =========================================================== CIRCULAR 230 DISCLOSURE: Pursuant to Regulations Governing Practice Before the Internal Revenue Service, any tax advice contained herein is not intended or written to be used and cannot be used by a taxpayer for the purpose of avoiding tax penalties that may be imposed on the taxpayer. =========================================================== CONFIDENTIALITY NOTICE: This electronic mail message and any attached files contain information intended for the exclusive use of the individual or entity to whom it is addressed and may contain information that is proprietary, privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information may be subject to legal restriction or sanction. Please notify the sender, by electronic mail or telephone, of any unintended recipients and delete the original message without making any copies. =========================================================== NOTIFICATION: Katten Muchin Rosenman LLP is an Illinois limited liability partnership that has elected to be governed by the Illinois Uniform Partnership Act (1997). ===========================================================
