Discuss August 2004

discuss@lists.surbl.org

56 participants
207 discussions

SURBL WS test scores in SA 3.0
by Fred 29 Aug '04

29 Aug '04

Hello Group, This is my first post here, let me introduce myself. I've been very active in fighting spam for the past 3-4 years, I just recently became a submitter to the WS surbl list and I am hoping to start some action to help get a few things improved for all of us. I've created a number of rulesets for SARE (tripwire, OEM, Spoof) and released my own rules to the public, now I am focusing on SURBL_WS and doing what I can to improve all aspects of it. First off I am looking for people who use SpamAssassin and have access to a corpus of ham e-mail. The score for the WS SURBL test in 3.0 is very low, I am really focused on improving this and hope to get the score to 2 or 3 by the release of SA 3.1 I want to track down False Positives and get these whitelisted. The statistics-set1.txt file shows: The first number is % of e-mails hit (spam and ham), the next is % of spam, followed by % of ham. 51.999 78.4712 0.4756 URIBL_WS_SURBL With detection at 78.5% this rule is only outperformed by RAZOR2 and this shows our potential. If we could reduce those FPs it would greatly increase or scores and improve everyones perception of how good we are. Even the most basic rule of HTML_MESSAGE only hit on 75% of spam, we are doing more than great so far! Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400 mailto:info@i-is.com

5 12

WL. klm-email.com
by Alex Broens 27 Aug '04

27 Aug '04

Jeff Could you pls get this whitelisted? klm-email.com * 5.0 OB_URI_RBL URI's domain appears in ws database at ob.surbl.org * [klm-email.com is blacklisted in URI RBL at] Domain Name: KLM-EMAIL.COM Registrar: SAFENAMES LTD Whois Server: whois.safenames.net Referral URL: http://www.safenames.net Name Server: A.NS.KLM-EMAIL.COM Name Server: B.NS.KLM-EMAIL.COM Name Server: C.NS.KLM-EMAIL.COM Name Server: D.NS.KLM-EMAIL.COM Name Server: E.NS.KLM-EMAIL.COM Name Server: F.NS.KLM-EMAIL.COM Status: REGISTRAR-LOCK Updated Date: 24-may-2004 Creation Date: 17-may-2004 Expiration Date: 17-may-2006 ---------------------- From: KLM Belgium [SMTP:klm_belgium@klm-email.com] Sent: 27 August 2004 14:23 To: xxxxxxxxxxxx Subject: 10 Crazy Days of Internet USA from 321 euro Fasten your seatbelts as KLM's 10 days of internet will be in the air again from August 31st until September 9th. For 10 days in a row you can book your flights to 76 destinations at extra special prices via www.klm.be (http://klm-email.com/a/MUNGED / www.klm.lu (http://klm-email.com/a/MUNGED/link5. The offer being limited, be sure to book in time! Check the complete list of destinations and prices on www.klm.be (http://klm-email.com/a/MUNGED/link4) / www.klm.lu (http://klm-email.com/a/MUNGED/link4) as of August 31st. Visit www.airfrance.be (http://klm-email.com/a/MUNGED/link6) for other attractive offers. KLM The Reliable Airline --------------------------------

2 1

RE: [SURBL-Discuss] another new TLD?
by Chris Santerre 27 Aug '04

27 Aug '04

getin.to file.to surf.to all reported spams the past few days. >-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Thursday, August 26, 2004 4:47 PM >To: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] another new TLD? > > >on Thu, Aug 26, 2004 at 04:39:21PM -0400, Chris Santerre wrote: >> File.to >> >> from >> http://File.to/ooo >> >> OK to add as well? Looks like spammers are trying to get >around the standard >> com, net, info , biz. > >Not new at all. That's Togo, who sold rights to their NIC and which TLD >we often saw in redirection services (e.g., 'http://surf.to') >back in the >mid-nineties. > >Didn't someone post a complete list of TLDs here just recently? > >-- >hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/ _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

3 3

another new TLD?
by Chris Santerre 26 Aug '04

26 Aug '04

File.to from http://File.to/ooo OK to add as well? Looks like spammers are trying to get around the standard com, net, info , biz. --Chris

