Spam Filter ISP Forums : another honey pot thought https://www.logsat.com/spamfilter/forums/ Sat, 08 Aug 2026 09:03:05 +0000 Thu, 11 Aug 2005 11:47:05 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=5157 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[another honey pot thought : How about adding a checkbox to...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6387&title=another-honey-pot-thought#6387 Author: Alan
Subject: 5157
Posted: 11 August 2005 at 11:47am

How about adding a checkbox to add IP's to the honeypot block list whoexceed the "maximum concurrent connections from same IP" ]]> Thu, 11 Aug 2005 11:47:05 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6387&title=another-honey-pot-thought#6387 <![CDATA[another honey pot thought : ahh, that is exactly what i was...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6383&title=another-honey-pot-thought#6383 Author: Marco
Subject: 5157
Posted: 11 August 2005 at 3:47am

ahh, that is exactly what i was referring to, and i see how it happened.

The problem is that an 'unknown' sender is mailing us spam to legit mail adresses. adding those adresses to honeypot list is not an option.

Since the senders don't use honeypot adresses, and some of the incoming mails are relayed throuygh to our primary mailsystem, the possibility that the relay's ip gets trapped is high. This is what happened, and i agree, the honeypot is working fine, but the donotaddiptohoneypot setting needs to be applied to the content tagging system also.

So maybe the tag 'honeypot' is a bit out of place in the keyword filter, perhaps a tag called '::blacklistIP' (or something) would be better.

Regardless, a system that blacklists senders ip's on the basis of mail or subject content could proove invaluable. But caution has to be applied not to blacklist legit ip's.

Another wish that might proove useful if possible is extending the 'automatic blacklisting' when the sender's mail is matched in MAPS and/or surbl search.  Also 'FROM' domain names /attachment filter perhaps.

Thank you for taking the effort in looking into this 'issue' i would gladly help test the new prerelease.

 

Regards,

Marco



Edited by Marco]]> Thu, 11 Aug 2005 03:47:13 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6383&title=another-honey-pot-thought#6383 <![CDATA[another honey pot thought : Marco, I&#039;m not sure if...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6382&title=another-honey-pot-thought#6382 Author: LogSat
Subject: 5157
Posted: 10 August 2005 at 10:14pm

Marco,

I'm not sure if you refer to your comment below or not:

==============================
I think the order of filters needs to be looked at again, so that DoNotAddIPToHoneypot has preference again.
==============================

If it's not this comment, but another "hidden bugreport", then it'shidden really good since I have no idea of where it is... Can yourepost it?

If instead it was the above comment, it looked like a "wish" not a bugreport. Looking over the behavior again, we noticed that theDoNotAddIPToHoneypot optionis doing exactly what it was asked anddesigned to do. That is, if an email comes in from an email address that is in the honeypot email list, the IP won't be added if it's listed in the DoNotAddIPToHoneypot list.

When we started adding extra tags to add sender's IP to the honeypotblacklist if they triggered other filters, that process ignored theDoNotAddIPToHoneypot. It's technically not a bug... but you're correct,it would be more appropriate if that "whitelist" would be expanded toall other filters as well.

We're pre-testing a build with this ability internally right now. We'llmake it available in a few days, but if you wish to test it please letus know and we'll make it available to you.
]]> Wed, 10 Aug 2005 22:14:58 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6382&title=another-honey-pot-thought#6382 <![CDATA[another honey pot thought : Maybe you missed the hidden bugreport...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6374&title=another-honey-pot-thought#6374 Author: Marco
Subject: 5157
Posted: 09 August 2005 at 3:16am

Maybe you missed the hidden bugreport i mentioned in my earlier post Roberto, just making sure.

The DoNotAddIPToHoneypot ini entry is beeing ignored in build 476

Regards,

 

Marco

]]> Tue, 09 Aug 2005 03:16:25 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6374&title=another-honey-pot-thought#6374 <![CDATA[another honey pot thought : Alan, We honestly don&#039;t...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6362&title=another-honey-pot-thought#6362 Author: LogSat
Subject: 5157
Posted: 07 August 2005 at 6:57pm

Alan,

We honestly don't see expirations on filters to be available any time soon.

What we do have next on the list however is a "timed cache" on sourceIPs. If an IP has sent more that "n" number of spams in the last "x"number of minutes, it will be immediately disconnected even before itsends any data for "y" number of minutes. This will save a considerableamount of bandwidth and will prevent filling user's quarantine withmassive amounts of spam to sort thru. We're trying to make theseoptions available for each type of filter, so that for example thetimer is active on the "virus" filter but not on the "reverse DNS"filter.
]]> Sun, 07 Aug 2005 18:57:03 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6362&title=another-honey-pot-thought#6362 <![CDATA[another honey pot thought : Thank you Roberto for getting...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6356&title=another-honey-pot-thought#6356 Author: Alan
Subject: 5157
Posted: 05 August 2005 at 5:06pm

Thank you Roberto for getting such a jump on that one.  It reallyhas made a noticable difference already in my testing.  And I donot see any performance hit either.  I am still very impressed athow quickly you have been able to encorporate new ideas and userrequests over the years of using SF.

