Discuss April 2005

discuss@lists.surbl.org

48 participants
112 discussions

RE: [SURBL-Discuss] xs.surbl.org preliminary results
by Owen, Daniel 22 Apr '05

22 Apr '05

Correction I just realized that these numbers are slightly skewed. I drop any e-mail that SA scores above a 20.9 . So all of the numbers should probably be slightly higher. As far as FPs go I don't see FPs being affected at all. I just wanted to add the note in since it means that the XS rules may have a higher strike percentage than this indicates. I'm considering letting everything come through tagged without dropping anything for a 24 hour period just to see what the real one day numbers are. Beyond this testing it would be helpful for me just to see how much mail I really am blocking. If I decide to do that it'll be sometime mid next week. -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Owen, Daniel Sent: Friday, April 22, 2005 11:56 AM To: SURBL Discussion list; Jeff Chan Subject: RE: [SURBL-Discuss] xs.surbl.org preliminary results More stats. I'll continue to do these internally but unless something interesting comes up I probably won't post stats on a daily basis unless someone wants to see them. 4/21/05 total e-mails: 9059 total strikes: 1226 (13.5% of total e-mail) spam strikes: 1225 ham strikes: 1 (see details below) total messages marked as spam (all rules): 6917 (76.4% of total e-mail) total messages marked as spam (all rules) also marked by XS: 1187 also in: URIBL_AB_SURBL: 244 URIBL_OB_SURBL: 956 URIBL_PH_SURBL: 0 URIBL_SC_SURBL: 872 URIBL_WS_SURBL: 1008 URIBL_JP_SURBL: 1077 NOT in any one of the above: 107 (.087% of total XS strikes) The false positive: This was a mailing list posting. The sender was sending through input-MUNGE.com which has a standard disclaimer that includes input-MUNGED.com. Looking at news.admin.net-abuse.sightings I see several reports of advanced-inputMUNGED.com. Could that be it? I also see 3 that appear to have numerous garbage URLs included but they are 2003 and 2004 so they should not be the issue. Anyway. It's the first false positive I have seen using the XS list. URIBL_WS_SURBL also hits this one. This email contains privileged and confidential information intended only for the use of the person to whom it is directed and intended. Any reproduction, dissemination or other use of this email by anyone who is not the intended recipient is strictly prohibited. If you have received this email in error, you should advise the sender immediately and delete the email from your mail box. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: [SURBL-Discuss] xs.surbl.org preliminary results
by Owen, Daniel 22 Apr '05

22 Apr '05

More stats. I'll continue to do these internally but unless something interesting comes up I probably won't post stats on a daily basis unless someone wants to see them. 4/21/05 total e-mails: 9059 total strikes: 1226 (13.5% of total e-mail) spam strikes: 1225 ham strikes: 1 (see details below) total messages marked as spam (all rules): 6917 (76.4% of total e-mail) total messages marked as spam (all rules) also marked by XS: 1187 also in: URIBL_AB_SURBL: 244 URIBL_OB_SURBL: 956 URIBL_PH_SURBL: 0 URIBL_SC_SURBL: 872 URIBL_WS_SURBL: 1008 URIBL_JP_SURBL: 1077 NOT in any one of the above: 107 (.087% of total XS strikes) The false positive: This was a mailing list posting. The sender was sending through input-MUNGE.com which has a standard disclaimer that includes input-MUNGED.com. Looking at news.admin.net-abuse.sightings I see several reports of advanced-inputMUNGED.com. Could that be it? I also see 3 that appear to have numerous garbage URLs included but they are 2003 and 2004 so they should not be the issue. Anyway. It's the first false positive I have seen using the XS list. URIBL_WS_SURBL also hits this one. This email contains privileged and confidential information intended only for the use of the person to whom it is directed and intended. Any reproduction, dissemination or other use of this email by anyone who is not the intended recipient is strictly prohibited. If you have received this email in error, you should advise the sender immediately and delete the email from your mail box.

