Discuss November 2004

discuss@lists.surbl.org

44 participants
81 discussions

RE: hotnudiegirls.com URI as false positive
by Chris Santerre 24 Nov '04

24 Nov '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Wednesday, November 24, 2004 5:07 PM >To: Chris Santerre >Cc: 'Daniel Quinlan'; 'Samat Jain'; postmaster(a)outblaze.com; >whitelist(a)surbl.org; dev(a)spamassassin.apache.org; SURBL Discussion list >(E-mail) >Subject: RE: hotnudiegirls.com URI as false positive > > >My guess is that the site was actually listed in SpamCop and Outblaze >(and may still be), but was either delisted by those lists or was >whitelisted by the SURBL folks. > "Negative ghostrider, the pattern is full." No whitelist has been made. But it is possible it got added and removed quickly. I sent up the flags because this isn't the first incident we have seen this week like this. --Chris

2 1

RE: hotnudiegirls.com URI as false positive
by Chris Santerre 24 Nov '04

24 Nov '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Wednesday, November 24, 2004 4:25 PM >To: Chris Santerre >Cc: 'Samat Jain'; postmaster(a)outblaze.com; whitelist(a)surbl.org; >dev(a)spamassassin.apache.org; SURBL Discussion list (E-mail) >Subject: Re: hotnudiegirls.com URI as false positive > > >We'd need a full example message that has been marked up as a false >positive, including the SpamAssassin headers, to be able to debug this. > ASk and yee shall receive...you sexy thing! :*) --Chris begin 600 e-mail2.txt M4F5C96EV960Z(&9R;VT@;&]C86QH;W-T(&)Y(&-A;&EG=6QA#0H@=VET:"!3 M<&%M07-S87-S:6X@*'9E<G-I;VX(a),RXP+C$I.PT*(%=E9"P@,C0@3F]V(#(P M,#0@,3(Z,C<Z-3,@+3`V,#`-"D9R;VTZ(%-A;6%T($IA:6X@/'-A;6%T0'%U M87-I<FAO;6)I8V]S:61O9&5C86AE9')O;BYC;VT^#0I4;SH@9V%M97-`;F%B M;&%D97-I9VXN8V]M#0I3=6)J96-T.B!T97-T(&US9PT*1&%T93H@5V5D+"`R M-"!.;W8@,C`P-"`Q,3HS,3HS-2`M,#<P,`T*365S<V%G92U)9#H@/#(P,#0Q M,3(T,3$S,2XS-3@T-2YS86UA=$!Q=6%S:7)H;VUB:6-O<VED;V1E8V%H961R M;VXN8V]M/@T*6"U3<&%M+49L86<Z(%E%4PT*6"U3<&%M+4-H96-K97(M5F5R M<VEO;CH@4W!A;4%S<V%S<VEN(#,N,"XQ("@R,#`T+3$P+3(R*2!O;B!C86QI M9W5L80T*6"U3<&%M+5-T871U<SH@665S+"!S8V]R93TU+CD@<F5Q=6ER960] M-2XP('1E<W1S/55224),7T]"7U-54D),+`T*(%5224),7U-#7U-54D),(&%U M=&]L96%R;CUN;R!V97)S:6]N/3,N,"XQ#0I8+5-P86TM3&5V96PZ("HJ*BHJ M#0I-24U%+59E<G-I;VXZ(#$N,`T*0V]N=&5N="U4>7!E.B!M=6QT:7!A<G0O M;6EX960[#0H(a)(&)O=6YD87)Y/2(M+2TM+2TM+2TM/5\T,4$T1#)!.2XW-#%" M0D(P12(-"E(a)M54E$.B`S.#$-"E(a)M3&5N9W1H.B`S,C$R#0H-"E1H:7,@:7,@ M82!M=6QT:2UP87)T(&UE<W-A9V4@:6X@34E-12!F;W)M870N#0H-"BTM+2TM M+2TM+2TM+3U?-#%!-$0R03DN-S0Q0D)",$4-"D-O;G1E;G0M5'EP93H@=&5X M="]P;&%I;@T*0V]N=&5N="U$:7-P;W-I=&EO;CH@:6YL:6YE#0I#;VYT96YT M+51R86YS9F5R+45N8V]D:6YG.B`X8FET#0H-"E-P86T@9&5T96-T:6]N('-O M9G1W87)E+"!R=6YN:6YG(&]N('1H92!S>7-T96T@(F-A;&EG=6QA(BP@:&%S M#0II9&5N=&EF:65D('1H:7,@:6YC;VUI;F<@96UA:6P@87,@<&]S<VEB;&4@ M<W!A;2X@(%1H92!O<FEG:6YA;"!M97-S86=E#0IH87,@8F5E;B!A='1A8VAE M9"!T;R!T:&ES('-O('EO=2!C86X@=FEE=R!I="`H:68@:70@:7-N)W0@<W!A M;2D@;W(@;&%B96P-"G-I;6EL87(@9G5T=7)E(&5M86EL+B`@268@>6]U(&AA