Spam Filter ISP Forums : Dummy SMTP - Opinions required - New feature? https://www.logsat.com/spamfilter/forums/ Sun, 10 May 2026 06:58:37 +0000 Mon, 07 Jan 2008 14:51:29 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6323 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Dummy SMTP - Opinions required - New feature? : Shoot an email to support@logsat.com...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11434&title=dummy-smtp-opinions-required-new-feature#11434 Author: WebGuyz
Subject: 6323
Posted: 07 January 2008 at 2:51pm

Shoot an email to support@logsat.com and Roberto will give you the link.]]> Mon, 07 Jan 2008 14:51:29 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11434&title=dummy-smtp-opinions-required-new-feature#11434 <![CDATA[Dummy SMTP - Opinions required - New feature? : I am running the latest pre-release...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11421&title=dummy-smtp-opinions-required-new-feature#11421 Author: dcook
Subject: 6323
Posted: 07 January 2008 at 9:44am

I am running the latest pre-release version, "SF3.5.4.730." I have seen the discussions about greylisting but have not seen that feature offered as of yet in the registered downloads area.



Edited by dcook - 07 January 2008 at 9:45am]]> Mon, 07 Jan 2008 09:44:39 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11421&title=dummy-smtp-opinions-required-new-feature#11421 <![CDATA[Dummy SMTP - Opinions required - New feature? : Stopped using my spamtrap because...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11417&title=dummy-smtp-opinions-required-new-feature#11417 Author: WebGuyz
Subject: 6323
Posted: 06 January 2008 at 9:36pm

Stopped using my spamtrap because of the greylisting in the new beta.
 
Very impressive 1st day numbers using the beta where 90% of the traffic I would normally have had to filter was stopped by the greylisting. My SFE's are not working anywhere as hard as they were before which is a great improvement. Clap
]]> Sun, 06 Jan 2008 21:36:53 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11417&title=dummy-smtp-opinions-required-new-feature#11417 <![CDATA[Dummy SMTP - Opinions required - New feature? : I setup my dummy smtp with the...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11406&title=dummy-smtp-opinions-required-new-feature#11406 Author: IKILLSPAM1
Subject: 6323
Posted: 03 January 2008 at 11:37am

I setup my dummy smtp with the * in local domains and in honeypots. I also have had the other honeypot setup on my primary mailserver which has email addresses that when emailed, the senders ip gets added to a file.
 
So I let my dummy smtp run for awhile. Then after around 4000 ips harvested, I took those and the 65,000 that were in the other honeypot and combined them. Brought them into MS Access table and then ran some queries to grab the highest offending Class Cs. I ended up taking any Class Cs with more than 11 IPs in my file, and exporting them to a new txt file. I then took those and added them to the local ip blacklist. I ended up added 90 Class Cs.
 
 
]]> Thu, 03 Jan 2008 11:37:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11406&title=dummy-smtp-opinions-required-new-feature#11406 <![CDATA[Dummy SMTP - Opinions required - New feature? : To all that have been using some...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11401&title=dummy-smtp-opinions-required-new-feature#11401 Author: ImInAfrica
Subject: 6323
Posted: 31 December 2007 at 5:35am

To all that have been using some sort of harvesting method using SF.
I think you may have missed the original point (and in the process made a very good one as well).

The original idea was to create a high number MX record, point it to a dummy smtp that will disconnect the session before it is completed.
Spammer WILL NOT try to resend the message, while 'real' smtp servers will retry based on their setup.

This way, even if your spamfilters are down, real emails will not be lost.
I quite like the idea of harvesting the ip's although my initial main concern was to reduce the load on the secondary MX record.

Happy New Year to everyone!

