Discuss July 2004

discuss@lists.surbl.org

65 participants
151 discussions

RE: First submission questions
by Chris Santerre 12 Jul '04

12 Jul '04

Hi Ryan, thanks for the submissions. I'm about to give them a quick going thru. The best place to ask these questions is right on the SURBL list discuss(a)lists.surbl.org I'm cc'ing this to the list. The more eyes on it the better. Redirects are handled differently. Post them to discussion list and they get added to a redirect list. The rule of thumb is like cooking: "When in doubt, throw it out." We would much rather not list a spammer, then list a shammer. Unless we decide together that the shammer is 95% spam with 1 legit customer. Then we might list them and inform the legit customer. Sometimes we don't all agree. Like political spam. Thats were we have some real fun ;) --Chris >-----Original Message----- >From: Ryan Thompson [mailto:ryan@sasknow.com] >Sent: Saturday, July 10, 2004 4:41 PM >To: Chris Santerre >Subject: First submission questions > > > >Hi Chris, > >I just submitted a "short list" of 87 domains to >chris+rthompson(a)moglobal.com, as kind of a proof-of-concept. I did take >quite a bit of care in the classification of these domains, so *I'm* >confident about them, but there are a few grey areas that I wasn't sure >if you'd agree with. Can you offer a bit of advice? > >Some I wasn't sure about are below. Also, if there's a person or list >that would be better equipped to advise on this kind of thing, please >let me know. I want to quickly become more help than burden, obviously. >:-) I'll be quieter once I better understand your inclusion system. > >Spam username hosts, but possibly also legit sites? I can't read >Taiwanese, nor do I really want to. In any case, these are >probably safe >for inclusion in English block lists. >twfc.org.tw Hosts spammers >club.net.tw Random hostname spammers >f2m.idv.tw Seems to process email forms for spammers >apol.com.tw mail.apol.com.tw seems to host /~spammers/ >pchome.com.tw Multiple NANAS mentions >netking.com.tw Multiple NANAS mentions > >Image hosts: >vendio.com eBay spammers image host; multiple NANAS >hinet.net has been mentioned before; they are rather notorious > >Obfuscated/invalid/mistyped URIs that get_uri_list picked up on: >interfun_lacing.jpg Local image URL >internet.e-mail Fake URL seen in spam >dnatzweirq2.ru Obfu for dazer2.ru >new_page_2.files Weird fake URL >wwwacronmedia.biz Mistyped spammer URL > >Iffy redirects: >tadpole.com Funny redirect destination in software spam? >61.218.32.78 Redirector; down now? >tadpolecomputer.com Funny redirect destination in software spam? > >- Ryan > >-- > Ryan Thompson <ryan(a)sasknow.com> > > SaskNow Technologies - http://www.sasknow.com > 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 > > Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon > Toll-Free: 877-727-5669 (877-SASKNOW) North America >

3 2

j-chkmail and SURBL
by Jose-Marcio.Martins＠ensmp.fr 12 Jul '04

12 Jul '04

Hello, j-chkmail is the filter I developed. It's completely written in C language. It's intended to use very few ressources and be very fast. Version 1.7 experimental has an interface for SURBL. I'm using it for two months now. There are two interfaces to SURBL : DNS and local database. DNS based queries are much easier to administrate, but local databases are faster. For the moment, only queries on local databases are validated. DNS queries is implemented but not yet validated. j-chkmail is free software, but with downloading is limited to registered users. To become a registered user, you shall accept to identify yourself : name, domain, ..., and have some responsibility on the domain you'll be using it (don't ask a license to hotmail.com, unless you're the hotmail.com system administrator... 8-). You can check it at : http://j-chkmail.ensmp.fr Best, Jose-Marcio -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

1 0

RE: [SURBL-Discuss] Hand classification / Scripted submission
by Chris Santerre 09 Jul '04

09 Jul '04

>> >3) Is there any advantage to submitting the same URI more than once >> > (i.e., from different spam messages?) It seems like the answer is >> > probably "no", but I'll gladly accept enlightenment. >> >> See my answer to #1. ;) > >:-) So noted, for WS. I've already had responses from other SURBLs that >are actually ranking by frequency of submissions, and encouraging >multiple submissions of the same URI if it appears in multiple spams. > Just a note on this for why I don't want multiples. I want multiples, but from different sources. The same person sending the same domain 5 times tells me nothing. But 5 different people submitting means a lot! > >> SURBL is the sexiest thing since.....well....me! :P > >Uhh... I'm not going to comment on that. For many reasons. :-) That's right, nothing to see here. Keep moving... :) > >> >Now I want to give something back. >> >> I keep getting this and I use the standard reply of: "I'll take 1 >> Dodge Hennessy Venom 800TT." >> >> Still no takers :) > >Well, I had one last week, but it was silver and had little plastic >ninjas stuck all over it, and a personalized plate of "SPAMD", so I >put it on an auction on Monday. If I would have known sooner... > Doh! You guys from saskachuan! If it can't mount a moose on it, you sell it! ;) --Chris

1 0

RE: [SURBL-Discuss] Hand classification / Scripted submission
by Chris Santerre 09 Jul '04

09 Jul '04

> >Questions: >1) Is this approach reasonable (i.e., am I going to hear screams from > someone if I script this, assuming I take precautions, >rate-limit the > submissions, and check the results before turning it loose?) I will shoot you! :) >2) Is there already a more efficient way to submit URIs? (Besides > running my own list, which, I guess, isn't too unreasonable :-) Yes. I'm going to email you off list. >3) Is there any advantage to submitting the same URI more than once > (i.e., from different spam messages?) It seems like the answer is > probably "no", but I'll gladly accept enlightenment. See my answer to #1. ;) >4) Should I be submitting to multiple SURBLs, or just stick with > ws.surbl.org? > most people are running [SC] and [WS] so [WS] is fine. >Since implementing SURBLs in SA2.63 about a week ago, we've had amazing >success. So much that we're having occasional word-wrap issues with the >X-Spam-Level: (stars) header. :-) > SURBL is the sexiest thing since.....well....me! :P >Now I want to give something back. I keep getting this and I use the standard reply of: "I'll take 1 Dodge Hennessy Venom 800TT." Still no takers :) I'm thinking of aiming smaller with an Nvidia 6800 video card. --Chris

2 1

RE: [SURBL-Discuss] Yahoo.net FP in ws.
by Chris Santerre 09 Jul '04

09 Jul '04

Actually I think I already beat you on that Bill ;) Muahahahah behold the speed of the big ape on caffene and techno music! --Chris >-----Original Message----- >From: William Stearns [mailto:wstearns@pobox.com] >Sent: Friday, July 09, 2004 10:53 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Yahoo.net FP in ws. > > >Good morning, Patrick, > >On Fri, 9 Jul 2004, Patrik Nilsson wrote: > >> This one needs to whitelisted... >> >> Domain yahoo.net, listed in: >> ws.surbl.org > > Thanks for the report! That'll be removed in the 11:00 update. > Cheers, > - Bill > >--------------------------------------------------------------- >------------ > "cc:Mail is a wonderful application, as long as you don't want >to read or send mail." >(Courtesy of Nix <nix(a)esperi.demon.co.uk>) >--------------------------------------------------------------- >----------- >William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, >freedups, p0f, >rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org -------------------------------------------------------------------------- _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

Yahoo.net FP in ws.
by Patrik Nilsson 09 Jul '04

09 Jul '04

This one needs to whitelisted... Domain yahoo.net, listed in: ws.surbl.org Thanks, Patrik

2 1

RE: [RD] BIGEVIL the big one, just went live!
by Chris Santerre 09 Jul '04

09 Jul '04

I'm cc'ing this to the SURBL list. But I think the answer may just be.... SA 3.0 :) --Chris >-----Original Message----- >From: Chr. von Stuckrad [mailto:stucki@mi.fu-berlin.de] >Sent: Friday, July 09, 2004 9:55 AM >To: Spamassassin-Talk (E-mail) >Subject: Re: [RD] BIGEVIL the big one, just went live! > > >... >> >Is *such* a large increase 'correct'? >> >Or do I have to seach for other trouble than *BIG*_evil? >... >> No that is correct. Bigevil got 10x bigger. I am worried abuot larger >... >> surbl.org is the way to go. If you can't do net tests, rsync >it and do it >> locally. > >OK, in my 'normal' system, using a self-compiled Version >I can (and did) do that, but > > DEBIAN 'original' Packages do not contain the > SURBL-Patch, so can NOT go that way > >Does somebody know, how to 'splice' those patches >into an otherwise completely unchanged way of using >debian packages? > >Stucki > >-- >Christoph von Stuckrad * * |nickname |<stucki(a)math.fu-berlin.de>\ >Freie Universitaet Berlin |/_*|'stucki' |Tel(days):+49 30 838-75 459| >Fachbereich Mathematik, EDV|\ *|if online|Tel(else):+49 30 77 39 6600| >Arnimallee 2-6/14195 Berlin* * |on IRCnet|Fax(alle):+49 30 838-75454/ >

1 0

Hand classification / Scripted submission
by Ryan Thompson 09 Jul '04

09 Jul '04

Hi All, 'Tis my first post to this list... so I'll try to make it a good one. I have a heap (and will continue to have future heaps) of spam with URIs that don't hit any of the SURBLs. We'll hand-classify the URIs, of course, but are there any objections to scripting the submission against http://www.rulesemporium.com/cgi-bin/uribl.cgi?report=1 ? The basic idea would be to run one automatic pass to analyze our SA headers to see if *_URI_BL rules already matched; if they don't, add the message to a processing queue. Then, for each URI in the each message of that queue, do the lookup again with Net::DNS, since the URI might have been added in the last 24 hours or so since the spam was received. This should hopefully produce a comparatively short list of URIs (and spams) that don't appear in the SURBL. From here, we can hand-classify this bunch (i.e., delete any that aren't spammer sites), and have our second-pass script strip the SA markup (if present) from the spam, and automatically submit the hand-picked URIs and their spams via the web interface. Questions: 1) Is this approach reasonable (i.e., am I going to hear screams from someone if I script this, assuming I take precautions, rate-limit the submissions, and check the results before turning it loose?) 2) Is there already a more efficient way to submit URIs? (Besides running my own list, which, I guess, isn't too unreasonable :-) 3) Is there any advantage to submitting the same URI more than once (i.e., from different spam messages?) It seems like the answer is probably "no", but I'll gladly accept enlightenment. 4) Should I be submitting to multiple SURBLs, or just stick with ws.surbl.org? Since implementing SURBLs in SA2.63 about a week ago, we've had amazing success. So much that we're having occasional word-wrap issues with the X-Spam-Level: (stars) header. :-) Now I want to give something back. - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

1 0

RE: {Spam?} Re: [SURBL-Discuss] {Spam?} Perfect example of URL Po ison
by Chris Santerre 09 Jul '04

09 Jul '04

>-----Original Message----- >From: Mariano Absatz [mailto:el.baby@gmail.com] >Sent: Thursday, July 08, 2004 4:32 PM >To: SURBL Discussion list >Subject: {Spam?} Re: [SURBL-Discuss] {Spam?} Perfect example of URL >Poison > > >I always 'LOOK' at the actually displayed message within my mailer and >THEN analyze the source... but looking at this, I'd tend to report >opoloves.com and netuetion.com (supposing the faxd.gif has something >visible in it). > >Please, people... by far the BEST thing about SURBL is its really, >really, really low FP rate so you can be very comfortable scoring it >high. > >I have them scored at 3.5 (except for 6dos) in a VERY conservative ISP >and it's doing wonderfully. > >I can't offer right now 'cause I have no time at all, but I'd very >much like that the SURBL lists keep being managed manually. > >It'd be great if we could, at some point, form a small group of >volunteers with VERY good skills at spotting guilty URIs within spam >and keep the lists much like clamav maintains its virus database... > Oh that has been discussed. And started. But then that guy got abducted by aliens or something. If you ever meet a guy named Paul on the street, ask him how he is doing, and if the mother ship has returned. :) --Chris

3 2

RE: [SURBL-Discuss] Submissions to SURBL list thru SARE website.
by Chris Santerre 08 Jul '04

08 Jul '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Thursday, July 08, 2004 3:27 PM >To: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] Submissions to SURBL list thru SARE >website. > > >on Thu, Jul 08, 2004 at 03:17:52PM -0400, Chris Santerre wrote: >> Good grief. Let me say this slowly.... >> >> SURBL is for domains in LINKS, URLS, websites, images, >things you click on, >> images hosted in the email. >> >> SURBL is NOT, will never be used, doesn't care, /dev/null's, >any domain or >> IP the email came from. > >Well, I for one won't be sending any more domains along if I >have to also >distinguish between the domains I happened to find in email bodies from >those I happened to find in message headers. Sorry. The >overlap is far too >great, as for example in a recent message I got (summarized): > No you misunderstand. Steve, what you do with me is fine ;) These are people who keep reporting the same dang domain but all the IP addresses it comes from. Which are mostly zombied broadband machines!! So I get 20 submissions of the SAME spam, with the same one line URL in it, only they report each IP it came from!!! ARGH!!! And please, when using the SURBL submission page on SARE, try to include a copy of the spam, it helps get it added MUCH faster. Remember these are hand checked!! For those of you submitting them thru other methods to me, continue what your are doing. That is working fine. --Chris

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss July 2004