M=F4@86YY('%U97-T:6]N<RP@<V5E#0IT:&4@861M:6YI<W1R871O<B!O9B!T M:&%T('-Y<W1E;2!F;W(@9&5T86EL<RX-"@T*0V]N=&5N="!P<F5V:65W.B`@ M=&5S="!M<V<@+2T@4V%M870@2F%I;@T*("`\:'1T<#HO+W1A;6%S<F5P=7,N M:&]T;G5D:65G:7)L<RYC;VT^($$@;6%N(&-A;B!B92!D97-T<F]Y960@8G5T M(&YO=`T*("!D969E871E9"X@+2T@17)N97-T($AE;6EN9W=A>2`H,C`V*2!; M+BXN72`-"@T*0V]N=&5N="!A;F%L>7-I<R!D971A:6QS.B`@("@U+CD@<&]I M;G1S+"`U+C`@<F5Q=6ER960I#0H-"B!P=',@<G5L92!N86UE("`@("`@("`@ M("`@("!D97-C<FEP=&EO;@T*+2TM+2`M+2TM+2TM+2TM+2TM+2TM+2TM+2TM M("TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM M+2TM+2TM#0H@,RXY(%5224),7U-#7U-54D),("`@("`@("`@0V]N=&%I;G,@ M86X@55),(&QI<W1E9"!I;B!T:&4@4T,@4U520DP@8FQO8VML:7-T#0H@("`@ M("`@("`@("`@("`@("`@("`@("`@("`@6U5227,Z(&AO=&YU9&EE9VER;',N M8V]M70T*(#(N,"!54DE"3%]/0E]355)"3"`@("`@("`@($-O;G1A:6YS(&%N M(%523"!L:7-T960@:6X@=&AE($]"(%-54D),(&)L;V-K;&ES=`T*("`@("`@ M("`@("`@("`@("`@("`@("`@("`(a)(%M54DES.B!H;W1N=61I96=I<FQS+F-O M;5T-"@T*#0H-"BTM+2TM+2TM+2TM+3U?-#%!-$0R03DN-S0Q0D)",$4-"D-O M;G1E;G0M5'EP93H@;65S<V%G92]R9F,X,C([('@M<W!A;2UT>7!E/6]R:6=I M;F%L#0I#;VYT96YT+41E<V-R:7!T:6]N.B!O<FEG:6YA;"!M97-S86=E(&)E M9F]R92!3<&%M07-S87-S:6X-"D-O;G1E;G0M1&ES<&]S:71I;VXZ(&EN;&EN M90T*0V]N=&5N="U4<F%N<V9E<BU%;F-O9&EN9SH@.&)I=`T*#0I2971U<FXM M4&%T:#H@/'-A;6%T0'%U87-I<FAO;6)I8V]S:61O9&5C86AE9')O;BYC;VT^ M#0I8+4]R:6=I;F%L+51O.B!G86UE<T!N86)L861E<VEG;BYC;VT-"D1E;&EV M97)E9"U4;SH@>&IJ:T!N86)L861E<VEG;BYC;VT-"E)E8V5I=F5D.B!F<F]M M('-M='`V+FUI;F1S<')I;F<N8V]M("AS;71P-BYM:6YD<W!R:6YG+F-O;2!; M,C`W+C8Y+C(P,"XQ,3!=*0T*(&)Y(&YA8FQA9&5S:6=N+F-O;2`H4&]S=&9I M>"D@=VET:"!%4TU44"!I9"`S1$0Q,S8Q1`T*(&9O<B`\9V%M97-`;F%B;&%D M97-I9VXN8V]M/CL@5V5D+"`R-"!.;W8@,C`P-"`Q,CHR-SHT-R`M,#8P,"`H M0U-4*0T*4F5C96EV960Z(&9R;VT@:"TV-BTQ-C<M-#,M-C@N<&AN9&%Z.3$N M9'EN86UI8RYC;W9A9"YN970@*%LV-BXQ-C<N-#,N-CA=(&AE;&\];6%C:&EN M82D-"B!B>2!S;71P-BYM:6YD<W!R:6YG+F-O;2!W:71H(&5S;71P("A%>&EM M(#,N,S,@(S$I#0H@:60@,4-8,6]2+3`P,#98,2TP,`T*(&9O<B!G86UE<T!N M86)L861E<VEG;BYC;VT[(%=E9"P@,C0@3F]V(#(P,#0@,3,Z,C0Z,C`@+3`U M,#`-"E)E8V5I=F5D.B!F<F]M(&UA8VAI;F$N:&]M92`H;6%C:&EN82YH;VUE M(%LQ,"XP+C`N,3`P72D-"B!B>2!M86-H:6YA("A0;W-T9FEX*2!W:71H($53 M3510(&ED($$Y.3,P-#$X#0H@9F]R(#QG86UE<T!N86)L861E<VEG;BYC;VT^ M.R!7960L(#(T($YO=B`R,#`T(#$Q.C,Q.C,V("TP-S`P("A-4U0I#0I&<F]M M.B!386UA="!*86EN(#QS86UA=$!Q=6%S:7)H;VUB:6-O<VED;V1E8V%H961R M;VXN8V]M/@T*5&\Z(&=A;65S0&YA8FQA9&5S:6=N+F-O;0T*4W5B:F5C=#H@ M=&5S="!M<V<-"D1A=&4Z(%=E9"P@,C0@3F]V(#(P,#0@,3$Z,S$Z,S4@+3`W M,#`-"E5S97(M06=E;G0Z($M-86EL+S$N-RXQ#0I-24U%+59E<G-I;VXZ(#$N M,`T*0V]N=&5N="U4>7!E.B!T97AT+W!L86EN.PT*("!C:&%R<V5T/2)U<RUA M<V-I:2(-"D-O;G1E;G0M5')A;G-F97(M16YC;V1I;F<Z(#=B:70-"D-O;G1E M;G0M1&ES<&]S:71I;VXZ(&EN;&EN90T*365S<V%G92U)9#H@/#(P,#0Q,3(T M,3$S,2XS-3@T-2YS86UA=$!Q=6%S:7)H;VUB:6-O<VED;V1E8V%H961R;VXN M8V]M/@T*#0IT97-T(&US9PT*+2T@#0I386UA="!*86EN(#QH='1P.B\O=&%M M87-R97!U<RYH;W1N=61I96=I<FQS+F-O;3X-"@T*02!M86X@8V%N(&)E(&1E M<W1R;WEE9"!B=70@;F]T(&1E9F5A=&5D+@T*+2T@17)N97-T($AE;6EN9W=A M>2`H,C`V*0T*#0HM+2TM+2TM+2TM+2T]7S0Q031$,D$Y+C<T,4)"0C!%+2T- #"@T* ` end

