text_combined: marc perkel vrvaperkelcom aaron wolfe wrote thu feb 21 2008 1147 pm marc perkel wrote steve radich wrote sorry apparently unclear mx records im saying follows 100 real 200 real perhaps many real want 300 bogus one blocks port 25 tcp reset example 400 accept port logs ip blacklist scored aggressively 421retry whole bunch places seeing smtp server hitting 400 level mx im saying seems like useful thing included blacklist using low score sa point offer 400 level mx free service log ips quickly dont want set server theory 400 level mx wouldnt used real smtp often hence likely spammer therefore ip could auto blacklisted realize im proposing block score based list steve radich httpwwwaspdevelopernet httpwwwvirtualserverfaqcom bitshop inc development training hosting troubleshooting httpwwwbitshopcom im actually something like track hits highest mx hit lowest numbered mx use exim track ip addresses dont send quit command close thinking playing around type thing different looking lost connection data lost connection rcpt errors postfix servers logs sure detect run exim specifically missing something exim acls let things quit received received exim probably 100x commans postfix lot tricky stuff exim mta connection combination creates highly reliable blacklist im currently tracking 11 million virus infected spambots tried spam last 4 days hostkarma list sounds interesting block based list use scoring sa something like false positve rate yes block based list ther false positives rare way people remove list criteria blacklist well makes fp extremely low ive put lot effort getting right thu 07 aug 2008 105931 0800 bogus mx blacklist service viable