Announce

announce@lists.surbl.org

1 participants
191 discussions

GetURI 1.7 Released
by Jeff Chan 02 Mar '05

02 Mar '05

Date: Tue, 1 Mar 2005 23:55:02 -0600 (CST) From: Ryan Thompson <ryan(a)sasknow.com> Subject: GetURI 1.7 Released 2005-03-01: GetURI 1.7 Released I'm very pleased to announce the release of GetURI 1.7. This is primarily a maintenance release. However, the new geturi.cgi has been included from the author's local source. geturi.cgi is the engine that drives the CGI-based system at http://ry.ca/geturi/ New features: - Experimental geturi.cgi provides CGI interface to geturi - Improved build/release procedure Bug fixes: - Fix domain creation date bug with .co.uk and .uk domains - Front-load 2nd level TLDs in tld.txt to fix domain ID bug - Added known subdomains within .ar To fetch the new version of GetURI, please visit http://ry.ca/geturi/ As always, your feedback will help improve GetURI! Additional testers are always welcome. - Ryan Thompson <ryan(a)sasknow.com> --------------------------------------------------------------------------- Thanks! - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

1 0

Updated SpamCopURI 0.22 config file
by Jeff Chan 23 Feb '05

23 Feb '05

If you are using SpamCopURI version 0.22 then please update your configuration to add two recent lists AB and JP. There are also a few typos corrected in the sample configuration at. http://www.surbl.org/spamcop_uri.cf.022-updated.txt Cheers, Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

JP removed from WS, zone files removed from web site
by Jeff Chan 08 Feb '05

08 Feb '05

This is a reminder that we have taken the JP data out of WS and have deleted the WS and SC SURBL zone files form the SURBL web site, as previously announced last week. Here are some relevant parts of those announcements: > We will be removing the data in jp.surbl.org from ws.surbl.org on > February 7th. If you are using SpamAssassin and don't already > have a separate rule for JP, then please add one as described > in the SURBL Quick Start: > > http://www.surbl.org/quickstart.html > > When SpamAssassin 3.1 is released, it will also include a separate > rule for JP. > > If you are using other programs, please check that they are using > JP in addition to the other lists in multi. JP is bitmask > 127.0.0.64 in multi.surbl.org and it has a relatively high spam > detection rate and low false positive rate, so it's definitely > worth using. More information can be found on the Lists page: > > http://www.surbl.org/lists.html > I will be removing the partial set of SURBL zone files (SC and > WS) from the SURBL web site by 7 February 2005. This will mainly > effect users of Roger Eriksson's Windows command script which > downloads the SC zone file using wget then checks SUBRL domains > against message bodies in Declude JunkMail. It should not affect > most other users of SURBLs, since other applications use the > preferred DNS lookups to get SURBL data. This change does not > affect SURBL name servers or name service, nor are any changes > required to them or applications that use their services. [...] > As an alternative for users of the command script, SURBLs can be > checked in Declude Junkmail using invURIBL, as mentioned in an > earlier announcement, and the DNS method it uses is definitely > preferred. > > Here is that part of the earlier announcement: > > 12/31/04: Invariant Systems has written a Windows URI > extraction tool invURIBL which can check message body URIs > against SURBLs. It can be used standalone or as plugin to any > Windows mail server that can call an external application and > process the return code. For example, it is finding use with > Declude for Imail. > > http://www.invariantsystems.com/invURIBL/default.htm > > Probably other plug-in type filters which support SURBLs can be > used with Declude Junkmail and other similar mail programs. > > http://www.surbl.org/links.html Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

