Got some more FPs from someone who wanted to be anonymous.
These are on WS:
Date: Saturday, August 21, 2004, 12:37:45 PM
Subject: fps
bridgetrack.com (used by nytimes.com)
elabs.com (EASTERN LABORATORIES INC.)
mfcreative.com (ancestry.com/myfamily.com/rootsweb.com, Genealogy ad)
secureserver.net (in message containing godaddy.com)
dnews.com (Moscow-Pullman Daily News)
spinpalace.com (appeared in xe.com currency update mailing list)
I'd like some help deciding on these, though they look legtimate
to me.
We may need to develop a more formal procedure for handling FP
reports.... Any suggestions or implementations would be
welcomed. Maybe something like a trouble ticket system would
be useful.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Can I get some research help in deciding which of the
following FPs to whitelist?
> Date: Sat, 21 Aug 2004 10:06:57 -0400
> From: John Lundin <lundin(a)cavtel.net>
> To: SURBL Discussion list <discuss(a)lists.surbl.org>
> Subject: [SURBL-Discuss] more possible FPs (2 OB, 4 WS and 2 DS)
> Eight possible FPs. These were taken from items reported as non-spam.
> The "nanas" number is raw matches on the domain from google groups.
> Use your own judgement...
>
> OB: www.mercenariesthegameMUNGED.com (nanas 0)
> mentioned in a lucasarts review
>
> OB: www.jmiequityMUNGED.com (nanas 0)
> mentioned in a Dow Jones newsletter
> The original wasn't caught by OB, but it shows up now.
>
> WS: Wireless.VentureReporterMUNGED.net (nanas 9) A stock newsletter.
> I checked back: it really had been subscribed to.
>
> WS: nmailerMUNGED.com (nanas 36) Design center newsletter.
> http://ellington.nmailerMUNGED.com/mailman/listinfo/dtgnews
>
> WS: www.imakenewsMUNGED.com (nanas 42) organization newsletter.
> http://www.imakenewsMUNGED.com/cabf/ (+ cleaned user tracking)
> imakenews makes me nervous... intrusive html.
>
> WS: ntcrMUNGED.us (nanas 43, some similar) Jupitermedia Web Events.
> (origin of mailing list -- appearance in unsubscribe disclaimer)
> (Site won't display for me, insufficiently motivated to find out why
> it said "Your Web browser must have cookies enabled" regardless.)
(DS hits ignored)
> Date: Saturday, August 21, 2004, 12:37:45 PM
> Subject: fps
>
> bridgetrack.com (used by nytimes.com)
> elabs.com (EASTERN LABORATORIES INC.)
> mfcreative.com (ancestry.com/myfamily.com/rootsweb.com, Genealogy ad)
> secureserver.net (in message containing godaddy.com)
> dnews.com (Moscow-Pullman Daily News)
>
> spinpalace.com (appeared in xe.com currency update mailing list)
Jeff C.
Several of our customers subscribe to a newsletter from www.golfonline.com.
This last one contained a link to www.bullysports.com, which is listed on
WS. Seems like a legit site, so I just wanted to pass it by all of you to
see if it should be whitelisted and/or removed from WS.
Bill
I would REMOVE spinpalace only. Do not whitelist. Place on watch list. I
agree with your other whitelists.
>-----Original Message-----
>From: Jeff Chan [mailto:jeffc@surbl.org]
>Sent: Monday, August 23, 2004 4:53 AM
>To: SURBL Discuss
>Cc: postmaster(a)outblaze.com
>Subject: Re: [SURBL-Discuss] FP help please
>
>
>On Sunday, August 22, 2004, 10:18:03 PM, Jeff Chan wrote:
>> Can I get some research help in deciding which of the
>> following FPs to whitelist?
>
>OK I did some of my own research and whitelisted most of
>these:
>
>>> Date: Sat, 21 Aug 2004 10:06:57 -0400
>>> From: John Lundin <lundin(a)cavtel.net>
>>> To: SURBL Discussion list <discuss(a)lists.surbl.org>
>>> Subject: [SURBL-Discuss] more possible FPs (2 OB, 4 WS and 2 DS)
>
>>> Eight possible FPs. These were taken from items reported as
>non-spam.
>>> The "nanas" number is raw matches on the domain from google groups.
>>> Use your own judgement...
>>>
>>> OB: www.mercenariesthegameMUNGED.com (nanas 0)
>>> mentioned in a lucasarts review
>
>Apparently a LucasArts game. Lucas are probably not
>spammers. Whitelisting:
>
>thx.com
>lucasfilm.com
>lucasarts.com
>mercenariesthegame.com
>
>>> OB: www.jmiequityMUNGED.com (nanas 0)
>>> mentioned in a Dow Jones newsletter
>>> The original wasn't caught by OB, but it shows up now.
