Discuss September 2004

discuss@lists.surbl.org

62 participants
229 discussions

RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Chris Santerre 28 Sep '04

28 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, September 27, 2004 8:18 PM >To: Frank Ellermann >Cc: discuss(a)lists.surbl.org >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to >suesingle4y ou.net > > >On Monday, September 27, 2004, 5:12:16 PM, Frank Ellermann wrote: >> Jeff Chan wrote: > >>> "A. Add domains that appear only in spam. Do not add any >>> domains that appear in ham." > >> As an absolute rule that won't work, because the criminal >> spammer talks with his rogue registrar in "ham". > >I don't consider spammer's messages to be ham. Only ham from >legitimate people (non-spammers) is ordinary ham. > >Jeff C. >-- >"If it appears in hams, then don't list it." > Oh yeah single4you.net is realy legit.... and I'm the queen of England. Their site is back up, with personal ads that show picts of people. Too bad one of the pics is snoop dog, and another is Conan the Barbarian!! The only basis we still have is this guys word that he is legit. Are we going to whitelist everyone who simply asks to be whitelisted? Yes or No? --Chris

4 3

RFC: SURBL inclusion policy
by Jeff Chan 28 Sep '04

28 Sep '04

In order to assist people hand-classifying spam URI domains and IPs for inclusion or non-inclusion in SURBLs, I've made a draft policy document: http://www.surbl.org/policy.html Please read it and post your comments. Jeff C. -- "If it appears in hams, then don't list it."

6 38

SA 3.0/URIDNSBL Install Problems
by Alden Levy 27 Sep '04

27 Sep '04

Hi. While installing SA3.0 yesterday, I *think* I had a problem with URIDNSBL. I cannot get URIDNSBL to run unless I put the following in a cf file: loadplugin Mail::SpamAssassin::Plugin::URIDNSBL I originally had it in my /etc/mail/spamassassin/local.cf, but I figure it's better where I have it now. Is it advisable to load this plugin elsewhere? If so, where? I am running RH 7.3, MS 4.33.3, Perl 5.6.1 with ClamAV (Mail::ClamAV v 0.11). The relevant (I believe) output of spamassassin -D --lint is: <snip> debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC debug: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) implements 'parse_config' debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks <snip> debug: ---- MIME PARSER END ---- debug: metadata: X-Spam-Relays-Trusted: debug: metadata: X-Spam-Relays-Untrusted: debug: decoding: no encoding detected debug: Loading languages file... debug: Language possibly: en,sco debug: metadata: X-Languages: en sco debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) implements 'parsed_metadata' debug: is Net::DNS::Resolver available? yes debug: Net::DNS version: 0.48 debug: trying (3) intel.com... debug: looking up NS for 'intel.com' debug: NS lookup of intel.com succeeded => Dns available (set dns_available to hardcode) debug: is DNS available? 1 debug: URIDNSBL: domains to query: debug: Running tests for priority: 0 debug: running header regexp tests; score so far=0 debug: registering glue method for check_uridnsbl (Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454)) debug: all '*From' addrs: ignore(a)compiling.spamassassin.taint.org debug: all '*To' addrs: debug: running body-text per-line regexp tests; score so far=-3.174 debug: running uri tests; score so far=-3.174 Razor is working, Bayes is working and SURBL does work, I'm just wondering if this is optimal, or if I just got lucky. BTW, URIDNSBL.pm is in /usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Plugin/ Any help would be appreciated. Thanks, Alden

2 1

RE: [SURBL-Discuss] SA 3.0/URIDNSBL Install Problems
by Chris Santerre 27 Sep '04

