Newsgroup: it.news.net-abuse
Titolo: [STATISTICHE] spam rifiutato da attila.bofh.it (dicembre 2003)

Queste sono le statistiche aggregate dello spam rifiutato da
attila.bofh.it
 tra queste date:
Dec 7 00:49:38
Jan 4 00:48:53
Al momento della generazione di queste statistiche, il server era
protetto (nell'ordine) da queste DNSBL:
xbl.spamhaus.org
sbl.spamhaus.org
list.dsbl.org
relays.ordb.org
dnsbl.njabl.org
korea.services.net
dul.dnsbl.sorbs.net
l1.spews.dnsbl.sorbs.net
  27814	Sender Domain not found
  22712	header checks
  17560	body checks
  15302	DNSBL 
cbl.abuseat.org
   9712	DNSBL 
dul.dnsbl.sorbs.net
   9000	User unknown
   8350	Sender address rejected
   7782	DNSBL 
list.dsbl.org
   7342	DNSBL 
dnsbl.njabl.org
   6360	Client host rejected
   5273	DNSBL 
xbl.spamhaus.org
   3547	DNSBL 
korea.services.net
   2941	DNSBL 
l1.spews.dnsbl.sorbs.net
   1714	DNSBL 
sbl.spamhaus.org
    703	DNSBL 
relays.ordb.org
    299	Need FQDN address
    223	Relay access denied
    156	Bad HELO
     80	Recipient address rejected
      9	Need FQDN address (recipient)
 146879	TOTAL
Rejected headers:
  18619	Gibe-F/Swen.A worm
   2567	no executable attachments allowed
   1275	Your mailer is not RFC 2047 compliant
    169	do not send stupid bounces
     47	keep your viruses for yourself
     16	we do not accept automatically generated complaints
     14	Message content rejected
      4	Ralsky from 
cta.cq.cn
      1	Ralsky from cncgroup-hl
Rejected bodies
  17539	keep your viruses for yourself
     21	do not send stupid bounces
Rejected hosts
   4843	Too much spam from CHINANET
    809	non accettiamo posta da IP dinamici
    554	Access denied
     83	Too much spam from 
gwbn.net.cn
     31	Too much spam from 
ethome.net.tw
     16	Too much spam from your site
     15	Too much spam from 
chinamobile.com
      7	fuck you nigeria
      2	Too much spam from 
consultingweb.it
-- 
ciao,
Marco

 
sbl.spamhaus.org
non e' meglio usare solo  
sbl-xbl.spamhaus.org
 ?


In termini di efficienza si', perche' e' una sola query anziche' due.
La risposta permette comunque di discriminare (per SBL e' 127.0.0.2,
per XBL 127.0.0.4) e mantenere statistiche separate  (quindi,
potrebbe anche essere che Marco manda query a sbl-xbl e le separa
al momento di scrivere le statistiche).
furio

ab...@3.1.0.0.8.1.4.1.1.0.0.2.ip6.arpa says...
| 
| 
xbl.spamhaus.org
| 
sbl.spamhaus.org
| 
list.dsbl.org
| 
relays.ordb.org
| 
dnsbl.njabl.org
| 
korea.services.net
| 
dul.dnsbl.sorbs.net
| 
l1.spews.dnsbl.sorbs.net
E 
cbl.abuseat.org
 ?
Sul mio MailWasher fa un bel lavoro.
-- 
50+38

 Sul mio MailWasher fa un bel lavoro.
infatti, anche a me mi toglie parecchio spam.
-- 
Ciao, Dmitry
Posted from X-Privat Free NNTP server - 
www.x-privat.org

 E 
cbl.abuseat.org
 ? Sul mio MailWasher fa un bel lavoro.
Da: 
http://www.spamhaus.org/xbl/
 
| The XBL wholly incorporates the highly-trusted CBL (Composite Block
| List) from 
cbl.abuseat.org
, therefore mail servers already using
| 
cbl.abuseat.org
 should NOT also use 
xbl.spamhaus.org
 or you will be
| making 'double' queries to basically the same data source and only one
| DNSBL will appear to work, the other will appear to not catch
| anything.
-- 
Cornelius dixit. 
Co-moderatore di 
www.fab4fans.com
 
Redattore di 
www.scidecom.org
 
"La grandezza della mia morale è proporzionale al mio successo"

corn...@despammed.com
 says...
| 
| Da: 
http://www.spamhaus.org/xbl/
 
| 
| | The XBL wholly incorporates the highly-trusted CBL (Composite Block
| | List) from 
cbl.abuseat.org
, [...]
Denghiu`.
BTW xbl non ce l'avevo.
-- 
50+38

  18619	Gibe-F/Swen.A worm
qualcosa del genere:
/^.*(((Current|Newest|Last|New|Latest)
+)?((Net|Network|Microsoft|Internet) +)?((Critical|Security)
+)?(Patch|Update|Pack|Upgrade)|((FW:|FWD:|RE:) +)?((Check|Check
out|Prove|Taste|Try|Try on|Look at|Take a look
at|See|Watch|Use|Apply|Install) +)?((these|the|that|this)
+)((correction|corrective|security|critical|internet|important)
+)(pack|package|patch|update)((for ((Microsoft|MS)
+)?((Windows|Internet Explorer) +))?(((which|that) +)((came|comes)
+))?from (the +)?(M$|Microsoft|MS)( +(Corporation|Corp\.)))).*$/REJECT
?
-- 
http://e-0.org



Non basta:
[root@e-0 root]# cat /etc/postfix/body_checks
/^b3IAAABBZG1pbgAAAEdFVCBodHRwOi8vd3cyLmZjZS52dXRici5jei9iaW4vY291bnRlci5naWYv/i
REJECT I-Worm.Swen
(
http://archives.neohapsis.com/archives/postfix/2003-09/2409.html
)
tanto ho poco traffico.
-- 
http://e-0.org