>
>A stock fund of an investment company whose original domain
>was registered in 1995. Probably not spammers. Whitelisting:
>
>jmi-inc.com
>jmiequity.com
>
>>> WS: Wireless.VentureReporterMUNGED.net (nanas 9) A stock newsletter.
>>> I checked back: it really had been subscribed to.
>
>Belongs to Dow Jones. Unlikely to be spammers. Whitelisting:
>
>dowjones.com
>siliconalleydaily.com
>venturereporter.net
>
>>> WS: nmailerMUNGED.com (nanas 36) Design center newsletter.
>>> http://ellington.nmailerMUNGED.com/mailman/listinfo/dtgnews
>
>Belongs to graphics design folks with a 1995 domain registration.
>Whitelisting:
>
>graphic-design.com
>graphic-design.net
>nmailer.com
>
>>> WS: www.imakenewsMUNGED.com (nanas 42) organization newsletter.
>>> http://www.imakenewsMUNGED.com/cabf/ (+ cleaned user tracking)
>>> imakenews makes me nervous... intrusive html.
>
>Whitelisting; 1999 registration:
>
>imakenews.com
>
>>> WS: ntcrMUNGED.us (nanas 43, some similar) Jupitermedia Web Events.
>>> (origin of mailing list -- appearance in unsubscribe disclaimer)
>>> (Site won't display for me, insufficiently motivated to
>find out why
>>> it said "Your Web browser must have cookies enabled" regardless.)
>
>Belongs to netcreations.com. Are they a spamhaus?
>
>
>> DS: surveyhelp.harrispollonlineMUNGED.com (nanas 19)
>> http://www.harrispollonlineMUNGED.com/sweeps.asp
>> (sigh) yes, they subscribed to it.
>
>Legitimate pollsters. Whitelisting:
>
>harrisinteractive.com
>harrispollonline.com
>
>> DS: www.winxpnewsMUNGED.com (nanas 42)
>> http://www.winxpnewsMUNGED.com/issues.cfm
>> Single reference in a tech newsletter...
>
>Looks like a legitimate tech newsletter. Whitelisting:
>
>winxpnews.com
>
>
>
>The next domains were in WS:
>
>>> Date: Saturday, August 21, 2004, 12:37:45 PM
>>> Subject: fps
>>>
>>> bridgetrack.com (used by nytimes.com)
>
>Looks like a legitimate web tracking operation. Whitelisting:
>
>planninggroup.com
>bridgetrack.com
>
>Some of their tracking image URIs may have appeared in spams
>but it's probably from citi phishers copying them from real
>messages.
>
>Comments?
>
>>> elabs.com (EASTERN LABORATORIES INC.)
>
>1995 registration, whitelisting:
>
>elabs.com
>
>>> mfcreative.com (ancestry.com/myfamily.com/rootsweb.com,
>Genealogy ad)
>
>Looks legit. Whitelisting:
>
>myfamily.net
>myfamilyinc.com
>mfcreative.com
>
>>> secureserver.net (in message containing godaddy.com)
>
>Used by legitimate registrars like dotster and godaddy.
>Whitelisting:
>
>secureserver.net
>securepaynet.net
>
>>> dnews.com (Moscow-Pullman Daily News)
>
>Small local newspaper in Idaho. Probably not a major spammer.
>Whitelisting:
>
>dnews.com
>
>>> spinpalace.com (appeared in xe.com currency update mailing list)
>
>Online casino. Appears in marginally spammy places. Does anyone
>have any info about them?
>
>
>It would be nice to distribute some of the work of checking
>FPs in future.
>
>
>WS and OB folks may want to remove some of these ones from their
>respective lists, and/or share their research with us.
>
>Jeff C.
>
>_______________________________________________
>Discuss mailing list
>Discuss(a)lists.surbl.org
>http://lists.surbl.org/mailman/listinfo/discuss
>
Good afternoon, Paul,
On Mon, 23 Aug 2004, Paul Diaguila wrote:
> Speaking of SURBL..... Haven't had any complaints about spam since it's
> been installed.... thank you...thank you...thank you....
We're sincerely glad to hear that it helps.
Cheers,
- Bill
---------------------------------------------------------------------------
"Not only is UNIX dead, it's starting to smell bad."
-- Rob Pike (?)
(Courtesy of Mike Castle <dalgoda(a)ix.netcom.com>)
--------------------------------------------------------------------------
William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f,
rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org
--------------------------------------------------------------------------
After working through today's spam I was amused we (almost) only received
spam for 3 site's:
The following (some old) url's to these sites are still alive:
- : sublunary1132nx.com
- : ourpillsdirect.com
- : naturalwellnessessence.com
Naturally all domains were added to the prolocation rbl and the (low)spam
decreased within the hour :). But I was wondering .. a small test with a
simple 'diff' script showed me that comparing output from url's found in
'fresh' spam with known spam-sites is doable. These guys seem to be changing
domains every 8 hours or so...
