Discuss December 2004

discuss@lists.surbl.org

43 participants
80 discussions

Start a nNew thread

www.rulesemporium.com down?
by Martin 07 Dec '04

07 Dec '04

Or is it just here? Thanks / Martin

2 1

RE: [SURBL-Discuss] Hi I'm new and I like SURBL
by Paul Schwarz 07 Dec '04

07 Dec '04

I'm using XWall and this is what it states: ----------------------------------------------------------- GreyListing GreyListing spam filter, based on http://projects.puremagic.com/greylisting The GreyListing method looks at three pieces of information about any particular mail delivery attempt: The IP address of the host attempting the delivery The envelope sender address The envelope recipient address >From this an unique triplet for identifying a message is created and if this triplet was never been seen before, or the sender is not excluded or on the white list, then the message delivery is refused with a temporary failure. Any normal SMTP server will reschedule the message and will resend it after some time ( usually 10 - 15 minutes ). Spammers however are sending applications designed specifically for spamming. These applications usually adopt the fire-and-forget methodology. That is, they attempt to send the spam to one or several MX hosts for a domain, but then never attempt a true retry as a real SMTP server would. There are some misbehaving mail servers that have a problem with GreyListing and XWall automatically excludes them. You will find the list at GreyListing Exclusions Note: Make sure your backup MX SMTP also runs XWall or any other SMTP server that support GreyListing or else the spammer will bypass XWall by sending to XWall first and then to the backup MX. Max triplets to gather Defines how many triples XWall should member Initial delay of a previously unknown triplet Lifetime of triplets that have allowed mail to pass Lifetime of triplets that have not yet allowed a mail to pass Defines the time interval of the triples Show detailed triplet description (last seen, time elapsed) If this is enabled XWall shows a detailed description about the status of the triplet, including the last seen and elapsed time. ----------------------------------------------------------- -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan Sent: Tuesday, December 07, 2004 1:10 AM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] Hi I'm new and I like SURBL On Monday, December 6, 2004, 8:54:09 PM, Joseph Burford wrote: (Paul Schwarz writes:) >> Is anyone else recommending or not recommending greylisting and what are >> your experiences. Seems like surbl should get more effective over the > Greylisting rocks, however I've been building a greylist whitelist to > help get over the problem of various people who run non-compliant systems. > So with a good list of trusted netblocks not to greylist, it is even > more effective. I've been sharing this with a few people, if you or > anyone else is interested please mail me offlist. OK I think there may be some confusion about the term 'greylisting' here. Greylisting is one of those terms that can mean different things in different contexts. In this case, it looks like: 1. Paul may be referring to putting marginal spams into a separate mail folder or mailbox so that they can be checked manually for spamminess, then delivered or deleted. Perhaps Paul can clarify if that's what he meant. 2. Joseph means using blocklists based on 'grey' criteria, i.e. domains are mentioned in some legitimate mail and also some spams. Jeff C. -- "If it appears in hams, then don't list it." _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

RE: [SURBL-Discuss] www.rulesemporium.com down?
by Thomas Kinghorn [MTNNS -Rosebank] 07 Dec '04

07 Dec '04

Same result. Looks down. Tom -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Martin Sent: 07 December 2004 11:29 AM To: discuss(a)lists.surbl.org Subject: [SURBL-Discuss] www.rulesemporium.com down? Or is it just here? Thanks / Martin _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: Non-Clickable URI's
by Chris Santerre 07 Dec '04

07 Dec '04

>-----Original Message----- >From: RD [mailto:bitoy@lawin.pinoy.org] >Sent: Friday, December 03, 2004 8:21 PM >To: Spamassassin List >Subject: Non-Clickable URI's > > >Hello List, > >I've seen spams where spammers are using >"Cut&Paste_this_URL_to_your_browser" method reason why spamassassin >won't trigger SURBL database lookup. > >Is there a known workaround to catch this non-clickable URIs >and trigger >SURBL lookup? This is in the form of www . domain . com It was mentioned on the SURBL list, and I wrote a quick and dirty SA rule for it. Initial tests were dissmal. Found 2 ham: > http :// www . drugstore . com / ivd0324 > header copied into the body of a forward: > X-Scanned-By: MIMEDefang 2.28 (www . roaringpenguin . com / mimedefang) Also hit 12 spam out of around 70k. A little more testing needed. But I think this shows that it isn't worth the rule. The links break and require end lusers to not only copy and paste, but edit the link to remove the spaces. Clearly more then most users would do. --Chris

