Discuss April 2007

discuss@lists.surbl.org

7 participants
8 discussions

Re: [SURBL-Discuss] webfusion.co.uk
by Rob McEwen 28 Apr '07

28 Apr '07

Phil, I removed it from SURBL. (it may take a few minutes to propogate) BTW - in the future, please sent any such requests to "whitelist <AT> surbl.org" Thanks for your help! Rob McEwen PowerView Systems rob(a)PowerViewSystems.com -----Original message----- From: "Phil $Medway Hosting$" phil(a)medwayhosting.com Date: Sat, 28 Apr 2007 08:31:00 -0400 To: "SURBL Discussion" discuss(a)lists.surbl.org Subject: [SURBL-Discuss] webfusion.co.uk Hi there I was just wondering about the … [View More]

1 0

webfusion.co.uk
by Phil (Medway Hosting) 28 Apr '07

28 Apr '07

Hi there I was just wondering about the listing of webfusion.co.uk on SC and OB. webfusion.co.uk are a rather large hosting company and their domain name appears on most emails sent out by 123-reg.co.uk who are one of the largest UK domain registrars. This listing is causing domain renewal notices etc to be rejected. I have now whitelisted them locally, but I was wondering if they really ARE spamming or is this an FP? Many thanks Phil _____________________________________________ Website … [View More]

