Discuss September 2004

discuss@lists.surbl.org

62 participants
229 discussions

Re: [SURBL-Announce] ANNOUNCE: New JP list is now part of multi.surbl.org
by Mariano Absatz 30 Sep '04

30 Sep '04

On Mon, 27 Sep 2004 16:24:00 -0700, Jeff Chan <jeffc(a)surbl.org> wrote: > JP is now active as part of multi. Please give it a try. We > think you'll like the results. :-) > __ > > http://www.surbl.org/quickstart.html > > jp - jwSpamSpy + Prolocation data source > > Joe Wein's jwSpamSpy program is used both by Joe's own systems > and also Raymond Dijkxhoorn and his colleagues at Prolocation to > process more than 300,000 likely spams per day. The resulting > list has a very good spam detection rate around 80% and a very > low false positive rate below 0.02%. This data is only available > in the combined list multi.surbl.org. > > An SA 2.63 and 2.64 rule and score using SpamCopURI 0.22 or later > looks like this: > > uri JP_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0+64') > describe JP_URI_RBL URI's domain appears in JP at http://www.surbl.org/lists.html > tflags JP_URI_RBL net > > score JP_URI_RBL 4.0 > > An SA 3.0 rule and score using URIBL's urirhssub looks like this: > > urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 > header URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') > describe URIBL_JP_SURBL Contains a URL listed in JP at http://www.surbl.org/lists.html > tflags URIBL_JP_SURBL net > > score URIBL_JP_SURBL 4.0 > __ > > Note that JP is not available as a separate list, only as part of > multi.surbl.org. Use it with urirhssub or SpamCopURI 0.22 as > described above. Please see the lists document mentioned in the > description for more information about JP. > If I understand this right, ws still has jp data, even within multi, is it? That is, if I want to score the rest of ws at 1.3 and jp at 4.0, I should set jp's score at 2.7, right? -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com

2 1

RE: [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Tim A 29 Sep '04

29 Sep '04

Are there a SURBL clan in JO?? Where do I find them :) > -----Original Message----- > From: Chris Santerre <csanterre(a)merchantsoverseas.com> > Date: Tue, 28 Sep 2004 10:04:43 -0400 > Subject: RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to > suesingle4y ou.net > To: Jeff Chan <jeffc(a)surbl.org>, SURBL Discussion list <discuss(a)lists.surbl.org> > > > > >-----Original Message----- > >From: Jeff Chan [mailto:jeffc@surbl.org] > >Sent: Tuesday, September 28, 2004 9:45 AM > >To: SURBL Discuss > >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to > >suesingle4y ou.net > > > > > >On Tuesday, September 28, 2004, 6:43:09 AM, Chris Santerre wrote: > >> The only basis we still have is this guys word that he is > >legit. Are we > >> going to whitelist everyone who simply asks to be > >whitelisted? Yes or No? > > > >No. > > Oh, now your taking the fun out of arguing with you ;) > > Did you break your JO cd? DOn't see ya playing much. > > --Chris (I need cover fire on the bridge!!!) > > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] Help classify quickinspirations.com
by Chris Santerre 29 Sep '04

29 Sep '04

>-----Original Message----- >From: Patrik Nilsson [mailto:patrik@patrik.com] >Sent: Wednesday, September 29, 2004 3:59 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Help classify quickinspirations.com > > >At 15:11 2004-09-29 -0400, Chris Santerre wrote: >>quickinspirations.com >>Thoughts on this guy? 48 NANAS hits. Listed in dnsbl.njabl.org > >As well as in: >http://spews.org/html/S1436.html > >>Didn't we already classify this? > >I can find a whitelisting email from Jeff, but not the original >whitelisting request. Seems to be lost in my archives. > >>I wonder if we can get a crossref lookup of >>the global whitelist, so we can see what has already been whitelisted. >> >>I belive this is a spammer in sheeps clothing. But it fools >people into >>signing up for a stupid inspiration newsletter. But the >subjects of the >>newsletter are stuff like: >>Subject: Get a Credit Report Instantly! >>Then a inspiration quote, then a big ad. I think we may see >more of this in >>the future. >>I think it is a UC candidate. Do we have enough listed in UC >for testing >>yet? > >I think it's a surbl candidate. >Why was it whitelisted? >Any actual examples of it showing up in real ham, rather than only in >"fooled into signing up for" spam? > Did you just create a new term? "Fisuf Spam" Works for me! I think I had a "discussion" about this domain with Jeff before. Which is why I rang a bell. I think this may be one of the ones that started the whole UC debate. Hmmm.... could more Fisuf Spam be around the corner? --Chris

1 0

Re: [SURBL-Discuss] Help classify quickinspirations.com
by Patrik Nilsson 29 Sep '04