]]> Mon, 31 Dec 2007 05:35:56 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11401&title=dummy-smtp-opinions-required-new-feature#11401 <![CDATA[Dummy SMTP - Opinions required - New feature? : Thanksfor the reply. I was afraid...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11396&title=dummy-smtp-opinions-required-new-feature#11396 Author: dcook
Subject: 6323
Posted: 27 December 2007 at 1:26pm

Thanksfor the reply.  I was afraid of my MX (99) being pushed up the chain.  I was also concerned about the number of individual IP addresses captured.  I also have taken mine off line and have remove all MX records pointing to the dummy install. 
 
I do have an A record for the dummy server so that it has a reverse address.  I will see how many people fish for a port 25 server and capture those IP's.  There are still a lot of fishermen searching networks for mail servers. 
 
But let'keep thinking and discussing the issue on this thread.
 
]]> Thu, 27 Dec 2007 13:26:20 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11396&title=dummy-smtp-opinions-required-new-feature#11396 <![CDATA[Dummy SMTP - Opinions required - New feature? : Dwight, I actually took mine...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11394&title=dummy-smtp-opinions-required-new-feature#11394 Author: Desperado
Subject: 6323
Posted: 27 December 2007 at 1:17pm

Dwight,

I actually took mine off-line due to the following:  I am testing using the Greylist option and many servers initially see the greylisting action (disconnect) as a non-responsive server and pushed up the "food chain" until they hit my dummy SMTP server and then got black-listed.  This was compounded by the scripting I wrote to auto-add the IP's to my dnsbl server.  This caused a huge amount of good servers to suddenly be black-listed by our own server and that just ended up s%*king ... big time.  Up to that point, I had nearly 500,000 IP in my dnsbl with no false positives.

I need to re-think how to utilize the "spam ip harvester" as I have been calling it.
]]> Thu, 27 Dec 2007 13:17:15 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11394&title=dummy-smtp-opinions-required-new-feature#11394 <![CDATA[Dummy SMTP - Opinions required - New feature? : Dwight,&gt; I determined our spam...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11392&title=dummy-smtp-opinions-required-new-feature#11392 Author: ImInAfrica
Subject: 6323
Posted: 26 December 2007 at 5:43pm

Dwight,

> I determined our spam by domain ranking with an sql query on the quarantine. 

Can you post or PM me your sql query you refer to?

Thanks
Amir
]]> Wed, 26 Dec 2007 17:43:50 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11392&title=dummy-smtp-opinions-required-new-feature#11392 <![CDATA[Dummy SMTP - Opinions required - New feature? : I have over 200K from the harvest...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11391&title=dummy-smtp-opinions-required-new-feature#11391 Author: jerbo128
Subject: 6323
Posted: 26 December 2007 at 5:09pm

I have over 200K from the harvest alone.  That is less than a week's worth.  I too need to go through and remove a lot of singles and replace them with Class C entries.
I have shut down my "harvester" for the time being so that I can watch the new beta.  In case the beta screws up bad, I don't want a lot of good mail going to the harvester.  Let me know if you want to swap IP blacklists.
 
Jeremy
]]> Wed, 26 Dec 2007 17:09:12 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11391&title=dummy-smtp-opinions-required-new-feature#11391 <![CDATA[Dummy SMTP - Opinions required - New feature? : I wanted to touch base and see...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11387&title=dummy-smtp-opinions-required-new-feature#11387 Author: dcook
Subject: 6323
Posted: 26 December 2007 at 9:15am

I wanted to touch base and see how the dummy smtp with MX value of 99 faired over the Christmas holiday.  This looks very promising and I'd like to keep us talking. 
 
We tried publishing the MX record of our dummy smtp as MX 99 on a few domains that get the most spam.  I determined our spam by domain ranking with an sql query on the quarantine.  The amount of single IP blacklists really grew over the holiday. I am sorting the list by IP and converting some of the entries to a whole class C if waranted, but it is a heap of addresses.
 
How are your tests running?
]]> Wed, 26 Dec 2007 09:15:24 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6323&PID=11387&title=dummy-smtp-opinions-required-new-feature#11387