JP data to be removed from WS
by Jeff Chan 03 Feb '05

03 Feb '05

We will be removing the data in jp.surbl.org from ws.surbl.org on February 7th.* If you are using SpamAssassin and don't already have a separate rule for JP, then please add one as described in the SURBL Quick Start: http://www.surbl.org/quickstart.html When SpamAssassin 3.1 is released, it will also include a separate rule for JP. If you are using other programs, please check that they are using JP in addition to the other lists in multi. JP is bitmask 127.0.0.64 in multi.surbl.org and it has a relatively high spam detection rate and low false positive rate, so it's definitely worth using. More information can be found on the Lists page: http://www.surbl.org/lists.html (* Previously JP data was merged in with WS data because SpamAssassin 3.0 was released before a separate rule for JP could be added. Adding them into WS was a way to get the benefits of JP into SA 3.0. But the lists are better separately because they have some differing data sources and types.) Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

SURBL zone files to be removed from web site
by Jeff Chan 30 Jan '05

30 Jan '05

I will be removing the partial set of SURBL zone files (SC and WS) from the SURBL web site by 7 January 2005. This will mainly effect users of Roger Eriksson's Windows command script which downloads the SC zone file using wget then checks SUBRL domains against message bodies in Declude JunkMail. It should not affect most other users of SURBLs, since other applications use the preferred DNS lookups to get SURBL data. This change does not affect SURBL name servers or name service, nor are any changes required to them or applications that use their services. The files will probably be deleted and replaced with a custom error message, which hopefully will show up in logs of the script. Darrell of Invariant Systems will also be mentioning this on Declude discussion groups. As an alternative for users of the command script, SURBLs can be checked in Declude Junkmail using invURIBL, as mentioned in an earlier announcement, and the DNS method it uses is definitely preferred. Here is that part of the earlier announcement: 12/31/04: Invariant Systems has written a Windows URI extraction tool invURIBL which can check message body URIs against SURBLs. It can be used standalone or as plugin to any Windows mail server that can call an external application and process the return code. For example, it is finding use with Declude for Imail. http://www.invariantsystems.com/invURIBL/default.htm Probably other plug-in type filters which support SURBLs can be used with Declude Junkmail and other similar mail programs. http://www.surbl.org/links.html Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

NetIQ MailMarshal adds direct SURBL support, Invariant Systems invURIBL plugs SURBLs into Declude, etc.
by Jeff Chan 01 Jan '05

01 Jan '05

12/28/04: NetIQ MailMarshal for Exchange and general SMTP servers protects enterprise mail against viruses and spam and now adds direct support for SURBLs. http://www.netiq.com/products/mma/default.asp Here's their Knowledge Base article about using SURBLs. http://www.netiq.com/kb/esupport/consumer/esupport.asp?id=NETIQKB44382 12/31/04: Invariant Systems has written a Windows URI extraction tool invURIBL which can check message body URIs against SURBLs. It can be used standalone or as plugin to any Windows mail server that can call an external application and process the return code. For example, it is finding use with Declude for Imail. http://www.invariantsystems.com/invURIBL/default.htm More news and links are at: http://www.surbl.org/news.html http://www.surbl.org/links.html Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Welcoming new public name server
by Jeff Chan 20 Dec '04

20 Dec '04

We'd like to welcome and thank the addition of a new public SURBL name server c3.surbl.org administered by: Frank Precissi of InReach Internet Without our public nameservers and the help of their administrators, SURBLs would not be possible. Our thanks to all of them! Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

SURBL patches for qmail and qmail-ldap
by Jeff Chan 03 Dec '04

03 Dec '04

Pieter Droogendijk has written patches for qmail and qmail-ldap to support SURBLs: http://www.binky.org.uk/index.html?page=qmail "One patch I've written works by extracting all HTTP URI from a mail message, and look up the minimum of the resulting domain, or IP address, on an internet blacklist, namely SURBL, which was designed specifically for this purpose." His colleague Richard Zuidhof mentions: On his website you can find the code. Regular patch http://www.binky.org.uk/sources/qmail/011_surbl Qmail-ldap patch http://www.binky.org.uk/sources/qmail/011_surbl_ldap Documentation http://www.binky.org.uk/sources/qmail/surbl.txt Cheers, Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