3 2

SpamCop URI Compilation
by Robin, Rob 26 Aug '04

26 Aug '04

All, My company has the policy of not throwing away default build from the OS install. Therefore, all my perl libs have been compiled under /usr/local/blah/blah without doing UNINST=1. After downloading all the necessary modules, etc, I am close to getting Spamcop URI compile. Details: Perl 5.005_03, SpamAssassin 2.63. perl ./Makefile.PL went through fine. Problem w/ it is extract_url.t test script. PERL5LIB="/usr/local/spamassassin/2.63/lib: /usr/local/perl5lib/HTML/Parser/3.26/lib: /usr/local/perl5lib/File/Spec/0.82/lib:/usr/local/perl5lib/URI/1.31/lib /usr/local/perl5lib/Test/Simple/0.47/lib /usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker /usr/local/perl5lib/podlators/1.27/lib /usr/local/perl5lib/Pod/Parser/1.28/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22" Export PERL5LIB The reason why I called the test script directly is because "make test" put my PERL5LIB directories as a less preferred lib and thus loaded older version of other libs that failed. I needed to circumvent by calling the test script directly. All the test scripts passed, except extract_urls.t. I defined "/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib" as part of PERL5LIB, since I know that SpamCopURI.pm is located at /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin/SpamCopURI.pm. Perl -V confirms that everything is defined properly. From the error message, could it be my perl version is too old ? Please note that all other test scripts went through just fine. bash-2.02# perl ./t/extract_urls.t 1..23 Undefined subroutine &Mail::SpamAssassin::SpamCopURI::_extract_urls called at ./t/extract_urls.t line 46. # Looks like your test died before it could output anything. Any input will be appreciated. #Perl -V (output). I verify that all the dir for my PERL5LIB existed just fine. Characteristics of this binary (from libperl): Built under bsdos Compiled at Oct 8 2000 21:58:54 %ENV: PERL5LIB="/usr/local/spamassassin/current/lib:/usr/local/perl5lib/HTML/Parser/current/lib:/usr/local/perl5lib/File/Spec/current/lib:/usr/local/perl5lib/URI/current/lib:/usr/local/perl5lib/Test/Simple/current/lib:/usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker:/usr/local/perl5lib/podlators/current/lib:/usr/local/perl5lib/Pod/Parser/current/lib:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22" @INC: /usr/local/spamassassin/current/lib /usr/local/perl5lib/HTML/Parser/current/lib /usr/local/perl5lib/File/Spec/current/lib /usr/local/perl5lib/URI/current/lib /usr/local/perl5lib/Test/Simple/current/lib /usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker /usr/local/perl5lib/podlators/current/lib /usr/local/perl5lib/Pod/Parser/current/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22 /usr/libdata/perl5/5.00503/i386-bsdos /usr/libdata/perl5/5.00503 /usr/libdata/perl5/site_perl/i386-bsdos /usr/libdata/perl5/site_perl /usr/libdata/perl5/site_perl/i386-bsdos/include . Thanks, ------------------------ Rob Robin Network Analyst Green Apple, Inc. 740-653-9890 rrobin(a)greenapple.com www.greenapple.com Internet access, hosting and development solutions since 1995.

2 1

RE: [SURBL-Discuss] Strange happenings...
by Chris Santerre 26 Aug '04

26 Aug '04

Older Steve submission. Yup same file. And I can see why these guys would have been added. Looks like spammers were using a spacer.gif image from them in theis spams. Hence lots of NANAS hits. This was before we looked for posion like this. Removed. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, August 18, 2004 9:52 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Strange happenings... > > >On Wednesday, August 18, 2004, 6:17:26 PM, Bill Landry wrote: > >> Replying to my own post. I see now that the URI above gets >redirected to: > >> >http://qspace.iplace.MUNGEDcom/cobrands/41/?sc=1452NLCRamp;&CM= MHHNewsletterServices&CE=TextArea3 > >> and "iplace.com" is listed in WS. So my next questions is, should >> "iplace.com" be listed in WS? > >Probably not. Anyone know if these guys are spammers or why it's >on WS? > >Name: icreditreport.com >Address: 205.180.159.210 >Aliases: qspace.iplace.com > >If this appeared in a legitimate message, then we probably should >whitelist. Was it in a ham? > >Comments? > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