27 Sep '04

>-----Original Message----- >From: Alden Levy [mailto:alden@engineno9inc.com] >Sent: Monday, September 27, 2004 4:01 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] SA 3.0/URIDNSBL Install Problems > > >Hi. > >While installing SA3.0 yesterday, I *think* I had a problem >with URIDNSBL. >I cannot get URIDNSBL to run unless I put the following in a cf file: >loadplugin Mail::SpamAssassin::Plugin::URIDNSBL > >I originally had it in my /etc/mail/spamassassin/local.cf, but >I figure it's >better where I have it now. > >Is it advisable to load this plugin elsewhere? If so, where? > >I am running RH 7.3, MS 4.33.3, Perl 5.6.1 with ClamAV (Mail::ClamAV v >0.11). > >The relevant (I believe) output of spamassassin -D --lint is: ><snip> >debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC >debug: plugin: registered >Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) >debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) *snip* This "inhibited further callbacks" is exactly what I am getting now. However I haven't changed over the running spamc is still 2.4 for now. I want to solve this problem first. Make sure you have all the prerequesits installed. They are listed int he INSTALL file. I'm doing this tomorrow. If not, I'm wondering if this has to do with my firewall not letting it out or something. Haven't got a chance to dig any further, and that is just a theory. Also how did you get the output captured from the lint?? I tried all the obvious things but it won't redir the output!!! --Chris

2 1

RE: [SURBL-Discuss] RFC: SURBL inclusion policy
by Chris Santerre 27 Sep '04

27 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, September 27, 2004 4:37 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] RFC: SURBL inclusion policy > > >On Friday, September 24, 2004, 9:35:14 PM, Jeff Chan wrote: >> OK I Updated the policy page, taking Ryan's top rules and general >> organizational comments: > >> http://www.surbl.org/policy.html > >> Please let me/us know what you think of it now. > >Does anyone else have any comments on the updated policy >page for adding new records to manual SURBL lists? It >includes changes thanks to comments from Frank, Ryan, >Joe and others. > >Please reply if you have anything to add or change. > The content is good. Somethings I would change the order of importance, but that is a personal preference. So I say go ahead with it. Are you really not even going to mention UC at all? I know you don't agree with it, but at least letting people know about it to make their own decisions would help. --Chris

1 0

RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Chris Santerre 27 Sep '04

27 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, September 27, 2004 11:06 AM >To: SURBL Discuss >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to >suesingle4y ou.net > > >On Monday, September 27, 2004, 7:53:41 AM, Chris Santerre wrote: >> But the fact that this brand new domain, not even a month >old, sent spam, >> and has been removed because it POTENTIALY might be used in >ham worries me >> beyond belief for this project. > >> I need more then, "He might be used for legitin the future." >as a reason to >> remove a blatant spam fool like this. > >This guy is a tiny flea on the rump of the stampeding herd >of mad bulls who are the real spammers. Whatever he's doing >is insignificant compared to the spam gangs. > Sounds exactly like Drug Enforcment. "Lets go after the bug guys, and not worry about the small guy we caught." Big Guy arrested, small guy takes his place. Where do you think the bigger guys come from, the stork? Hell this guy could be in one of those "Make money from home" scams. And you know what, he will go tell his buddies it ain't worth it because he was blacklisted days after he started. --Chris (Riple in the water.....) --Chris

1 0

RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to sue single4 yet
by Chris Santerre 27 Sep '04

27 Sep '04

>-----Original Message----- >From: Ryan Thompson [mailto:ryan@sasknow.com] >Sent: Monday, September 27, 2004 10:53 AM >To: SURBL Discussion list >Subject: RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to sue >single4yet > > >Chris Santerre wrote to 'Jeff Chan' and 'SURBL Discussion list': > >>> Thanks Joe. Hopefully he's learned his lesson. >> >> What the hell?? I just read this whole thread! I would not have taken >> this guy off! No way in hell!!!!! Ray, add this yahoo to UC please! > >Well, first off, you probably meant "Ryan". Second, single4you.net has >been in UC for for days already. :-) > >> The domain is brand new, sends spam, and screams about >getting listed! >> How the hell can he be legit! Did you guys read the NANAS listings >> that showed his wonderful emails? >> >> These are just the ones reported. He 'purchased' a list. So none of >> these were opt in. > >Agreed! Don't forget the temporal aspect of SURBL. It *was* a spammer >domain, but that doesn't mean it still *is* a spammer domain. > >> This is not the last we will hear of this guy. I think taking him off >> is a mistake. And IF he does it again, I'll report his a$$ to every >> RBL I can find, simply because you guys removed this idiot. > >Well, I'm not worried about it at all, because if he has really cleaned >up his act, we won't hear from him again. Otherwise, if I get confirmed >fresh spam for single4you.net, I'll happily spend the 3 >seconds it takes >to re-list, as I'm sure would many people who have read this >thread. ;-) >I'll be watching my daily GetURI runs very, very closely. :-) > >> --Chris (Jaded, fed up, and tired of the BS.) > >Even while following this thread yesterday, I whitelisted 45 domains, >and listed 24 new ones, from a ~6 hour corpus. I'm not going to let a >little bit of BS about *one* measly domain ruin my fun. > >I know, I had to damn near swallow my own tongue before I recommended >de-listing them, but, the point is, if we aren't responsive to the odd >site possibly changing their act, SURBL (and even UC) will be useless. > >- Ryan > Yup, sorry about that. After I sent it I realized I meant you :) I'm still having fun, and I know it seems that Jeff and I don't get along, but we do. Our differences are good for the lists. If you have had more correspondence with this spammer that leads you to this decision, then I trust you have reasons for removing then. --Chris

