Discuss August 2004

discuss@lists.surbl.org

56 participants
207 discussions

RE: [SURBL-Discuss] RE: (1) Another Possible FP, and (2) header p arsing issues
by Chris Santerre 16 Aug '04

16 Aug '04

>-----Original Message----- >From: Rob McEwen [mailto:webmail@powerviewsystems.com] >Sent: Thursday, August 12, 2004 11:18 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] RE: (1) Another Possible FP, and (2) header >parsing issues >Importance: High > > >I have a two-part question: > >(1) header parsing issues... > >I was reading a web site discussing an implementation of SURBL on the >IceWarp web server (using a third party add-on). One person >complained that >there are too many false positives when submitting IPs and >domains found in >the header of the e-mail. They felt like ONLY the body of the >message should >be examined. I see good arguments both ways. For example, >parsing the header >can catch spam which was originally sent to one place, but >then forwarded to >another. On the other hand, actual affiliate URLs would only >normally occur >in the body of the message. Any thoughts or suggestions? > >(2) Another Possible FP... > >This person was asked to give an example of a message which >shouldn't have >been blocked and which would have gone through if the header >wasn't parsed. >They provided an example which had the following line in the header: > >Message-ID: <000b01c47f1a$e02f73e0$0200a8c0(a)MUNGED-callatg.com> > >The offending domain was MUNGED-callatg.com > >Therefore, I must ask, could MUNGED-callatg.com be a FP? The reason I >suspect so is because they mentioned that this company is a >division of GE. >Please check on this. > I'm confused. (Theres a first!) SURBL only check the body for URLs. How did the message-ID get hit? --Chris

9 25

Fwd: [SURBL-Discuss] FP Pattern for sbl-xbl.spamhaus.org
by Jeff Chan 16 Aug '04

16 Aug '04

Spamhaus says: >From: Rob McEwen <rob(a)pvsys.com> >To: "'SURBL Discussion list'" <discuss(a)lists.surbl.org> >Date: Saturday, August 14, 2004, 1:52:26 PM >Subject: [SURBL-Discuss] FP Pattern for sbl-xbl.spamhaus.org >RE: FP Pattern for sbl-xbl.spamhaus.org > >For a while now, my philosophy has been to use sbl-xbl.spamhaus.org to block >at the connection level and not even allow these messages onto my server. >Much of the remaining spam filtering is then done by SURBL-checking. >However, more recently, I been testing samples of sbl-xbl.spamhaus.org >blocked messages and I've noticed two things. > >(1) more false positives than I would want to see (though still a very tiny, >tiny percentage overall) get blocked by sbl-xbl.spamhaus.org > >...and... > >(2) those that ARE legitimate tend to be cases where a mistake was made and, >by the next day (or later that same day), the offending IP is removed from >sbl-xbl.spamhaus.org Hmmm, this can happen. Also depends on the volume of mail he processes. I'd be interested in if this is due to SBL or XBL hits. Both can produce FP's, but it brings up a debate as to what's an FP. If an IP has been found sending viruses or spam and is auto-listed by the XBL system (normally due to a compromised box), but that IP also sends non-bad email, it's not a false listing. We error on the side of stopping the 100,000 viruses being sent to users worldwide than to let the fewer legit emails pass. >However, I must admit, I'm drawing sweeping conclusions from very little >sampling of data. Therefore, don't take my word for it... If it's SBL, if he has a cousin in the Chinanet-CQ IP space, or in parts of Brazil Telecom's space, he'll probably see many more FPs as we do have large SBL listings. Also, if he gets email from people hosting on the cheap-spam-friendly networks like New Horizon, CET Networks or OC3, they get all IP space listed. >Rather, is this consistent with anyone else's experience with >sbl-xbl.spamhaus.org? The >reason I mention this is that, if my initial conclusions are true, there >would then be a strong argument for "holding" sbl-xbl.spamhaus.org blocked >mail and giving it a "second try" some hours later. He sure could, many people do greylist with DNSBLs. >Also, if this is true, >does anyone have a "feel" for exactly how long "bad" data stays on >sbl-xbl.spamhaus.org before it gets removed? No way to know. Most XBL listed IPs can be "self-removed", SBL mistakes that generate FPs are normally found out by us pretty quickly as either the blocked users or people who use us and like he, check their logs, let us know. >(Recognizing, of course, that >SpamHaus is probably the most reliable and respected free RBL in existence >and they rarely make mistakes in the first place). :-) >Any thoughts or suggestions? Has anyone examined their sbl-xbl.spamhaus.org >blocked messages lately? On large ISP type corpses, we still have a tiny fraction of true FPs. That being said, some places (with little volume or huge cheap bandwidth and lots of CPU) will just use SBL+XBL as a part of a SpamAssassin type formula. They won't toss on it being BL'd, but will want some other spammy trait to push it over the spam-score. >Rob McEwen

5 8

preparingforemergencies.co.uk false FP on OB
by Patrik Nilsson 15 Aug '04

15 Aug '04

preparingforemergencies.co.uk is listed on OB. It's a parody site that seem to be quite popular at the moment, getting forwarded in emails, mentioned in blogs, etc. I can't find any NANAS reports involving it. It is a quite recently registered domain though (26-Jul-2004) which might have contributed to it ending up on OB. Patrik