3 2

New tld?
by Chris Santerre 26 Aug '04

26 Aug '04

I've never seen this TLD??? www.sdlkjfdd.it.tt Can I add to surbl? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

4 3

RE: [SURBL-Discuss] WS FP greenfieldonline.com
by Chris Santerre 26 Aug '04

26 Aug '04

http://media.greenfieldonline.com/images/sample/greenrtop.jpg http://media.greenfieldonline.com/images/sample/first600.jpg "Free chances to win cash and prizes by filling surveys ------------------------------------------------------ $$$ (added 11/6/2000) Free Sweepstakes GreenfieldOnline.com is a survey-based site that wants your input on consumer products and services. Register for free to fill out their surveys and you could win any of their great cash and prize giveaways. http://www.bonustree.com/freebies/greenfield.html " http://signup.greenfieldonline.com/welcome.asp?wm=3823 And after all that... I actually feel like they are legit. Go figure! remove, no whitelist. (RNW - new term?) +1 RNW --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, August 26, 2004 4:52 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] WS FP greenfieldonline.com > > >WS folks, please consider removing greenfieldonline.com > >Looks white hat. > >Jeff C. >__ > >From: Jeff Chan >To: "Bill Landry" >Date: Thursday, August 26, 2004, 1:07:10 AM >Subject: WS FP? > >===8<==============Original message text=============== >On Thursday, August 26, 2004, 12:19:32 AM, Bill Landry wrote: >> Jeff, I am sending this directly to you since the list will >not deliver HTML >> e-mail attachments. Anyway, here is another MSN newsletter >with a redirect >> to greenfieldonline.MUNGEDcom that is listed in WS. The >actual link can be >> found under "Hot Offers" near the top right side of the >e-mail: "Win $2,500 >> cash for a vacation" > >> Thoughts on this one? > >> Bill > >Hi Bill, >They look legitimate to me so I whitelisted greenfieldonline.com > >Do you mind if I forward this to the discussion list? It can >be better to do these publically. > >Including the newsletter could be done as a text paste of the >raw message, but in this case it's probably not necessary. > >Jeff C. >-- >Jeff Chan >mailto:jeffc@surbl.org >http://www.surbl.org/ > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

WS FP greenfieldonline.com
by Jeff Chan 26 Aug '04

26 Aug '04

WS folks, please consider removing greenfieldonline.com Looks white hat. Jeff C. __ From: Jeff Chan To: "Bill Landry" Date: Thursday, August 26, 2004, 1:07:10 AM Subject: WS FP? ===8<==============Original message text=============== On Thursday, August 26, 2004, 12:19:32 AM, Bill Landry wrote: > Jeff, I am sending this directly to you since the list will not deliver HTML > e-mail attachments. Anyway, here is another MSN newsletter with a redirect > to greenfieldonline.MUNGEDcom that is listed in WS. The actual link can be > found under "Hot Offers" near the top right side of the e-mail: "Win $2,500 > cash for a vacation" > Thoughts on this one? > Bill Hi Bill, They look legitimate to me so I whitelisted greenfieldonline.com Do you mind if I forward this to the discussion list? It can be better to do these publically. Including the newsletter could be done as a text paste of the raw message, but in this case it's probably not necessary. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

RE: [SURBL-Discuss] Need help classifying a domain, solis2.365med ia.com
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, August 25, 2004 2:52 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Need help classifying a domain, >solis2.365media.com > > >On Wednesday, August 25, 2004, 7:51:13 AM, Chris Santerre wrote: >> Here is a link from a pure spam! No doubt in my mind it is >spam. However I'm >> not sure if the domain has legit purposes. > >> http://solis2.365media.com/galepublishing/AWDD/public/signin.asp > >365media.com was registered in 1998 and is in the U.S. >Chances are that they would probably not have survived >this long if they were a spam gang. > >To me a "pure spam" comes from a zombie and points to >a site at a spam-friendly ISP in China, Korea or Brazil. 1/2 ;-) > After further investigation, I have to go run over the head of marketing with my sports car. *sigh* it isn't a spam domain at all. An ISP in asia is blocking our company as a spammer :) IT would be funnier if a few of our vendors were not on that ISP :/ --Chris

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss August 2004