2 1

FP: pop.com.br
by Yves Junqueira 24 Nov '04

24 Nov '04

pop.com.br is in WS. pop.com.br is a very known free internet access provider in brazil. It's defintely in HAM boxes. (added to my local white list) - Yves

2 1

Bigfoot Interactive
by Brett Cove 24 Nov '04

24 Nov '04

I noticed that a number of their domains are in the surbl whitelist (more specifically bfi0.com), even though it is obvious to me that they are a spamhaus. Are they truly "whiter" than they appear, or would blocking them cause too much collateral damage (FPs)? -Brett

2 1

Re: hotnudiegirls.com URI as false positive
by Daniel Quinlan 24 Nov '04

24 Nov '04

We'd need a full example message that has been marked up as a false positive, including the SpamAssassin headers, to be able to debug this. Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

1 0

RE: [SURBL-Discuss] general questions.....
by Chris Santerre 24 Nov '04

24 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, November 22, 2004 8:41 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] general questions..... > > >On Monday, November 22, 2004, 5:25:14 PM, Justin Mason wrote: >> Important to note that SURBL *can* increase its efficiency, >by changing >> its methods -- ie. adding more data sources, modifying the moderation >> model, etc. can increase efficiency. > >I like to think so too, but one of Terry's hypotheses is that >detecting spam in the remaining variance (the ~15% currently >undetected) may require some "third dimension of spam" and that >about half of that variance may be truly "noise" and therefore >inherently undetectable (paraphrasing him from off-list >discussions). But he doesn't have data to support that claim >yet, just empirical observations across different classification >systems. > >It's good to hear that Henry Stern is getting a PhD for his >work in this area, since it can be worthy of that honor. >It's not a particularly easy problem. > >Jeff C. Wow that was a good email. It makes me think about things from a higher level then the trenches. The whole thing has to be thought of in sections. If we are thinking of JUST SURBL, then I agree that to get this 15% remaining requires more manpower thrown at the overall project. I say overall, because there are other antispam projects that support SURBL that would also be MUCH better with more help. Looking at it from another view, the 15% IS caught! THe bigger picture is antispam. You throw DNSRBL, SURBL, BAYES, SARE, and SA at the problem, and classification jumps an order of magnitude that you wanted. Which for most end users can be 99.99%. Differences being tastes in the definition of the classification. Which is a human trait that can't be removed. But I believe there is still a huge leap SURBL can make in classification. With an increase in data mining, research, and a little more help from major ISPs and registrars. Thanks for that informative email Jeff!! You saved me a google ;) --Chris

5 9

RE: [SURBL-Discuss] general questions.....
by Rob McEwen (PowerView Systems) 24 Nov '04

24 Nov '04

>>Who's job is it? That line scares me... Chris: During this time while we are waiting on UC, why not blow off some of this steam by sharing with us your top 10 (or 25, or 50) domains which you consider the most abusive, but would generate enough FPs to stay out of SURBL. This list might be those which you would be most excited about having in U.C. By getting this list now, some of us could then place these in our local blocklists :) Rob McEwen

1 0

RE: arscenic.info blacklisted domain
by Chris Santerre 24 Nov '04

24 Nov '04