Seems like some of the old requests from years ago are starting to getincluded in the product now.  So how about some way to set a timelimit on filters?  Maybe something like "::NULL/08102005" to havea filter that will no longer be effective as of a certain expirationdate (08/10/2005 in this case).  Of course it would be either upto the admin to clean up or you can have the app auto-remove expiredfilters.  This would be good for outbreaks or spambot attackswhere certain is suddenly a big problem but will probably not be in thefuture.

And another thought, a way to also scan within attached text files suchas spoofed bounces resulting from joe-job instances. 

Oh and finally, how about that darned mailing list for registered usersso we can be notified immediately of new official and betaversions?  That seems like a no-brainer and another reason forpeople to pony up for a fine product.
]]> Fri, 05 Aug 2005 17:06:34 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6356&title=another-honey-pot-thought#6356 <![CDATA[another honey pot thought : ok, one of them badasses sent...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6350&title=another-honey-pot-thought#6350 Author: Marco
Subject: 5157
Posted: 05 August 2005 at 8:21am

ok, one of them badasses sent us one... and it seems to work.. but you guessed it: the ISP's relay server got blocked :)))

I think the order of filters needs to be looked at again, so that DoNotAddIPToHoneypot has preference again.

Other than that it works great! This is gonna give the spammers some serious headaches. How to try and sell something if the text needed to sell it will cause you an ipblock? muhahaha (sorry, was beeing myself for a sec there) :)

regards,

Marco



Edited by Marco]]> Fri, 05 Aug 2005 08:21:04 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6350&title=another-honey-pot-thought#6350 <![CDATA[another honey pot thought : Fantastic! great work roberto....]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6346&title=another-honey-pot-thought#6346 Author: Marco
Subject: 5157
Posted: 05 August 2005 at 3:05am

Fantastic! great work roberto.

 

just to make sure, the following lines are correct?

subject:challenged on live tv::honeypot
subject:software,at,incredibly,low,price::honeypot



Edited by Marco]]> Fri, 05 Aug 2005 03:05:44 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6346&title=another-honey-pot-thought#6346 <![CDATA[another honey pot thought : Marco, Alan, keizersozay, everyone, We...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6342&title=another-honey-pot-thought#6342 Author: LogSat
Subject: 5157
Posted: 04 August 2005 at 11:49pm

Marco, Alan, keizersozay, everyone,

We now have a pre-release build that does include support for extratags in the keyword filter as well. This was done with practically noperformance loss. The build is still being tested, but is available inthe registered user area as build 2.6.3.476.

The syntax for the extra tag had to be slightly different. In this listyou MUST use a double colon rather than a single one to separate thetag from the keyword entries. The updated help file for that sectionisas follows:

Keywords Filter - You can check email content and subject header for specific keyword and/or phrases. If found, the email is rejected. You can also use Regular Expressions (RegEx). If the keyword file does not exist it will be created. The file is reloaded every minute. The contents of the file will be loaded in the memo box, allowing you to make changes to the file. This list supports the ::NULL option to send emails in a black hole. If an entry is in the form keyword::NULL it will cause all emails to be accepted and then sent to NULL right away. Such emails will not cause NDRs, they will not be quarantined, they will not be seen by the users.If an entry is in the form keyword::NoNDR such emails will not cause NDRs as in the DoNotSendNDROnQuarantine parameter in the ini file. This list supports the ::Honeypot option, which will cause the sender's IP address to be automatically blacklisted in the future. Please note that unlike in other cases, with the keyword list you must enter the ":" symbol twice to specify the extra tag.
 
]]> Thu, 04 Aug 2005 23:49:25 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6342&title=another-honey-pot-thought#6342 <![CDATA[another honey pot thought : I was going to suggest the exact...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6338&title=another-honey-pot-thought#6338 Author: Marco
Subject: 5157
Posted: 04 August 2005 at 10:47am

I was going to suggest the exact same (topic), from then on anyone with 'case of fine wine' 'improved cialis without prescription' (to name some) in the subject would get blocked into oblivian.

 

This feature would only need to be active for a limited time, and would catch quite a few of the badasses that got hold of our domain name and are swamping it with spam.

Any users that forward such spam and dont change at least the titles are deserving of a block :->

But i would also like to see a limited timeblock, say - a day- with notification to the sender, so that they are warned not to do it again.

 

Just my 2 cents

 

]]> Thu, 04 Aug 2005 10:47:37 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5157&PID=6338&title=another-honey-pot-thought#6338