<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12">
<TITLE>RE: Barracuda Networks Spam Firewall</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>Eric,</FONT>
</P>
<P><FONT SIZE=2>> There's one rule that will wipe out ~90% of spam, but nobody seems to have</FONT>
<BR><FONT SIZE=2>> written it yet.</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> if URL IP addr is in China then score=100</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> support for a generic lookup list of cidr blocks would get another 9%</FONT>
</P>
<BR>
<P><FONT SIZE=2>I agree that geographically classifying the URL's embedded in the spams would be pretty slick, using the china.blackholes.us and cn-kr.blackholes.us RBLs has been pretty effective at reducing our spamload, as a supplement to the standard lookup services.</FONT></P>
<P><FONT SIZE=2>They do not descriminate between legit mails and spam mails from china. Everything from those IP blocks gets classified as spam. Luckily we don't ever get any client emails from those countries at this point and can use these filters without worrying about false-positives. (I think the doubleclick.blackholes.us is pretty funny too)</FONT></P>
<P><FONT SIZE=2>There are others at:</FONT>
<BR><FONT SIZE=2><A HREF="http://www.blackholes.us/" TARGET="_blank">http://www.blackholes.us/</A></FONT>
</P>
<P><FONT SIZE=2>Is anyone else out there using these blackholes? I wonder how often they get updated.</FONT>
</P>
<P><FONT SIZE=2>Brian Battle</FONT>
<BR><FONT SIZE=2>Confluence</FONT>
</P>
</BODY>
</HTML>