1 0

RE: [SURBL-Discuss] RE: Research wanted: age of spam gang URI dom ains
by Chris Santerre 22 Apr '05

22 Apr '05

Agreed John. What I saw was patterns, and the dates of the domains involved in the patterns corelated. It wasn't anything worth tagging off of, but an interesting bit of data none the less. When you get what appears to be 3 different spammers, with spam runs within days of each other, all using domains that have connections in their data...it gets the mind a wondering :) --Chris >-----Original Message----- >From: John_Delisle(a)ceridian.ca [mailto:John_Delisle@ceridian.ca] >Sent: Friday, April 22, 2005 10:27 AM >To: SURBL Discussion list >Cc: discuss-bounces(a)lists.surbl.org; SURBL Discuss; SpamAssassin Users >Subject: Re: [SURBL-Discuss] RE: Research wanted: age of spam gang URI >domains > > >Even if data re average age of the domains, wouldn't they just start >registering them earlier so as to not match that pattern? > >John Delisle, CISA >Senior Network Analyst, Network and Security Team >Information Systems & Technology Management Dept. >Ceridian Canada Ltd >600 - 125 Garry St >Winnipeg, MB >R3C 3P2 >204-975-5909 > > > > >Chris Santerre <csanterre(a)MerchantsOverseas.com> >Sent by: discuss-bounces(a)lists.surbl.org >04/22/2005 08:05 AM >Please respond to >SURBL Discussion list <discuss(a)lists.surbl.org> > > >To >"'Jeff Chan'" <jeffc(a)surbl.org>, SURBL Discuss ><discuss(a)lists.surbl.org>, >SpamAssassin Users <users(a)spamassassin.apache.org> >cc > >Subject >[SURBL-Discuss] RE: Research wanted: age of spam gang URI domains > > > > > > > > >>-----Original Message----- >>From: Jeff Chan [mailto:jeffc@surbl.org] >>Sent: Thursday, April 21, 2005 7:46 PM >>To: SURBL Discuss; SpamAssassin Users >>Subject: Research wanted: age of spam gang URI domains >> >> >>Does anyone have research or references for the age profiles of >>domains appearing in the URIs of spam gang (i.e. Ralsky, Lindsay, >>Richter, etc.) spams? In other words, how old are the domains of >>sites being spamvertised *by spam gangs*? (By age I mean how >>long ago they were (most recently) created.) >> >>Jeff C. > >Off the top of my nogging, I've seen the major guys be about >1-3 days from >registering. > >However...... > >I also saw a pattern a few spammers using ones registered 3 >months prior. >This is when I began to theorise that there was possibly a spam domain >service. Someone simply registering domain names full time, >then selling >them out to other spammers. I started researching the idea, >then got busy >on >other stuff. > >When things settle I'll try to pick back up on the research. >Sorry I don't >have any hard data for you. > >--Chris >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Testing: xs.surbl.org (CBL Data)
by Alex Broens 22 Apr '05

22 Apr '05

Guys, Jeff's little XtraSmall (CBL Data) lust, ehhhmm, list seems to be catching quite a bit of trash. give it a try: urirhsbl URIBL_XS_SURBL xs.surbl.org. A 2 body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL URL listed in XS SURBL - TEsting tflags URIBL_XS_SURBL net score URIBL_XS_SURBL 1.5 Score to your taste !!!!! Pretty sure Jeff is anxious to get FP reports. h2h Alex -- // no grey data here - its pi11z .-) //

6 8

Re: Discuss Digest, Vol 13, Issue 27
by Robert Menschel 22 Apr '05

22 Apr '05

> Message: 2 > Date: Thu, 21 Apr 2005 08:42:39 -0700 > From: "Bret Miller" <bret.miller(a)wcg.org> > Subject: [SURBL-Discuss] RE: missed URI redirector > To: "SURBL Discussion list" <discuss(a)lists.surbl.org> > Message-ID: <2fca43fc9d365a479a389643a1dbd138(a)mail.wcg.org> > Content-Type: text/plain; charset="us-ascii" >> just got this in a spam >> >> <A href="h >> t >> tp:/ >> /r.lycos.com/r/vn_swditarrx_csmqempf/http://cympgebdnrMUNGED.o >> rg&aeglnl0 >> oepml18w32zd6%2Ezin >> ciccg >> cag%2Ecom/"> >> <IMG >> SRC="cid:qlysaynv_milhjoua_qtobefxh" border="0" ALT=""></A> > Actually, I've been getting tons of spam with this lycos redirector over > the last week. Sure wish they'd close it down or we'd find a way to > parse redirector URIs for the real URI. FWIW, I've added the Lycos and ZDNet redirectors to the 70_sare_uri1.cf file I maintain with SARE. We'll have a mass-check of them in the next few days to determine a reasonable score, and hopefully publish early next week. Bob Menschel

1 0

missed URI redirector
by Matthew Wilson 22 Apr '05

22 Apr '05

just got this in a spam <A href="h t tp:/ /r.lycos.com/r/vn_swditarrx_csmqempf/http://cympgebdnrMUNGED.org&aeglnl0 oepml18w32zd6%2Ezin ciccg cag%2Ecom/"> <IMG SRC="cid:qlysaynv_milhjoua_qtobefxh" border="0" ALT=""></A>

4 3

Research wanted: age of spam gang URI domains
by Jeff Chan 22 Apr '05

22 Apr '05

Does anyone have research or references for the age profiles of domains appearing in the URIs of spam gang (i.e. Ralsky, Lindsay, Richter, etc.) spams? In other words, how old are the domains of sites being spamvertised *by spam gangs*? (By age I mean how long ago they were (most recently) created.) Jeff C. -- "If it appears in hams, then don't list it."

