Spam Filter ISP Forums : Blacklist cache

Spam Filter ISP Forums : Blacklist cache https://www.logsat.com/spamfilter/forums/ Mon, 17 Aug 2026 12:30:55 +0000 Sat, 14 Apr 2007 16:30:22 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6014 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Blacklist cache : Roberto, As I was sitting there...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=10006&title=blacklist-cache#10006 Author: WebGuyz
Subject: 6014
Posted: 14 April 2007 at 4:30pm

Roberto,

As I was sitting there writing yet another filter today for some persistent spam I realized that majority of the spam fighting we do is reactive, we deal with it after it hits the mailbox by writing filters or using Surbl lists, etc. Even the new db system your talking about has to spend cpu cycles and other resources reading the spam in and then figuring out if its spam or not.

Greylisting works on the assumption all mail is spam unless the same attempt is made a second or third time, and the belief that most spam is fire and forget coming from a large population of zombies PC's in a botnet that does not retry a failed message send. It builds a whitelist of good ip's and never again fails messages coming from that combo of ip/sender/recipient.

I feel that this feature would be more desireable in the short term to help fight these spammer turds.

Anyone else feel as strongly as I do?

]]> Sat, 14 Apr 2007 16:30:22 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=10006&title=blacklist-cache#10006 <![CDATA[Blacklist cache : LogSat wrote:We're in...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=9940&title=blacklist-cache#9940 Author: caratking
Subject: 6014
Posted: 01 April 2007 at 9:15am

LogSat wrote:

We're in the initial stages of developing a huge database, similar to the SFDB, that will contain samples of both content and images, that will be used to help i the fight of these new types of attacks.

That sounds exciting, DNA for every SPAM message and SPAM image.
]]> Sun, 01 Apr 2007 09:15:47 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=9940&title=blacklist-cache#9940 <![CDATA[Blacklist cache : Is this kind of like 'dna...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=9938&title=blacklist-cache#9938 Author: WebGuyz
Subject: 6014
Posted: 30 March 2007 at 5:11pm

Is this kind of like 'dna fingerprinting' I see other spam filters adverstising?

Sound like it might be really great, but rather complex. In the SmarterMail forums (thats the mail server package I use) they are raving about greylisting really cutting down on spam, but of course, I do all my spam filtering thru SFI and can't really tell how good a job it does.

]]> Fri, 30 Mar 2007 17:11:24 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=9938&title=blacklist-cache#9938 <![CDATA[Blacklist cache : Once SpamFilter Enterprise is...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=9937&title=blacklist-cache#9937 Author: LogSat
Subject: 6014
Posted: 30 March 2007 at 4:40pm

Once SpamFilter Enterprise is released officially within the next few days, we'll start working on two new filters which we hope will address the issue of spammers using "zombie" machines. As WebGuyz pointed out, often times the same spam is sent from a multitude of different machines. We're in the initial stages of developing a huge database, similar to the SFDB, that will contain samples of both content and images, that will be used to help i the fight of these new types of attacks.]]> Fri, 30 Mar 2007 16:40:04 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=9937&title=blacklist-cache#9937 <![CDATA[Blacklist cache : I myself are already greylisting...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=9936&title=blacklist-cache#9936 Author: mbrusl
Subject: 6014
Posted: 30 March 2007 at 2:39pm

I myself are already greylisting IPs. Even though its not the same as doing it thru SF, I use the firewall to accomplish the same thing. If anyone want to know what the IPs are, feel free to visit my site at www.spacequad.com

]]> Fri, 30 Mar 2007 14:39:41 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=9936&title=blacklist-cache#9936 <![CDATA[Blacklist cache : Would love to be able to offer...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=9935&title=blacklist-cache#9935 Author: Web123
Subject: 6014
Posted: 30 March 2007 at 12:28am

Would love to be able to offer Greylisting as option for my customers Think it would be one "great filter" among others is SF

/Kim

]]> Fri, 30 Mar 2007 00:28:37 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=9935&title=blacklist-cache#9935 <![CDATA[Blacklist cache : Seems to me that the sneaky spammers...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=9933&title=blacklist-cache#9933 Author: WebGuyz
Subject: 6014
Posted: 29 March 2007 at 7:17pm

Seems to me that the sneaky spammers are getting around getting caught in the blacklist cache by rotating their spam amongst all the PC's in their botnet. Since it takes a long time to go through thousands of PC's (and their unique IP's) that some herders have, a lot of attempts expire and the spam keeps pounding away. Gone are the days when a dictionary attack came from a single IP and it was easy to detect and the blacklist cache effectively stopped it.

I know greylisting has been discussed before and rejected with the blacklist cache being the response to the greylisting request. And I even wholeheartedly agreed with the decision.

But with the change in tactics the question of greylisting needs to be brought up again. Anyone feel the same or is it just me beating that same old dead horse.

]]> Thu, 29 Mar 2007 19:17:32 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6014&PID=9933&title=blacklist-cache#9933