1 0

FUN: Help Rob McEwen test his new anti-spam tools!
by Rob McEwen 27 Apr '07

27 Apr '07

FUN PROJECT: Help Rob McEwen test his new anti-spam tools! (NOTE: I have been granted official permission from Jeff Chan to make this announcement on the SURBL list!) As many already know... I'm one of a **small** handful of organizations with authority to blacklist and whitelist "at will" on SURBL and I've provided much administrative assistance to SURBL for years, particularly in preventing false positives. Of course, my efforts there are miniscule compared to Jeff Chan's great work! Still,… [View More] Jeff has thanked me countless times for my assistance. Most importantly, I have an "insider's view" and **uncommon expertise** into what it takes to make a "world class" blacklist and, within the next few business days, I will be officially releasing my 2 new "Invaluement Spam Blocklists": (1) The "Invaluement-URI" blocklist (much like SURBL & URIBL) ..AND.. (2) The "Invaluement-SIP" blocklist, a Sender's IP blocklist (a.k.a. an "RBL", like DSBL, SBL, etc.). SIP = "Sender's IP" Proverbs 15:22 says, "Without counsel plans fail, but with many advisers they succeed." NOT that these two lists will be built by committee... but, along these lines, I sure could use some feedback! You may be asking: --WHY SHOULD WE USE THESE LISTS? --HOW ARE THEY HELPFUL? --WHAT ARE THESE? First, if you are already using SURBL & URIBL, continue to do so! Invaluement-URI will NOT replace SURBL & URIBL as those lists WILL catch things that Invaluement-URI will miss or not catch as quickly. However... ************************************** REGARDING: "Invaluement-URI" blocklist ************************************** (A) The "Invaluement-URI" blocklist is catching over 1,000 URIs (per week) minutes, hours, and even days BEFORE surbl or uribl or even uribl-red! Did you catch that? Let me repeat: ****Invaluement-URI is listing over 1,000 URIs (per week) minutes, hours, and even days BEFORE surbl or uribl or even uribl-red!**** (If a URI showed up on ANY 1 of these lists, I didn't count it towards that tally. I ONLY counted items which were not on ANY of those other lists!) Q: Why? How? A: Mostly because Invaluement-URI is a "fast reacting" list! Often even faster than URIBL-RED!! Q: Why is this important? A: Because many new series of spams are listed on Invaluement-URI lightening fast and this will help you block much spam that would otherwise pass through your spam filtering during those minutes/hours BEFORE the URI is listed on SURBL or URIBL. (B) The "False Positive Rate" for Invaluement-URI is extremely low -- and might even be better than SURBL's already very low FP rate! I have yet to spot a single egregious FP... and the **few** that I have spotted (and removed) were VERY questionable to begin with! NOTE: Being aggressive and fast is easy... but doing such **without** the FPs is incredibly difficult. Years of programming and analysis went into the development of these two lists! (C) Additionally, Invaluement-URI is catching many URIs, particularly phishes, that **might** NEVER be getting in SURBL or URIBL... or at least that seems to be the case as several days have gone by without them being listed. NOTE: You might ask, "Rob, why haven't **you** placed these into SURBL or requested them be listed in URIBL?" The answer is simple. In recent weeks, finishing touches on these new lists have consumed most of my time and energies. But I do plan to use this knowledge/data to do more submissions to SURBL & URIBL. However, even then, for various reasons, such submissions will have to be "hand-submitted" and "hand-checked". Therefore, Invaluement-URI will STILL haVE the "upper hand" in being a fast-reaction list. ************************************** REGARDING: "Invaluement-SIP" blocklist ************************************** I find that many Sender's IP blocklists (a.k.a. "RBLs"): (1) tend to catch much spam without FPs, but also seem to have diminishing returns... sort of an upper limit in their effectiveness... a "glass ceiling" ...OR... (2) block much legit mail and/or very credible sources... or even purposely "punish" sources of legit mail for those ISP's/ESP's who are lacking in their prevention of spams sent from their network. So you are "stuck" with one type of Sender's IP blocklist being helpful, but very limited... and the other type too aggressive to be used, requiring that you "score" it very, very low in your filtering to prevent FPs... thus minimizing its effectiveness! IN CONTRAST... you'll find Invaluement-SIP to be a "best of both worlds" Sender's IP Blocklist. It is as aggressive and "fast reacting" as many of the best... listing MANY IPs that are not yet on other RBLs... but NOT having the high FP rate found on many other "aggressive" IP blacklists. ************************** REGARDING: BOTH blocklists ************************** LOW MEMORY FOOTPRINT: While both are "quick reacting"... both are also "quick expire time" lists. If a spam hasn't been seen containing that URI or from that Sender's IP for more than a few weeks, it gets expired and removed. This keeps the "memory footprint" very low... and this opens up multiple possibilities... like possible use in spam appliances or even routers which otherwise couldn't efficiently work with lists that have almost a million or more entries... many of which are so outdated that they include items practically never seen "in the wild" anymore. Additionally, this smaller "footprint" also allows for fast data transfers / updates. These lists are ONLY available via RSYNC or BIND "zone transfers". But because the dataset is so relatively small, the updates are (and can be!) more frequent... allowing my "quick strike" capabilities to help you in your "real time" spam filtering. Amazingly I provide **2 minute update frequency** for RSYNC access and 4 minute expire time on zone transfers! (Compare this to some blacklists which take longer than this just to get to complete a single transfer!) QUALITY AND DISCERNMENT: Both lists have an amazing ability to block the very dirty ESPs which are more "pretenders" who are trying to "look" like legit ESPs, but haven't really ever sent to a true confirmed opt-in subscriber. Yet, at the same time, both Invaluement lists are very good at NOT targeting ESPs know to have sent **some** amount of legit opt-in e-mail. In other words, e-mail admins probably won't have to use that sledgehammer as often if they would employ this "surgeon's scalpel". Additionally, **spammers beware** messages are kept "on file" as "evidence" for EVERY SINGLE LISTING. In the event of a suspicious listing being questions by the sender, the intended recipients WILL be contacted to confirm or deny that they opted in! Also, MUCH behind the scenes auditing takes place to ensure quality! *********************************** PRICE: What are the fees for usage? *********************************** First, these lists are NOT for free. The are available ONLY via RSYNC or BIND Zone Transfer. The price ranges from $12.50/month to $605/month, depending on such things as # of users being protected, willingness to allow us to list you as a subscriber, linking to our website, etc. I expect that most subscribers will pay either the lowest price, or close to the lowest price. The higher prices are more for exotic users and VERY large ISPs or filtering providers. One price procures access to BOTH Invaluement-SIP **and** Invaluement-URI. ALSO: No anonymous usage allowed. Payments will be via paypal... but the basic contact information provided at the time of signup must be legit and authentic. **************************** WEEKEND PROJECT INSTRUCTIONS **************************** For the next 2-4 days, I'll provide FREE access to these lists. Send me an e-mail with the following: (1) Name & contact information, including phone number & e-mail address, company, etc. (2) Tell me the approximate number of mailboxes/users that your use of this product will protect if/when you decide to officially subscribe. (3) Let me know if you need RSYNC access, or Bind Zone Access, or both (4) Include the IP address that I should grant permission for the access type specified. *************************************** STEEP DISCOUNTS IN RETURN FOR TESTING!! *************************************** The first 10 people who post a thoughtful and detailed analysis of the results of their testing went will get a special discount if/when they decide to subscribe. The post must be to either the SpamAssassin list or the SPAM-L list. Please refrain from further posts on the URIBL & SURBL lists as I have permission to make this announcement there... but NOT to discuss this in depth there since those lists are NOT for general spam fighting techniques/tools. The first 10 people who spot an egregious FP will get this same discount. Sent the (munged) URI to my address along with the message it was spotted in zipped. SPECIAL DISCOUNT: If you protect less than 100,000 users/boxes, you'll get the first 6 months at $1/month. If you protect more than 100,000 users, you'll get the first 6 months at half the regular price (which would first be calculated depending on other options chosen, THEN the ADDITIONAL discount applied. Testing access will be cut off soon after the product is "officially" released... but these discounts will STILL be obtainable (to be applied to subsequent months) until the 10 & 10 spots have filled up. *************************** HOW TO JUDGE/TEST THIS DATA *************************** Simple. (1) Does using these lists cause your filtering to block MORE spams than it otherwise would if you didn't use this list. (2) Does it do with WITHOUT causing FPs... or is the FP rate low compared to other such lists. IMPORTANT: Testing must be done on "live" data and using constantly synced datalists. Otherwise, you diminish many of the most important the advantages that set this list apart from others. You can "score" the "hits" low on live data if you want to test it in a "safe" way. Try to devise a system where you can examine what both of these lists "hit" on that got overall missed by your spam filter. Running the lists against recent corpuses will only work for spotting FPs... but, even then, be sure it wasn't really a "False Negative"! Remember, if you are blocking 96% of all spam and use of these two lists improves your catch rate to 97%... a one percent reduction might not seem like a lot... but the key percentage is the drop in the spam that your users SEE!! Therefore, if the amount of spam which gets past your filter through drops from 4% down to 3%, this is a whopping 25% reduction in the amount of spam that your users see. That is huge! If someone did that for you, what would you do in return? You'd hug them... take them out to dinner... thank them profusely. I contend that these "Invaluement blacklists" will be "on par" with those kind of results and you'll find the fees to be low compared to what you are getting in return. *************** GETTING STARTED *************** Contact me, Rob McEwen, today and I'll provide you the access information. For access, send the requested information to the following: invaluement(a)PowerViewSystems.com (PLEASE - keep discussion about this on the SURBL list to an absolute minimum. SA and SPAM-L are more appropriate. Or e-mail me directly.) Rob McEwen PowerView Systems invaluement(a)PowerViewSystems.com [View Less]

