Re: [exim] I've modified Erik Mugele's exim_surbl.pl utility…

Ted Cooper wrote:
> Mike Cardwell wrote:
>
>> Graeme Fowler wrote:
>>
>>> On Mon, 2008-09-15 at 16:37 -0700, Marc Perkel wrote:
>>>
>>>> One of the important additions I made in the code was the addition of
>>>> checking against a whitelist database to eliminate false positives.
>>>>
>>> Small nit: that doesn't eliminate false positives. It eliminates
>>> returning positive results against hosts, addresses or URIs in the
>>> database - not the same thing at all.
>>>
>> *Every* single domain name that it caught on my system yesterday failed
>> to fall within their listing policy:
>>
>> existsshaded.com
>> dozencourier.com
>> orecopper.com
>> bedcalab.com
>> anrosite.com
>> searchvisiontech.com
>> cluttlergroup.com
>> dogsswim.com
>> phosphatefarmhouse.com
>> jadedistinguished.com
>>
>> None of those are were created within the last 5 days. Most of them were
>> nowhere near 5 days.
>>
>
> However, every single one of them either has fake whois data, is a
> questionable marking email source, has had its dns servers re-delegated
> due to spam, or is a click farming operation.
>
> If they keep on listing the domains that no one wants to hear from past
> 5 days, I don't mind ;)
>
>

Yeah - the idea here is to catch spam. And it's still experimental so
that's why I'm talking about it here so others can experiment too. And
if it ultimately doesn't work then I'll quit using it and others will
see it's a waste of time.

I'm also experimenting with the combination of tracking NOT QUIT and the
DOB list and blocking new domains that don't close with quit. The seems
promising as well.