2 1

fp - sms dot ac
by Steven Champeon 15 Aug '04

15 Aug '04

...found in the latest Cryptogram (Bruce Schneier's mailing list). -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/

2 1

sounddogs.com FP on WS.
by Patrik Nilsson 15 Aug '04

15 Aug '04

sounddogs.com is listed on WS. It's an online sound effects library that's been around since 1998. 1100 posts mentioning sounddogs.com found in Google News. None of them a NANAS report related to abuse from sounddogs.com. patrik

2 1

cross-pollination with MT-Blacklist?
by jm＠jmason.org 15 Aug '04

15 Aug '04

Hi SURBLers -- has anyone talked to Jay Allen and the MT-Blacklist people? MT-Blacklist -- http://www.jayallen.org/comment_spam/ -- is a blacklist of "bad" URLs (sound familiar? ;). They have quite a small list from the looks of things, but cross-pollination could work both ways; if *they* looked up SURBL, or even just looked up a "blog-spam" SURBL sublist, that'd be a lot more sensible. BTW I bet the blog spammers and email spammers are the same people. (If blog spammers are the people who *used* to do referrer spamming, then I'm *sure* of it -- see http://taint.org/2003/08/14/040652a.html ). Also -- some info on that google technique posted here and in SpamAssassin-users recently -- read this: http://kalsey.com/2004/07/new_comment_spam_technique/ "It appears the spammers have a new tactic in increasing their PageRank. They find a site that doesn't delete comment spam and fill it with links. Then they boost the PR of that site by spamming it in blog comments. Once the spam-friendly's site has in increased Google ranking, all those spammed links in their comments will get a boost in rank as well." I'll bet that's it -- working like so: 1. spammer S sets up payload site 2. S spams comment spam everywhere to up its PageRank 3. S email-spams with the google search URL 4. top hit for that phrase is the payload site. --j.

1 0

FP Pattern for sbl-xbl.spamhaus.org
by Rob McEwen 15 Aug '04

15 Aug '04

RE: FP Pattern for sbl-xbl.spamhaus.org For a while now, my philosophy has been to use sbl-xbl.spamhaus.org to block at the connection level and not even allow these messages onto my server. Much of the remaining spam filtering is then done by SURBL-checking. However, more recently, I been testing samples of sbl-xbl.spamhaus.org blocked messages and I've noticed two things. (1) more false positives than I would want to see (though still a very tiny, tiny percentage overall) get blocked by sbl-xbl.spamhaus.org ...and... (2) those that ARE legitimate tend to be cases where a mistake was made and, by the next day (or later that same day), the offending IP is removed from sbl-xbl.spamhaus.org However, I must admit, I'm drawing sweeping conclusions from very little sampling of data. Therefore, don't take my word for it... Rather, is this consistent with anyone else's experience with sbl-xbl.spamhaus.org? The reason I mention this is that, if my initial conclusions are true, there would then be a strong argument for "holding" sbl-xbl.spamhaus.org blocked mail and giving it a "second try" some hours later. Also, if this is true, does anyone have a "feel" for exactly how long "bad" data stays on sbl-xbl.spamhaus.org before it gets removed? (Recognizing, of course, that SpamHaus is probably the most reliable and respected free RBL in existence and they rarely make mistakes in the first place). Any thoughts or suggestions? Has anyone examined their sbl-xbl.spamhaus.org blocked messages lately? Rob McEwen

4 7

China revokes Viagra patent so it can make locally
by Jeff Chan 14 Aug '04

14 Aug '04

Of possibly major significance to phramaspam, the Chinese government apparently has revoked Pfizer's Viagra patent so their own companies can make it locally: <http://news.yahoo.com/news?tmpl=story&u=/afp/20040805/hl_afp/china_health_v…> > Thu Aug 5, 7:17 AM ET > BEIJING (AFP) - Chinese pharmaceutical makers are planning to > jointly produce a local variant of Viagra after Pfizer Inc of > the US lost its patent protection in China for the popular drug. > Without citing a source, state media reported Wednesday the 17 > pharmaceutical companies, headed by Tonghua Hongtaomao > Pharmaceutical Co Ltd. from northeastern China, are hoping to > set up a joint-stock company to make an erectile dysfunction > drug that would cost only half the price of Viagra. This may create new incentives for and types of pill spams. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

partstrain.com potential FP on OB.
by Patrik Nilsson 14 Aug '04

14 Aug '04

partstrain.com is listed on OB. They show up in sponsor links on a discussion list for Amnesty International members (a list hosted by mainsleaze spammers Topica...). They seem to be a legit autoparts company. I can't find any abuse reports on NANAS that mention partstrain.com, but one news group post indicating they might be a bit shady. Not sure about this one. I'll whitelist it locally if there is a reason for it being on OB. Patrik

2 1

Re: SpamAssassin Logo Update
by Jeff Chan 14 Aug '04

14 Aug '04

FWIW I agree with most of your own comments. The arrow is much more meaningful in cross-cultural symbolism than the shuriken. (Even many Japanese people would probably more readily recognize the arrow than the Shuriken, which is an obscure and impractical weapon at best.) The tie in with Apache is an added plus. I like the top (closest to original?) logo the best. I find your logo clean, professional, meaningful and, frankly, pretty. Those are hard to come by. Congratulations on nice work. Jeff C.

1 0

← Newer
1
...
9
10
11
12
13
14
15
...
21
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss August 2004