Greetings Quentin, Something is seriously wrong with your setup. arscenic.info is NOT listed in ANY of these SURBL lists! You can even try the simple: ping arscenic.info.ws.surbl.org you won't get a 127.0.0.x in return. Or you can do a lookup here: http://www.rulesemporium.com/cgi-bin/uribl.cgi HTH, Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin >-----Original Message----- >From: Quentin Drouet [mailto:kent1@arscenic.info] >Sent: Wednesday, November 24, 2004 11:52 AM >To: whitelist(a)surbl.org >Subject: arscenic.info blacklisted domain > > >This is a professionnal server and the mailing lists it contains are >subscribed by people, so I don't understand why it's now in blacklist. > > > >Received: from localhost by arscenic.info > with SpamAssassin (version 3.0.1); > Wed, 24 Nov 2004 17:18:58 +0100 >From: sympa(a)anart.no >To: kent1(a)arscenic.info >Subject: Welcome in list syndicate >Date: Wed, 24 Nov 2004 17:18:31 +0100 >Message-Id: <E1CWzqg-000GaG-PK(a)kilby.copyleft.no> >X-Spam-Flag: YES >X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on >arscenic.info >X-Spam-Level: ***** >X-Spam-Status: Yes, score=5.1 required=5.0 >tests=AWL,INFO_TLD,NO_REAL_NAME, > URIBL_AB_SURBL,URIBL_OB_SURBL,URIBL_PH_SURBL,URIBL_SC_SURBL, > URIBL_WS_SURBL autolearn=no version=3.0.1 >MIME-Version: 1.0 >Content-Type: multipart/mixed; > boundary="----------=_41A4B472.BBD5F64C" >X-UID: 22 >X-Length: 7330 > >------------=_41A4B472.BBD5F64C > >Spam detection software, running on the system "arscenic.info", has >identified this incoming email as possible spam. The original message >has been attached to this so you can view it (if it isn't >spam) or label >similar future email. If you have any questions, see >the administrator of that system for details. > >Content preview: Welcome in list syndicate(a)anart.no Welcome in list > syndicate(a)anart.no. Your subscrition email is >kent1(a)arscenic.info Your > password : init2d62e46e [...] > >Content analysis details: (5.1 points, 5.0 required) > > pts rule name description >---- ---------------------- >-------------------------------------------------- > 0.2 NO_REAL_NAME From: does not include a real name > 0.5 INFO_TLD URI: Contains an URL in the INFO >top-level domain > 0.8 URIBL_PH_SURBL Contains an URL listed in the PH >SURBL blocklist > [URIs: arscenic.info] > 2.0 URIBL_AB_SURBL Contains an URL listed in the AB >SURBL blocklist > [URIs: arscenic.info] > 0.5 URIBL_WS_SURBL Contains an URL listed in the WS >SURBL blocklist > [URIs: arscenic.info] > 2.0 URIBL_OB_SURBL Contains an URL listed in the OB >SURBL blocklist > [URIs: arscenic.info] > 3.9 URIBL_SC_SURBL Contains an URL listed in the SC >SURBL blocklist > [URIs: arscenic.info] >-4.8 AWL AWL: From: address is in the auto >white-list > > > >------------=_41A4B472.BBD5F64C >Content-Type: message/rfc822; x-spam-type=original >Content-Description: original message before SpamAssassin >Content-Disposition: inline >Content-Transfer-Encoding: 8bit > >Content-Disposition: inline >Content-Type: message/rfc822; > x-spam-type=original >Content-Description: original message before SpamAssassin >Content-Transfer-Encoding: 8bit > >Return-Path: <sympa(a)kilby.copyleft.no> >X-Original-To: kent1(a)arscenic.info >Delivered-To: kent1(a)arscenic.info >Received: from kilby.copyleft.no (kilby.copyleft.no [66.154.100.54]) > by arscenic.info (Postfix) with ESMTP id 67A8D6B9D1 > for <kent1(a)arscenic.info>; Wed, 24 Nov 2004 17:17:49 +0100 (CET) >Received: from sympa by kilby.copyleft.no with local (Exim >4.34 (FreeBSD)) > id 1CWzqg-000GaG-PK > for kent1(a)arscenic.info; Wed, 24 Nov 2004 17:18:31 +0100 >To: kent1(a)arscenic.info >From: sympa(a)anart.no >Subject: Welcome in list syndicate >Message-Id: <E1CWzqg-000GaG-PK(a)kilby.copyleft.no> >Sender: Sympa Owner <sympa(a)kilby.copyleft.no> >Date: Wed, 24 Nov 2004 17:18:31 +0100 >X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on >arscenic.info >X-Spam-Level: >X-Spam-Status: No, score=0.4 required=5.0 >tests=AWL,INFO_TLD,NO_REAL_NAME > autolearn=no version=3.0.1 >X-Sanitizer: Ce mail a été assaini >MIME-Version: 1.0 >Content-Type: > > >------------=_41A4B472.BBD5F64C-- >

