Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Dummy SMTP - Opinions required - New feature?
  FAQ FAQ  Forum Search   Register Register  Login Login

Dummy SMTP - Opinions required - New feature?

 Post Reply Post Reply Page  <12
Author
jerbo128 View Drop Down
Senior Member
Senior Member
Avatar

Joined: 06 March 2006
Status: Offline
Points: 178
Post Options Post Options   Thanks (0) Thanks(0)   Quote jerbo128 Quote  Post ReplyReply Direct Link To This Post Posted: 26 December 2007 at 5:09pm
I have over 200K from the harvest alone.  That is less than a week's worth.  I too need to go through and remove a lot of singles and replace them with Class C entries.
I have shut down my "harvester" for the time being so that I can watch the new beta.  In case the beta screws up bad, I don't want a lot of good mail going to the harvester.  Let me know if you want to swap IP blacklists.
 
Jeremy
Back to Top
ImInAfrica View Drop Down
Groupie
Groupie
Avatar

Joined: 27 June 2006
Location: FL, USA
Status: Offline
Points: 60
Post Options Post Options   Thanks (0) Thanks(0)   Quote ImInAfrica Quote  Post ReplyReply Direct Link To This Post Posted: 26 December 2007 at 5:43pm
Dwight,

> I determined our spam by domain ranking with an sql query on the quarantine. 

Can you post or PM me your sql query you refer to?

Thanks
Amir
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 27 December 2007 at 1:17pm

Dwight,

I actually took mine off-line due to the following:  I am testing using the Greylist option and many servers initially see the greylisting action (disconnect) as a non-responsive server and pushed up the "food chain" until they hit my dummy SMTP server and then got black-listed.  This was compounded by the scripting I wrote to auto-add the IP's to my dnsbl server.  This caused a huge amount of good servers to suddenly be black-listed by our own server and that just ended up s%*king ... big time.  Up to that point, I had nearly 500,000 IP in my dnsbl with no false positives.

I need to re-think how to utilize the "spam ip harvester" as I have been calling it.
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
dcook View Drop Down
Senior Member
Senior Member
Avatar

Joined: 31 January 2005
Location: United States
Status: Offline
Points: 174
Post Options Post Options   Thanks (0) Thanks(0)   Quote dcook Quote  Post ReplyReply Direct Link To This Post Posted: 27 December 2007 at 1:26pm
Thanksfor the reply.  I was afraid of my MX (99) being pushed up the chain.  I was also concerned about the number of individual IP addresses captured.  I also have taken mine off line and have remove all MX records pointing to the dummy install. 
 
I do have an A record for the dummy server so that it has a reverse address.  I will see how many people fish for a port 25 server and capture those IP's.  There are still a lot of fishermen searching networks for mail servers. 
 
But let'keep thinking and discussing the issue on this thread.
 
Dwight
www.vividmix.com
Back to Top
ImInAfrica View Drop Down
Groupie
Groupie
Avatar

Joined: 27 June 2006
Location: FL, USA
Status: Offline
Points: 60
Post Options Post Options   Thanks (0) Thanks(0)   Quote ImInAfrica Quote  Post ReplyReply Direct Link To This Post Posted: 31 December 2007 at 5:35am
To all that have been using some sort of harvesting method using SF.
I think you may have missed the original point (and in the process made a very good one as well).

The original idea was to create a high number MX record, point it to a dummy smtp that will disconnect the session before it is completed.
Spammer WILL NOT try to resend the message, while 'real' smtp servers will retry based on their setup.

This way, even if your spamfilters are down, real emails will not be lost.
I quite like the idea of harvesting the ip's although my initial main concern was to reduce the load on the secondary MX record.

Happy New Year to everyone!

Back to Top
IKILLSPAM1 View Drop Down
Groupie
Groupie


Joined: 02 May 2007
Location: United States
Status: Offline
Points: 70
Post Options Post Options   Thanks (0) Thanks(0)   Quote IKILLSPAM1 Quote  Post ReplyReply Direct Link To This Post Posted: 03 January 2008 at 11:37am
I setup my dummy smtp with the * in local domains and in honeypots. I also have had the other honeypot setup on my primary mailserver which has email addresses that when emailed, the senders ip gets added to a file.
 
So I let my dummy smtp run for awhile. Then after around 4000 ips harvested, I took those and the 65,000 that were in the other honeypot and combined them. Brought them into MS Access table and then ran some queries to grab the highest offending Class Cs. I ended up taking any Class Cs with more than 11 IPs in my file, and exporting them to a new txt file. I then took those and added them to the local ip blacklist. I ended up added 90 Class Cs.
 
 
Back to Top
WebGuyz View Drop Down
Senior Member
Senior Member


Joined: 09 May 2005
Location: United States
Status: Offline
Points: 348
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebGuyz Quote  Post ReplyReply Direct Link To This Post Posted: 06 January 2008 at 9:36pm
Stopped using my spamtrap because of the greylisting in the new beta.
 
Very impressive 1st day numbers using the beta where 90% of the traffic I would normally have had to filter was stopped by the greylisting. My SFE's are not working anywhere as hard as they were before which is a great improvement. Clap
http://www.webguyz.net
Back to Top
dcook View Drop Down
Senior Member
Senior Member
Avatar

Joined: 31 January 2005
Location: United States
Status: Offline
Points: 174
Post Options Post Options   Thanks (0) Thanks(0)   Quote dcook Quote  Post ReplyReply Direct Link To This Post Posted: 07 January 2008 at 9:44am

I am running the latest pre-release version, "SF3.5.4.730." I have seen the discussions about greylisting but have not seen that feature offered as of yet in the registered downloads area.



Edited by dcook - 07 January 2008 at 9:45am
Dwight
www.vividmix.com
Back to Top
WebGuyz View Drop Down
Senior Member
Senior Member


Joined: 09 May 2005
Location: United States
Status: Offline
Points: 348
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebGuyz Quote  Post ReplyReply Direct Link To This Post Posted: 07 January 2008 at 2:51pm
Shoot an email to support@logsat.com and Roberto will give you the link.
http://www.webguyz.net
Back to Top
 Post Reply Post Reply Page  <12
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.235 seconds.