1 0

RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Chris Santerre 27 Sep '04

27 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, September 27, 2004 10:34 AM >To: SURBL Discuss >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to >suesingle4y ou.net > > >On Monday, September 27, 2004, 7:25:40 AM, Chris Santerre wrote: >> The domain is brand new, sends spam, and screams about >getting listed! How >> the hell can he be legit! Did you guys read the NANAS >listings that showed >> his wonderful emails? > >> These are just the ones reported. He 'purchased' a list. So >none of these >> were opt in. > >And are those the only emails that ever have or ever will mention >the domain? How can you say that of ANY domain we have listed????????? >Do we know that the domain has no legitimate uses or >users? If not should we block all legitimate messages that do >mention the domain? Or any legit message talking about any domain we have listed already?? > >These are difficult questions which we attempted to answer. > >It's much easier to list them, but is that fair to people >who actually use or mention the site in hams? > Show me one freaking legit ham from him!! Where the hell do we draw the line??? I can literaly argue that ANY, and I mean ANY of the domains we have listed have the potential to be used in ham. But the fact that this brand new domain, not even a month old, sent spam, and has been removed because it POTENTIALY might be used in ham worries me beyond belief for this project. I need more then, "He might be used for legitin the future." as a reason to remove a blatant spam fool like this. You're obviously not going to add him back in. So I'm going to wath this guy closer then his proctologist! I'll be all over this guy in every way. When he trips up, I will be there. I be he is relisted in under 3 months. Am I pissed he got removed, yes. Am I pissed at Jeff, no. He is still my schmoopie! :-) Do I think Jeff might have fallen on his head this weekend........ ....it crossed my mind ;) --Chris

2 2

Re: [SURBL-Announce] ANNOUNCE: ccTLDs in two-level-tlds file updated somewhat
by Leonardo Helman 27 Sep '04

27 Sep '04

Hi, don't forget: esc.edu.ar (elementary schools, high schools and other (non-universitary educational institutions). uba.ar (Buenos Aires University) educ.ar There was a thread on this list started by Mariano Absatz on Fri, 18 Jun 2004 10:41:30 On Sun, Sep 26, 2004 at 09:22:23PM -0700, Jeff Chan wrote: > On Saturday, September 18, 2004, 11:58:56 PM, Frank Ellermann wrote: > > [Konqueror list] > >>> | name,ai,au,bd,bh,ck,eg,et,fk,il,in,kh,kr,mk,mt,na, > >>> | np,nz,pg,pk,qa,sa,sb,sg,sv,ua,ug,uk,uy,vn,za,zw > > I have updated the ccTLDs for the ones Frank mentioned, > removed some duplicates, and added some data for a few > other ccTLDs. The results are in: > > http://spamcheck.freeapp.net/two-level-tlds > > Really this is just for completeness since geographic > domains other than .us aren't used in spams too often. > > Jeff C. > -- > "If it appears in hams, then don't list it." > > _______________________________________________ > Announce mailing list > Announce(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/announce

1 0

FP on WS & DS
by Bill Landry 27 Sep '04

27 Sep '04

vault. com is listed on WS & DS. Bill

3 8

← Newer
1
2
3
4
5
6
7
8
...
23
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss September 2004