2 1

RE: [SURBL-Discuss] Re: a few URL blacklist sources
by Chris Santerre 06 Dec '04

06 Dec '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Monday, December 06, 2004 1:19 PM >To: quinlan(a)pathname.com >Cc: SURBL Discuss >Subject: [SURBL-Discuss] Re: a few URL blacklist sources > > >> http://moinmaster.wikiwikiweb.de/BadContent > >Apparently, this is now just a copy of mt-blacklist: > > http://www.jayallen.org/comment_spam/ > >It looks a little stagnant, but my previous cooperation suggestion >stands. :-) Thanks DQ. Looks like some good sources. I'll talk to Jeff and see if we can come up with something. I know he will want to put this thru a test of some sort to reduce FPs. But a great idea. --Chris

1 0

RE: [SURBL-Discuss] Web page
by Chris Santerre 06 Dec '04

06 Dec '04

Sweet! Thanks! --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 8:54 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Web page > > >On Friday, December 3, 2004, 8:31:51 AM, Chris Santerre wrote: >> Do we list all the programs that curently support SURBL on >the web site? It >> seemed to escape my eyes if it is. > >There was a partial list on the Quick Start page under "Additional >programs using SURBLs", which I've just updated. > > http://www.surbl.org/quickstart.html > >"Additional programs using SURBLs > >Many programs now support SURBLs including sendmail, qmail, >qmail-ldap, exim, exchange, Policy Patrol, MailScanner, Declude >Junkmail, Merak Mail Server, MDaemon, GEE Whiz, SpamBouncer, >ALOAHA, ASTPS, NEMX Power Tools, XWall, ORFilter, STAT AntiSpam, >MTS Professional, Trash Finder, and more. Please see the News and >Links sections for more information." > >The main list is on the Links page: > > http://www.surbl.org/links.html > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Web page
by Chris Santerre 04 Dec '04

04 Dec '04

Do we list all the programs that curently support SURBL on the web site? It seemed to escape my eyes if it is. --Chris

2 1

RE: [SURBL-Announce] SURBL patches for qmail and qmail-ldap
by Chris Santerre 03 Dec '04

03 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 10:15 AM >To: SURBL Announce >Subject: [SURBL-Announce] SURBL patches for qmail and qmail-ldap > > >Pieter Droogendijk has written patches for qmail and qmail-ldap >to support SURBLs: > *sniff* our little baby, is growing up so fast! ;) --Chris

1 0

RE: [SURBL-Discuss] What are the chances of FP on Newsletters and Order Confs.
by Chris Santerre 03 Dec '04

03 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 12:19 AM >To: Paul Schwarz >Cc: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] What are the chances of FP on Newsletters >and Order Confs. > *snip* > >In a nutshell our false positive rate is very low. Our policies >help that, and you can help by reporting any false positives >you may find to us. Our rate of false positive reports is very >low, probably less than one per day. A comment on this. This FP rate is arguable in my eyes. Anyone on the SURBL list knows Jeff and I have a difference of opinion as to what an FP is :-) (Much love for Jeff!) If a legit newsletter sends to a spamtrap, then is that truely an FP? Think about that, let it simmer, eat something, think about it some more, then answer it. (You don't have to answer that one Jeff, I know....) But we follow the SURBL contributor rules whether we like them or not. WWJD= What would Jeff do? ;) I have to admit, it bothers me that Theo's stats show the WS list in second lowest place for FPs. Damit it! We want to be the lowest FP rate of them all!!! Call it a freindly competition. We are close, so close. --Chris

1 0

RE: [SURBL-Discuss] Spammers Workaround
by Chris Santerre 03 Dec '04

03 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 2:45 AM >To: RD >Cc: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Spammers Workaround > > >On Thursday, December 2, 2004, 11:02:26 PM, RD RD wrote: >> I just thought that an additional feature for SpamcopURI to scan the >> message for a non-clickable links/domains that is present it >SURBL would >> be a nice add-on. > >SpamAssassin probably already does quite a bit of deobfuscation >to detect URIs and domains in them. I think it may look for >www.domain.com already, but I don't know about www . domain . com >You could look at the source code or ask them.... > Actually I see a nice pattern to look for. I will right an SA rule for this and post it later today for testing. But if people are stupid enough to fall for spams, then they are too stupid to remove the spaces, and these links are useless. :) --Chris (I'm a toys-r-us kid!)

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss December 2004