Re: sortnoxington.com, and Spam Blacklist question

Chris wrote:
> My main spammer to my account has been from 'sortnoxington.com' for
> the past day or two.

'from' is a very ambiguous term to be using about spam.  Some think from
means the 'From:'  Some think from means the spamsource.  Some think
from means the spamvertiser.  I recommend that we not use 'from' at all
to characterize a spam unless we then proceed to further define what is
the From and what is the spamsource and what is the spamvertiser -- in
which case we would have been better off just characterizing the spam as
to spamsource or spamvertiser and not using the word 'from' and not even
talking about the From.

> I noticed that if I was using the JWSpamSpy blacklist, then these
> spams would have been blocked as according to this page:
>
> http://www.joewein.de/sw/bl-log.htm

That page provides a list made of spamvertised domainnames.

> . . . this domain was added to their blacklist on 3rd May.
>
> I am running MailWasher and have bl.spamcop.net blacklisting in
> operation,

bl.spamcop.net is *only* a list of spamsource IP addresses, not
spamvertised names.  The jwspamspy list is a completely different kind
of list.  There are about 260 different lists, many more important than
others.  The SCbl is an important list.  I've never heard of jwspamspy
until today.

> but as Sortnoxington.com domain wasn't in the list, the
> Spam mail got through. Does this (SC) blacklist operate at a slower
> rate than others?

There are hundreds and hundreds of different lists.  The individual can
configure to use whatever lists and methods they like.  Choosing
blocklists and creating whitelists should be designed so that you have
good effectiveness and don't get goodmail in your spam.



-- 
Mike Easter
kibitzer, not SC admin