1 0

RE: [SURBL-Discuss] xs.surbl.org preliminary results
by Owen, Daniel 21 Apr '05

21 Apr '05

This is a different data set. 4/20/05 midnight to midnight CDT total e-mails: 6477 total strikes: 1513 (23.4% of total e-mail) spam strikes: 1513 ham strikes: 0 total messages marked as spam (all rules): 4210 (65% of total e-mail) total messages marked as spam (all rules) also marked by XS: 1478 also in: URIBL_AB_SURBL: 447 (29.5% of XS hits) URIBL_OB_SURBL: 1120 (74% of XS hits) URIBL_PH_SURBL: 0 URIBL_SC_SURBL: 1160 (76.7% of XS hits) URIBL_WS_SURBL: 1124 (74.3% of XS hits) URIBL_JP_SURBL: 1416 (93.6% of XS hits) NOT in any of the above: 61 (.041% of XS hits) Hey if it proves to be fairly FP proof that's 61 less emails I have to deliver per day after I raise the score a bit) -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Raymond Dijkxhoorn Sent: Thursday, April 21, 2005 2:23 PM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] xs.surbl.org preliminary results Hi! > total strikes: 204 > spam strikes: 204 > ham strikes: 0 > > total messages marked as spam (all rules): 1495 > total messages marked as spam (all rules) also marked by XS: 204 Would be interesting to check if those would have been picked up by (for example) JP, eg other SURBL lists. If its duplicates all over then it wont help much. I did a compare on the zonefiles but not that much fresh ones inside. So far.... Bye, Raymond. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss This email contains privileged and confidential information intended only for the use of the person to whom it is directed and intended. Any reproduction, dissemination or other use of this email by anyone who is not the intended recipient is strictly prohibited. If you have received this email in error, you should advise the sender immediately and delete the email from your mail box.

1 0

Re: [SURBL-Discuss] missed URI redirector
by List Mail User 21 Apr '05

21 Apr '05

zinciccgcag. com is part of the multitrade group and their attempt to move into the US. The registration address is false (does not exist) - report them to both wdprs and rfci. Also the name servers in ccpatoncejk. biz have a false postal code (and probably more) - also report to wdprs and rfci. For examples see: http://www.rfc-ignorant.org/tools/detail.php?domain=multitrade-corp.com&sub… and http://www.rfc-ignorant.org/tools/detail.php?domain=ddagraniale.com&submitt… Paul Shupak track(a)plectere.com

1 0

xs.surbl.org preliminary results
by Owen, Daniel 21 Apr '05

21 Apr '05

2 sets of hit rates follow. I'll try to find time to send my results on a daily basis as long as the info is useful. As you will see from the message volume this is a fairly small office. All messages are from the Internet. In other words no internal e-mail traffic is counted in any of these numbers. I am using the XS as a 1.5 point spam assassin rule in production so it may have pushed some of these over the top. My cutoff score of 5.8. For the numbers that follow I hand sorted anything that had less than 10 SA points. I rarely ever see a false positives so I'm fairly certain of these numbers. We are very sensitive to false positives so we run a pretty conservative rule base, but I do have some hand crafted rules that have high values that can push a message's spam score through the roof. The difference in strike rate between days is interesting but it's not the same time period. For the future I'll hit the same time period each day even if that means skipping the most recent data. That should show trending better. Of course it could be something else entirely pushing the first set of numbers up. Only time will tell. Set 1: time range 4/19/05 18:22 to 4/20/05 15:19 central time 4514 total e-mails spam strikes: 1783 ham strikes: 0 Set 2: time range 4/20/05 15:20 to 4/21/05 9:57 central time 2027 total e-mails total strikes: 204 spam strikes: 204 ham strikes: 0 total messages marked as spam (all rules): 1495 total messages marked as spam (all rules) also marked by XS: 204 Daniel This email contains privileged and confidential information intended only for the use of the person to whom it is directed and intended. Any reproduction, dissemination or other use of this email by anyone who is not the intended recipient is strictly prohibited. If you have received this email in error, you should advise the sender immediately and delete the email from your mail box.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss April 2005