1 0

Re: [Uribl-discuss] Fw: Requesting Your Permission or "Why Mardev and Outward Media should be RBL Listed"
by Kevin A. McGrail 19 Apr '07

19 Apr '07

> When the legislation was first passed we did support opt out for B2B, > small business who for the first time can trade with big business on an > equal footing would have been slaughtered. > > We fully anticipate however that opt in legislation is on the cards and > have adopted that policy from day one. Do you not understand that these two statements are mutually exclusive? How can you possibly promote the legal changes for opt-out and then claim a policy of opt-in … [View More]

1 0

Re: [Uribl-discuss] Fw: Requesting Your Permission or "Why Mardev and Outward Media should be RBL Listed"
by Kevin A. McGrail 19 Apr '07

19 Apr '07

> We collect 100% of our emails by opt in and document every permission. > And, if you had read anything I have written you would know that I > recommend that all other companies follow this policy and go beyond the > legislation. > > We do no mass broadcasting. A typical communication would be an email to a > farmer who has told us that he has pigs, receiving a notification about a > swine flu inoculation. Really? While this might be a personal position, the … [View More]

1 0

btassets.co.uk
by Phil (Medway Hosting) 19 Apr '07

19 Apr '07

Hi folks Could someone from surbl kindly give me an idea of what the problem is with btassets.co.uk please ? I am currently having a major row with them, but have actually achieved getting their Chairman's Dept interested - mainly because I have told them the abuse I am seeing will be chargeable at £50 +vat per email and they have already attempted to deliver 250 !! Any info would be useful. Many thanks Phil _____________________________________________ Website Hosting from only £5.00 … [View More]

3 3

Fw: Requesting Your Permission
by Kevin A. McGrail 19 Apr '07

19 Apr '07

HITN ConfirmationBelow is an email I received, purportedly on behalf of Avis from a company called Outward Media. Does anyone know if this is a legit firm? To me it looks potentially legit but that Avis has given the marketing duties to a questionable firm. For example, I haven't used the email address below in close to 4 years! Anyone ever heard of csmarketingmail.com or Outward Media? They claim to be CAN-SPAM compliant but, as written before, this isn't a legal issue as much as a consent … [View More]

2 1

Re: Strange blacklisting
by Jeff Chan 16 Apr '07

16 Apr '07

On Sunday, April 15, 2007, 6:22:58 PM, AshtonWood AshtonWood wrote: > Hi there, > It has come to our attention that our domain securestix.com may have ended > up on a "Blacklist" of yours recently. > This may have been from our most recent once-only mail out to a list > supplied by the organisers of a trade show we recently exhibited at. > We've checked all of your lists in surbl.org, but cant find out domain in > there, yet the messages we are receiving indicate that … [View More]

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss April 2007