Would it be bad to have some of these (stupid) 'static webpage hosting'
spammers automaticly being added to the WS list by comparing the output of
their home page advertised in the url?
It's fairly easy to create a script to do this ... that's not the issue....
what could go wrong ?.. any input would be appreciated :)
Secondly, while doing these tests I noticed that a lot of the sites listed
in (our) WS-list are not longer 'alive'. Is there any clean-up procedure
defined yet ?... or will the list just keep on growing ;)
bye,
Chris
Christiaan den Besten wrote to 'Ryan Thompson':
>> Mail::SpamAssassin::PerMsgStatus::get_uri_list($status), but there
>> were a few other incantations that I did to get the list of URIs
>> down. I have been meaning to publish the script, but things keep
>> getting in the way. I will do that tomorrow (today). Stay tuned!
>
> Check, I see its 03:xx over there ;) Just woke up here :)
It's released.
http://ry.ca/geturi/
> I have just looked at Justin's hints for a SA plugin, that seems very doable
> as well. I was just wondering if I could re-use the SA surbl-plugin while I
> am at it. For I am only interested in uri's not yet in WS.
>
> For my idea, what you do now:
> - strip uri's from messages
Yes. I also attempt to eliminate those with empty anchors.
> - for each (new) uri generate a NASAS query
NANAS query URLs (to Google Groups) are pre-built, but not automatically
queried, because that would violate Google TOS. (See the TODO section in
the documentation).
> - build a 'matrix' between uri's and messages they are referenced in.
More or less, a two-way hash.
> - score uri's for spamability :)
Yep. Technically, they're just scored for relevance in the message. It's
up to the person building the corpus to decide whether they're spammy or
not. :-)
- Ryan
--
Ryan Thompson <ryan(a)sasknow.com>
SaskNow Technologies - http://www.sasknow.com
901-1st Avenue North - Saskatoon, SK - S7K 1Y4
Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon
Toll-Free: 877-727-5669 (877-SASKNOW) North America
Back up now. I believe they changed domain registrars.
>-----Original Message-----
>From: Mailing List [mailto:ml@netgroupes.ca]
>Sent: Sunday, August 22, 2004 10:55 AM
>To: surbl(a)alexb.ch; SURBL Discussion list
>Subject: RE: [SURBL-Discuss] openrbl.org domain gone?
>
>
>>Can any of you reach http://openrbl.org ?????
>Also dead from Canada
>
>
>_______________________________________________
>Discuss mailing list
>Discuss(a)lists.surbl.org
>http://lists.surbl.org/mailman/listinfo/discuss
>
>-----Original Message-----
>From: Jeff Chan [mailto:jeffc@surbl.org]
>Sent: Sunday, August 22, 2004 3:13 AM
>To: SURBL Discuss
>Subject: Re: [SURBL-Discuss] Fwd: fps
>
>
>On Saturday, August 21, 2004, 11:08:06 PM, Doc Schneider wrote:
>>> On Saturday, August 21, 2004, 9:59:06 PM, Doc Schneider wrote:
>
>>>>I have run RT (Request Tracker) in fact still have it
>installed on one
>>>>of my servers.
>
>>>>Where would we like it to run at? I could re-set it up
>(need to upgrade
>>>>it here) and add you all to it.
>
>> I'm upgrading my old version as I type. Will let you all
>know where to
>> get to it. Maybe we could add a pointer to something like
>> something.surbl.org and point it to my rt site? I'll leave
>it to you all
>> to figure out the something.surbl.org 8*))
>
>> Once I have this upgraded I'll add Jeff and Bill to it for
>now. Then add
>> whoever else needs admin access.
>
>Sounds good. Whatever name folks think would be good is fine;
>maybe something short like track.surbl.org?
>
>Jeff C.
>
Track sounds good. But how will we be notified if something is added?
--Chris
Two more FPs in WS.
ientryMUNGEDmail.com
The domain is used for mailing list management by the ientry network,
we have several confirmed legit subscribers to their WebProNews,
newsletter.
siteproMUNGEDnews.com
Once again several confirmed subscribers, mainly web designers or
people who have used their submission services.
Bayes training fixes any problems at my end, or I could locally
whitelist, however they shouldn't be listed in WS :-) Both have valid
unsubscribe options.
Interesting reading comments about FPs over the last week. I think
because of the global ramifications of these lists we need to make
sure that spam is definately spam and borderline is excluded from
listings.
Otherwise the lists just become personal preferences of what we want
to see in our mailboxes!!
Regards,
Joseph