SURBL stats: list hit rates measured in DNS queries, whitelist hits increased to 90 days
by Jeff Chan 14 Nov '04

14 Nov '04

In order to explore some conjunctions of existing lists that might have fewer false positives, we've created some stats measuring the number of DNS hits against all blocklists that the individual lists get, along with some permutations of those lists. For completeness, we've added checking of AB and PH as individual (not permuted) lists, and the output can be found at: http://www.surbl.org/permuted-hits.out.txt [sc][ws][ob][jp] 762 records of 82592 67115 hits of 232463 is 28% [sc][ws][ob] 857 records of 82592 67325 hits of 232463 is 28% [sc][ws][jp] 899 records of 82592 70622 hits of 232463 is 30% [sc][ws] 1066 records of 82592 71725 hits of 232463 is 30% [sc][ob][jp] 788 records of 82592 69526 hits of 232463 is 29% [sc][ob] 916 records of 82592 70292 hits of 232463 is 30% [sc][jp] 934 records of 82592 73050 hits of 232463 is 31% [sc] 1193 records of 82592 75597 hits of 232463 is 32% [ws][ob][jp] 16383 records of 82592 144989 hits of 232463 is 62% [ws][ob] 21793 records of 82592 150159 hits of 232463 is 64% [ws][jp] 33123 records of 82592 186633 hits of 232463 is 80% [ws] 58471 records of 82592 209710 hits of 232463 is 90% [ob][jp] 17145 records of 82592 150595 hits of 232463 is 64% [ob] 44636 records of 82592 168053 hits of 232463 is 72% [jp] 34669 records of 82592 196112 hits of 232463 is 84% [ab] 368 records of 82592 61920 hits of 232463 is 26% [ph] 996 records of 82592 307 hits of 232463 is 0% The records columns show the size of the lists or intersections. The hits columns shows how many DNS queries out of all blocklist hits those lists or intersections. This is run nightly around midnight using the script: http://www.surbl.org/permuted-hits This gives some measure of the performance of the different lists, though it likely undercounts rapidly changing data since it's based on the previous ten days of data. The more quickly changing lists like AB and SC have higher detection rates in actual, real-time operation. The stats above also do not take into account false positives at all, just hits against existing blocklists (which do have some FPs). Additionally we've increased the number of days that frequency data of DNS queries against our whitelist are kept from 10 to 90. However it will take another 80 days before we get 90 days accumulated: http://www.surbl.org/dns-queries.whitelist.counts.txt I re-wrote the scripts to accommodate the additional data more efficiently: http://www.surbl.org/hourly-dns http://www.surbl.org/daily-dns (run around midnight) After things stabilize we will probably change from the current 10,000 DNS queries sampled every 2 hours to 20,000 sampled every hour. This will make the results represent about a half million queries per day. The larger sample sizes should make the results more accurate, but it means absolute numbers from the past won't be comparable. Percentages and relative rankings should always be comparable though. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

fraud.rhs.mailpolice.com phishing data added to ph SURBL
by Jeff Chan 12 Nov '04

12 Nov '04

As of 12 November 2004, we have added data from fraud.rhs.mailpolice.com into ph, joining our exiting phishing data from mailsecurity.net.au. This has doubled the size of our phishing list to about 1000 records. Unlike other SURBLs, data from this fraud list includes a few deliberate subdomains as found in URIs. (Because SURBL clients are expected to reduce subdomains to base domains, an occasional mismatch in domain levels between data and client should not cause false positives.) Thanks to Jay Swackhamer of MailPolice for gathering this data and making it available to us. At the time of this message, overlap between fraud.rhs.mailpolice.com and mailsecurity.net.au's phishing list was 36 records. Overlap between fraud.rhs.mailpolice.com and all other existing SURBLs, including ph.surbl.org, is 89 records. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

← Newer
1
...
8
9
10
11
12
13
14
...
20
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Announce