Discuss October 2004

discuss@lists.surbl.org

44 participants
134 discussions

Experimental CGI GetURI
by Ryan Thompson 05 Oct '04

05 Oct '04

Hey all, I've started phase two of GetURI's development, in the form of a CGI interface. So far, the interface supports lists of ham and spam domains, which will be especially handy for discussions on this list, and for those of you hand-checking lists of submitted domains. I'll also probably at least add a message checker and maybe even an mbox upload feature, based on feedback and testing. The CGI version produces the same output that the commandline version does. (In fact, it uses some clever tricks to communicate with the commandline version and provide progress to the browser). http://ry.ca/cgi-bin/geturi.cgi This will be *especially* useful for all of these "FP" discussions we've been having lately. Now, f'rinstance, if I proclaim topical7074rneds .com should be whitelisted (it shouldn't!!), I could just feed you this: http://ry.ca/cgi-bin/geturi.cgi?domains=topical7074rneds.com&surbl=ws.surbl… ...which is ugly, and gets uglier in a hurry with more domains. So, I implemented caching and unique IDs, so you can just do the lookup yourself, and then cut and paste the resulting (potentially much shorter) link that will show up in your Address bar, like so: http://ry.ca/cgi-bin/geturi.cgi?id=spam-X52p6q8FMYYEINMCsepAG1 These cached results (if referenced by id, as in the last URL) will be available for at least 30 days from their last access time. The page itself describes the caching algorithm in a bit more detail, for those that are interested. Try it out, please, and make some noise about it. It's experimental (read: I started with an idea in my head and a blank file in my editor about 4.5 hours ago), so there are bound to be some interesting bugs. ;-) - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

3 6

Re: [SURBL-Discuss] Read this policy please
by Rob McEwen 05 Oct '04

05 Oct '04

> OE6 on XPsp2 is smart like this now too, by default blocks all external > content. BTW, does anyone here know of a plug-in (or something) to get Outlook XP (office verion, not "outlook express") to do this external image blocking too? I know that image blocking can be done in Outlook 2003, but I don't want to upgrade until the next version of MS Office. Rob McEwen

1 0

Help checking a few FPs
by Jeff Chan 05 Oct '04

05 Oct '04

Got some more FPs from hams: /home/gorilla/black-gorilla-8_04.txt:servebeer.com /web/antispam/outblaze.domains.sort:pacmanhattan.com /web/antispam/mailsecurity.spam.domains:romp.com /home/prolocation/black-prolocation-master:romp.com These all seem to have legitimate uses to me. servebeer.com belongs to dynamic DNS provider No-IP.com so obviously it's subject to some abuse, but it also seems to have legitimate uses. pacmanhattan.com is apparently a university student project to play Pacman on city steets with people. romp.com appears to be a National Lampoon movie site. I'd like to whitelist all of these but would like to hear from Chris, David, Outblaze and Raymond about why they listed them. None have SBL hits. romp and pacman have no NANAS, and as expected serverbeer has 29 NANAS. The full list from the 5 source hams includes the three probable FPs above and some others which are not in SURBLs, but which should probably be whitelisted since they appear in things like Debian Linux newsletters. catb.org debian.org debianforum.de ffii.org gnu.org harddisk-recovery.nl heise.de infodrom.org kitenet.net leidenuniv.nl linuxtag.org opensource.org pacmanhattan.com romp.com servebeer.com spi-inc.org uu.nl wallsplash.net xtronics.com Comments please, Jeff C. -- "If it appears in hams, then don't list it."

4 7

RE: [SURBL-Discuss] Whitelist kit . net
by Chris Santerre 05 Oct '04

05 Oct '04

>-----Original Message----- >From: Yves Junqueira [mailto:yves.junqueira@gmail.com] >Sent: Monday, October 04, 2004 12:04 PM >To: Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] Whitelist kit . net > > >On Mon, 4 Oct 2004 07:29:14 -0700, Jeff Chan <jeffc(a)surbl.org> wrote: >> The policy is: if it has legitimate uses, then don't list. >> >> Can you provide some examples of legitimate sites on kit.net >> (preferably in English)? >> >> Jeff C. > >Sorry, I couldn't find any in english. > >http://www.tmabc.kit.net - >http://www.1mais1.kit.net - They seem good people. They are a group >of volunteers that assist home less people. Doesn't seem to be a scam. > >I'd suggest whitelisting kit.net if, and only if, you are really >strict to the policy. They do host many trojans and scam sites there. > Why not treat them like the tld is 'kit.net' and list on subdomains? --Chris