29 Sep '04

At 15:11 2004-09-29 -0400, Chris Santerre wrote: >quickinspirations.com >Thoughts on this guy? 48 NANAS hits. Listed in dnsbl.njabl.org As well as in: http://spews.org/html/S1436.html >Didn't we already classify this? I can find a whitelisting email from Jeff, but not the original whitelisting request. Seems to be lost in my archives. >I wonder if we can get a crossref lookup of >the global whitelist, so we can see what has already been whitelisted. > >I belive this is a spammer in sheeps clothing. But it fools people into >signing up for a stupid inspiration newsletter. But the subjects of the >newsletter are stuff like: >Subject: Get a Credit Report Instantly! >Then a inspiration quote, then a big ad. I think we may see more of this in >the future. >I think it is a UC candidate. Do we have enough listed in UC for testing >yet? I think it's a surbl candidate. Why was it whitelisted? Any actual examples of it showing up in real ham, rather than only in "fooled into signing up for" spam? Patrik

1 0

Re: [SURBL-Announce] ANNOUNCE: ccTLDs in two-level-tlds file updated somewhat
by Leonardo Helman 29 Sep '04

29 Sep '04

Hi, don't forget: gov.ar (government) mil.ar (armed forces) edu.ar (universities and university-related research groups) esc.edu.ar (elementary schools, high schools and other (non-universitary educational institutions). uba.ar (Buenos Aires University) educ.ar There was a thread on this list started by Mariano Absatz on Fri, 18 Jun 2004 10:41:30 On Sun, Sep 26, 2004 at 09:22:23PM -0700, Jeff Chan wrote: > On Saturday, September 18, 2004, 11:58:56 PM, Frank Ellermann wrote: > > [Konqueror list] > >>> | name,ai,au,bd,bh,ck,eg,et,fk,il,in,kh,kr,mk,mt,na, > >>> | np,nz,pg,pk,qa,sa,sb,sg,sv,ua,ug,uk,uy,vn,za,zw > > I have updated the ccTLDs for the ones Frank mentioned, > removed some duplicates, and added some data for a few > other ccTLDs. The results are in: > > http://spamcheck.freeapp.net/two-level-tlds > > Really this is just for completeness since geographic > domains other than .us aren't used in spams too often. > > Jeff C. > -- > "If it appears in hams, then don't list it." > > _______________________________________________ > Announce mailing list > Announce(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/announce

4 5

RE: [SURBL-Discuss] FP in OB g4techtv .com
by Chris Santerre 29 Sep '04

29 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, September 29, 2004 11:09 AM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] FP in OB g4techtv .com > > >On Wednesday, September 29, 2004, 7:58:16 AM, Chris Santerre wrote: >> 2.0 URIBL_OB_SURBL Contains an URL listed in the OB >SURBL blocklist >> [URIs: g4techtv .com] > >> Ahhhhhhh my game news!!!!!! > >> --Chris > >I heard they spam... ;-) > >Whitelist them with documentation. > But it is on OB list, I thought I could only whitelist for WS? --Chris "If it appears in spam, do not whitelist."

3 2

RE: [SURBL-Discuss] FP in OB g4techtv .com
by Chris Santerre 29 Sep '04

29 Sep '04

>-----Original Message----- >From: Fred [mailto:tech2@i-is.com] >Sent: Wednesday, September 29, 2004 1:35 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] FP in OB g4techtv .com > > >Jeff Chan wrote: >> I heard they spam... ;-) >> >> Whitelist them with documentation. >> >> Jeff C. > >They were bought by Comcast and we know how much they care about spam.. >Maybe things have changed recently, in the past we were being >attacked by a >different customer daily. > >I want LEO back and I'm still mad at TechTV for taking off the >shows they >did. I say keep them listed ;) > > >If they bring back Leo then we can whitelist them :) I grew >up watching Leo >teach people about computers now I do it myself, but I still miss him! > I agree! X-Play seems lost. Sweat and Players are stupid shows. Bring back Leo!! --Chris (Burnout 3 is hurting my thumbs!)

1 0

FP in OB g4techtv .com
by Chris Santerre 29 Sep '04

29 Sep '04

2.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist [URIs: g4techtv .com] Ahhhhhhh my game news!!!!!! --Chris

3 2

ignore
by Doc Schneider 29 Sep '04

29 Sep '04

Just a test... I got a bounce back from this on my last post. -Doc

1 0

RE: Why such a low score?
by Chris Santerre 29 Sep '04

29 Sep '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Wednesday, September 29, 2004 11:10 AM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail); Spamassassin-Talk (E-mail) >Subject: Re: Why such a low score? > > >Chris, > >> What was the reason WS got such a low score in SA 3.0??? .5 >is a joke! Hell >> BigEvil was scored a 3 and now one complained, and it is the >same data!! I >> don't understand. Did the mass check not go well? > >We pointed this out several times, the mass checker found way too many >FP's and so SA decided to score it lower. Its 'our own' >problem, we have >to get out those FP's. The scoring is done with SA 3.1 again, >so lets try >to do better there... > >And yes, i am disappointed also with this very low scoring, >personally i >have raised it via my local.cf. > I am as well. I wonder when they did the testing. We have changed so much of WS to reduce FPs. And with the rates reported now, you can see why I was stunned to see this score. (I do vaguley remember a post from Theo or DQ about this.) I'd love to know what a new GA run would say about this now. --Chris

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss September 2004