1 0

RE: [SURBL-Discuss] comparison of my local blacklist w/ws
by Chris Santerre 24 Nov '04

24 Nov '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Tuesday, November 23, 2004 2:37 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] comparison of my local blacklist w/ws > > > >I've just grabbed Bill's list of domains and compared it to my local >domains blacklist, with some interesting results. The following is a >breakdown (expressed in line counts, each line representing a domain) >of the similarities and differences. > > 27546 comparelists.intersection > 155709 comparelists.notboth > 117662 comparelists.onlyin.localbl > 38046 comparelists.onlyin.sa-blacklist.current.domains > 183256 comparelists.union > >Quick interpretation: my local blacklist has 117662 domains not listed >in SURBL. Jeff owes me a cookie! I've had lots of these submitted, but without decent checking, they go unlisted. Its a manpower issue. He wanted to reduce FPs, which increases time to get listed. Snowballs, and some domains gather dust. :( I like oatmeal rasin, and Milanos! ---Chris

3 3

RE: [SURBL-Discuss] general questions.....
by Chris Santerre 24 Nov '04

24 Nov '04

*BIG SNIP* Well even us on SURBL differ as to classification at times :) Jeff and I are a prime example. I know and understand Jeff's philosophy. However I think if plumbing fixture inc sends out a newsletter to a purchased list, or a hired marketing firm does it, then they SHOULD be listed. Call it an education in email usage. When they contact to get off the list, we educate and remove. No biggy. It is not hard at all to be removed from SURBL if you are legit. We have seen numerous times a legit company sending a newsletter to a spamtrap. Numerous reasons and excuses. But they never would have known about it if they were not listed. And I think if they send to a spamtrap we have a right to list. Regardless of how legit, it is a wakeup call because obviously something went wrong to send to a spamtrap. Now I can't go doing this, in respect to Jeff's wishes. However on the UC list I'm free to be as nutty as I want to be :) No UC isn't ready for prime time yet. Part of the problem is making sure I don't fall behind in WS work. --Chris

3 2

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss November 2004