3 2

RE: [SURBL-Discuss] Help checking a few FPs
by Chris Santerre 04 Oct '04

04 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, October 04, 2004 9:31 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Help checking a few FPs > > >On Monday, October 4, 2004, 6:17:09 AM, Alex Broens wrote: >> Jeff Chan wrote: > >>> catb.org >>> debian.org >>> debianforum.de >>> ffii.org >>> gnu.org >>> harddisk-recovery.nl >>> heise.de >>> infodrom.org >>> kitenet.net >>> leidenuniv.nl >>> linuxtag.org >>> opensource.org >>> pacmanhattan.com >>> romp.com >>> servebeer.com >>> spi-inc.org >>> uu.nl >>> wallsplash.net >>> xtronics.com > >> the .de are very ugly FPs, especially heise ...... wow > >Actually to clarify, that's the full list that appeared >in hams that had some FPs, but the FPs were only the >first three: > >>> servebeer.com belongs to dynamic DNS provider No-IP.com >>> so obviously it's subject to some abuse, but it also >>> seems to have legitimate uses. >>> >>> pacmanhattan.com is apparently a university student >>> project to play Pacman on city steets with people. >>> >>> romp.com appears to be a National Lampoon movie site. > >In other words those other domains appeared in messages >that had the three FPs. The others are not FPs, but >probably should be whitelisted since they appeared in >things like legitimate Linux newsletters. > >Hope this clarifies things. > serverbeer has 8 reported spams in a 9 month period. What was this link pointing to in the newsletter? --Chris

3 2

RE: [SURBL-Discuss] Help checking a few FPs
by Chris Santerre 04 Oct '04

04 Oct '04

>-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Monday, October 04, 2004 11:02 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Help checking a few FPs > > >Chris Santerre wrote: >>>-----Original Message----- >>>From: Jeff Chan [mailto:jeffc@surbl.org] >>>Sent: Monday, October 04, 2004 10:34 AM >>>To: SURBL Discuss >>>Subject: Re: [SURBL-Discuss] Help checking a few FPs >>> >>> >>>On Monday, October 4, 2004, 7:24:08 AM, Chris Santerre wrote: >>> >>>>>From: Jeff Chan [mailto:jeffc@surbl.org] >>> >>>>>>>servebeer.com belongs to dynamic DNS provider No-IP.com >>>>>>>so obviously it's subject to some abuse, but it also >>>>>>>seems to have legitimate uses. >>> >>>>serverbeer has 8 reported spams in a 9 month period. >>> >>>>What was this link pointing to in the newsletter? >>> >>>It was in a Debian bug report: >>> >>> http://lists.debian.org/debian-wnpp/2004/06/msg00434.html >>> >>> >>>>From: Florian Ragwitz <florian(a)mookooh.org> >>>>To: Debian Bug Tracking System <submit(a)bugs.debian.org> >>>>Subject: ITP: wmibam -- dockapp to monitor the apm status using ibam >>>>X-Mailer: reportbug 2.58 >>>>Date: Tue, 25 May 2004 18:26:36 +0200 >>>>X-Debbugs-Cc: debian-devel(a)lists.debian.org >>>>Message-Id: <20040525162643.17303184E2(a)godsmacker.servebeer.com> >>>>Delivered-To: submit(a)bugs.debian.org >>>>X-Spam-Checker-Version: SpamAssassin >2.60-bugs.debian.org_2004_03_25 >>>> (1.212-2003-09-23-exp) on spohr.debian.org >>>>X-Spam-Status: No, hits=-11.0 required=4.0 >>> >>>tests=BAYES_00,HAS_PACKAGE, >>> >>>> X_DEBBUGS_CC autolearn=ham >>> >>>version=2.60-bugs.debian.org_2004_03_25 >>> >>>>X-Spam-Level: >>>> >>>>Package: wnpp >>>>Severity: wishlist >>>> >>>>* Package name : wmibam >>>> Version : 0.0.1 >>>> Upstream Author : Florian Ragwitz <florian(a)mookooh.org> >>>>* URL : >> >> http://godsmacker.servebeer-MUNGED.com/~florian/wmibam/ >> >>>* License : GPL >>> Description : dockapp to monitor the apm status using ibam >>> >>> wmibam is a dockapp that monitors the apm status using the >intellegent >>> battery monitor (ibam) by Sebastian Ritterbusch. It can be used with >>> window managers like WindowMaker, AfterStep, BlackBox or >>> Enlightenment. >> >> >> >> The link is dead. Perhaps they boot ham'rs from their network? ;) >> > >go the feeling the guy miss-spelt. Probably meant >servebeer.com which is >a dyndns domain offered by no-ip.com. > Yes....which will not let you connect. -Chris

