In may last year I put up an proposal for a spam method, using the fact that
spam is a business proposal from the sender, therefore having to provide a
communication method for the "customer", generally a phone no or a URL. The
method, that I called Earnest, because I look for real info in the spams,
got some critisism for that the blacklist over Ph.no's and URL's to find the
spams, could be tainted.
I have now for 1.5 year been running a PoC, with generally very good
results, using a simple shellscript with some grep lines. The blacklist,
built using spams that got through and Spamarchive.org repositories, held up
fine to the present Rolex/Viagra campaines. Before the Rolex explosion, I
had an average of 2-3 spams in of ca 35 a day over the 1.5 years. To cope
with Rolex, I added SURBL DNS list to the PoC, which thankfully decreased
the post-Rolex hits from 20-30 in of 40-50 spams a day to 6-8 passing in.
SURBL has become a good tool, but it still have a turnaround of a couple of
hours before a URL domain is in the DNS, for in my tests of SURBL, it later
correctly has identified the spams that got in. I want to decrease the
turnaround time, from when I can identify them.
Does anyone know of a spamlist/webpage using multiple independent honeypots,
comparing spams and identifying them by the multiplicity of mails with the
same contact info, then presenting data realtime, so one can use it to
extract domains for blocking? It is OK if it is full mails, just that I can
generate temp blocklists, until SURBL publish the domains.
Then the list has been rather low-volume the last 1.5 month, at least at the
IETF web where I read it, is the group dying out, giving up?
Kurt Magnusson
_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg