Discuss July 2004

discuss@lists.surbl.org

65 participants
151 discussions

FW: False positive on Big Evil
by Chris Santerre 23 Jul '04

23 Jul '04

I agree with Jonathan, these guys should be whitelisted. --Chris >-----Original Message----- >From: Hall J D (ISeLS) [mailto:jdhall@glam.ac.uk] >Sent: Friday, July 23, 2004 7:41 AM >To: csanterre(a)merchantsoverseas.com >Subject: False positive on Big Evil > > >Hello Chris, > >I seem to be getting a false positive in the current >BigEvil.cf for http://emailuniverse.com > >They are an e-mail list hints and tips site. They're lists >seem to require a confirmation e-mail to subscribe to their >lists. My user who reported the false positive has confirmed >that she did sign up for the list so it's not unsolicited. > >Thanks, > >Jonathan >

2 1

Re: [SURBL-Discuss] ETA on New Version
by Jeff Chan 22 Jul '04

22 Jul '04

On Thursday, July 22, 2004, 1:43:58 PM, Rob McEwen wrote: > What is the TTL for the ob.surbl.org list? The TTL on ob is 6 hours. Maybe we should lower that. > Also, is the TTL for the multi.surbl.org list still > 6 hours? Could/will that ever be improved? Good question. RFCing lowering the TTL on multi was one of the things on my list of things to do... I'll ask now.... Jeff C.

1 0

Bitmasks on multi.surbl.org
by Mark 22 Jul '04

22 Jul '04

Hello, I just read about the new multi.surbl.org, and was wondering about its bitmask properties. Can you call multi.surbl.org with a multi-bitmask? Like 00111110? (127.0.0.62). To mean "Any of 2,4,8,16,32"? Probably not; but that would be real useful. Thanks, - Mark

2 1

Re: [SURBL-Discuss] ETA on New Version
by Rob McEwen 22 Jul '04

22 Jul '04

Jeff C. wrote: > Outblaze in particular seems to get domains quickly and > have a relatively low FP rate.... Great! What is the TTL for the ob.surbl.org list? Also, is the TTL for the multi.surbl.org list still 6 hours? Could/will that ever be improved? I'm still finding some spam getting through which shows up on the MULTI list the next day. Therefore, I'm thinking about checking BOTH multi.surbl.org AND ob.surbl.org. The idea is that, even though they overlap, I could catch everything but the newest stuff with multi.surbl.org and then possibly catch some newer stuff on ob.surbl.org that hasn't yet made it into the multi-surbl.org list. Follow?

1 0

ETA on New Version
by Rob McEwen 22 Jul '04

22 Jul '04

I read on an earlier post something about a newer SURBL version which more quickly matches a new domain submission with that particular spammer's past data so as to lower the threshhold (of # of reports) it takes for a known spammer hiding behind a new domain name to get blacklisted. Does anyone have an estimate about when this new system will be put into production. Rob M.

2 1

[SURBL-Discuss] Help! Who should a send email to regarding SA not checking against localhost rbldns?
by Joe Young 22 Jul '04

22 Jul '04

Spamassassin is not checking against my rbldns server. It will query multi.surbl.org but not localhost Here is my configs /etc/sysconfig/rbldnsd RBLDNSD="njabl -udnsbl -r/var/lib/rbldns -t21600 -c60 \ -lquerylog -blocalhost/53 \ localhost:dnset:ws.surbl.org.rbldnsd \ " /etc/mail/spamassassin/spamcop_uri.cf uri SPAMCOP3_URI_RBL eval:check_spamcop_uri_rbl('localhost','127.0.0.2') describe SPAMCOP3_URI_RBL URI's domain appears in spamcop database at ws.surbl.org tflags SPAMCOP3_URI_RBL net score SPAMCOP3_URI_RBL 3.0 The debug of spamassassin shows debug: querying for amazingbuyz.net.localhost debug: Query failed for amazingbuyz.net.localhost debug: querying for amazingbuyz.net.ws.surbl.org debug: found A records for: amazingbuyz.net.ws.surbl.org Dig @localhost amazingbuyz.net.localhost shows ; <<>> DiG 9.2.2-P3 <<>> @localhost amazingbuyz.net.localhost ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24488 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 20, ADDITIONAL: 0 ;; QUESTION SECTION: ;amazingbuyz.net.localhost. IN A ;; ANSWER SECTION: amazingbuyz.net.localhost. 21600 IN A 127.0.0.2 ;; AUTHORITY SECTION: localhost. 5400 IN NS ns1.surbl.org. localhost. 5400 IN NS ns2.surbl.org. localhost. 5400 IN NS ns3.surbl.org. localhost. 5400 IN NS ns4.surbl.org. localhost. 5400 IN NS ns5.surbl.org. localhost. 5400 IN NS ns6.surbl.org. localhost. 5400 IN NS ns7.surbl.org. localhost. 5400 IN NS ns8.surbl.org. localhost. 5400 IN NS ns9.surbl.org. localhost. 5400 IN NS ns10.surbl.org. localhost. 5400 IN NS ns11.surbl.org. localhost. 5400 IN NS ns12.surbl.org. localhost. 5400 IN NS ns13.surbl.org. localhost. 5400 IN NS ns14.surbl.org. localhost. 5400 IN NS ns15.surbl.org. localhost. 5400 IN NS ns16.surbl.org. localhost. 5400 IN NS ns17.surbl.org. localhost. 5400 IN NS ns18.surbl.org. localhost. 5400 IN NS ns19.surbl.org. localhost. 5400 IN NS ns20.surbl.org. ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(localhost) ;; WHEN: Thu Jul 22 11:30:29 2004 ;; MSG SIZE rcvd: 439

2 1

RE: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh
by Chris Santerre 22 Jul '04

22 Jul '04

>70_sc_top200.cf You could remove. >antidrug.cf remove this when you upgrade to SA 3.0 >backhair.cf remove this when you upgrade to SA 3.0 >bigevil.cf REMOVE! >chickenpox.cf remove this when you upgrade to SA 3.0 >evilrules.cf REMOVE very old! --Chris

1 0

RE: [SURBL-Discuss] New slogan
by Chris Santerre 22 Jul '04

22 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, July 20, 2004 1:28 AM >To: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] New slogan > > >On Monday, July 19, 2004, 9:40:30 PM, Ryan Thompson wrote: >> Save a parse tree. Get SURBL. > >> ;-) > >Or, Let us do the parsing for you. > >(at least part of it) :-) > >Jeff C. > Wouldn't that be: "Relax, and leave the parsing to us!" :) --Chris

2 1

RE: [SURBL-Discuss] ph.surbl.org
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Thanks Jeff And thanks for not "flaming" my dumb questions. Regards Tom > -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: 22 July 2004 10:44 > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] ph.surbl.org > > On Thursday, July 22, 2004, 1:38:06 AM, Thomas Kinghorn wrote: > > I have noticed that the plugin for SA 2.63 has sc, ws, ob & ab BUT the > > plugin for SA 3 has ph.surbl.org. > > > What is ph.surbl.org and can it be used with 2.63 as a stand-alone rule > like > > the others. > > ph is a list with some phishing data. It only exists in > multi.surbl.org which is currently supported in SA 3.0. > It does not exist as a standalone list. > > You can find it described in the Lists document: > > http://www.surbl.org/lists.html#ph > > Jeff C. > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss

1 0

ph.surbl.org
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Hi All. Just reading the docs. I have noticed that the plugin for SA 2.63 has sc, ws, ob & ab BUT the plugin for SA 3 has ph.surbl.org. What is ph.surbl.org and can it be used with 2.63 as a stand-alone rule like the others. Regards, Tom Kinghorn

2 1

← Newer
1
2
3
4
5
6
7
8
...
16
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss July 2004