1 0

Whitelist kit . net
by Yves Junqueira 04 Oct '04

04 Oct '04

Hi. kit.net is a free host provider in Brazil that hosts many phishing scams with trojans etc as sub domains. Yet, they host a few inocent sites too. According to the "if it's in ham, do not list it" policy, this one should not be listed. I had to add "kit.net" (not ".kit.net") to my local whitelist because WC was giving me many FPs. I maintain a small list of *.kit.net spam domains that could be used. What is the policy for this kind of free host servers? In my local rbl server I have all those Spamvertized domains listed, but "kit.net" itself is not. -- Yves Junqueira http://www.lynx.com.br

2 2

RE: [SURBL-Discuss] Help checking a few FPs
by Chris Santerre 04 Oct '04

04 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, October 04, 2004 10:34 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Help checking a few FPs > > >On Monday, October 4, 2004, 7:24:08 AM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>>> servebeer.com belongs to dynamic DNS provider No-IP.com >>>>> so obviously it's subject to some abuse, but it also >>>>> seems to have legitimate uses. > >> serverbeer has 8 reported spams in a 9 month period. > >> What was this link pointing to in the newsletter? > >It was in a Debian bug report: > > http://lists.debian.org/debian-wnpp/2004/06/msg00434.html > >> From: Florian Ragwitz <florian(a)mookooh.org> >> To: Debian Bug Tracking System <submit(a)bugs.debian.org> >> Subject: ITP: wmibam -- dockapp to monitor the apm status using ibam >> X-Mailer: reportbug 2.58 >> Date: Tue, 25 May 2004 18:26:36 +0200 >> X-Debbugs-Cc: debian-devel(a)lists.debian.org >> Message-Id: <20040525162643.17303184E2(a)godsmacker.servebeer.com> >> Delivered-To: submit(a)bugs.debian.org >> X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25 >> (1.212-2003-09-23-exp) on spohr.debian.org >> X-Spam-Status: No, hits=-11.0 required=4.0 >tests=BAYES_00,HAS_PACKAGE, >> X_DEBBUGS_CC autolearn=ham >version=2.60-bugs.debian.org_2004_03_25 >> X-Spam-Level: >> >> Package: wnpp >> Severity: wishlist >> >> * Package name : wmibam >> Version : 0.0.1 >> Upstream Author : Florian Ragwitz <florian(a)mookooh.org> >> * URL : http://godsmacker.servebeer-MUNGED.com/~florian/wmibam/ > * License : GPL > Description : dockapp to monitor the apm status using ibam > > wmibam is a dockapp that monitors the apm status using the intellegent > battery monitor (ibam) by Sebastian Ritterbusch. It can be used with > window managers like WindowMaker, AfterStep, BlackBox or > Enlightenment. The link is dead. Perhaps they boot ham'rs from their network? ;) --Chris

2 1

namesdatabase . com
by Bitz 04 Oct '04

04 Oct '04

namesdatabase . com Listed at WS. It has legit uses, should be whitelisted?

10 17

Re: [SURBL-Discuss] Re: 419 for school???
by Frank Ellermann 03 Oct '04

03 Oct '04

David B Funk wrote: [esthereki17(a)indiatimes.com} > This scammer is probably depending upon their victims to > just hit the "Reply" button. indiatimes.com.abuse.rfc-ignorant.org = 127.0.0.4 That's a known bulletproof 419 RfC ignorant. :-( Bye, Frank

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss October 2004