spf-discuss
[Top] [All Lists]

Re: [spf-discuss] throwaway domains and whois

2008-10-17 16:34:01
On Fri, 17 Oct 2008, Alessandro Vesely wrote:

May I ask how do you manage black list entries rehabilitation? I'm planning to
do something similar to Stockade(*), i.e. to have a decay rate so that the
probability that a listed IP gets blocked is automatically halved every that
many seconds, until it eventually vanishes. That implies fuzzy blocking,
though.

I use GOSSiP for domain reputation, where the confidence in a reputation
decays with time.  Blocking doesn't begin until confidence reaches 
a threshold.

IPs are on a 7 day rotation.  So a given spammer IP gets to attempt to send 1
spam per week.  The IPs are blocked at a low level, before getting to my filter
(although the filter decides when to blacklist them).  That's short enough
to allow an IP sold to a legit party to get back in service.

-- 
              Stuart D. Gathman <stuart(_at_)bmsi(_dot_)com>
    Business Management Systems Inc.  Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flammis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.


-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/735/=now
RSS Feed: https://www.listbox.com/member/archive/rss/735/
Powered by Listbox: http://www.listbox.com