From csanterre@merchantsoverseas.com Thu Jul 8 21:17:38 2004 From: Chris Santerre To: discuss@lists.surbl.org Subject: [SURBL-Discuss] Submissions to SURBL list thru SARE website. Date: Thu, 08 Jul 2004 15:17:52 -0400 Message-ID: <620A4FF9B83DD511B69900062939D037ABFD0B@internal.merchantsoverseas.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8186580402888271073==" --===============8186580402888271073== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Good grief. Let me say this slowly.... SURBL is for domains in LINKS, URLS, websites, images, things you click on, images hosted in the email. SURBL is NOT, will never be used, doesn't care, /dev/null's, any domain or IP the email came from. Thanks, I feel better now. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin --===============8186580402888271073==-- From schampeo@hesketh.com Thu Jul 8 21:27:15 2004 From: Steven Champeon To: discuss@lists.surbl.org Subject: Re: [SURBL-Discuss] Submissions to SURBL list thru SARE website. Date: Thu, 08 Jul 2004 15:26:34 -0400 Message-ID: <20040708192634.GE27275@hesketh.com> In-Reply-To: <620A4FF9B83DD511B69900062939D037ABFD0B@internal.merchantsoverseas.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8412088804987236224==" --===============8412088804987236224== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable on Thu, Jul 08, 2004 at 03:17:52PM -0400, Chris Santerre wrote: > Good grief. Let me say this slowly.... >=20 > SURBL is for domains in LINKS, URLS, websites, images, things you click on, > images hosted in the email. >=20 > SURBL is NOT, will never be used, doesn't care, /dev/null's, any domain or > IP the email came from.=20 Well, I for one won't be sending any more domains along if I have to also distinguish between the domains I happened to find in email bodies from those I happened to find in message headers. Sorry. The overlap is far too great, as for example in a recent message I got (summarized): Received: from mx51.AfClawFrog1.us (mx51.afclawfrog1.us [216.162.182.51]) Subject: [Target-removed] Free Break-In & Fire Protection System Message-ID: [text part with a snippet of fictional text] [html part containing several links to=20 To: discuss@lists.surbl.org Subject: Re: [SURBL-Discuss] Submissions to SURBL list thru SARE website. Date: Thu, 08 Jul 2004 21:34:59 +0200 Message-ID: In-Reply-To: <20040708192634.GE27275@hesketh.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8844829307059232355==" --===============8844829307059232355== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Steven, > > SURBL is NOT, will never be used, doesn't care, /dev/null's, any domain or > > IP the email came from.=20 > Well, I for one won't be sending any more domains along if I have to > also distinguish between the domains I happened to find in email bodies > from those I happened to find in message headers. Sorry. The overlap is > far too great, as for example in a recent message I got (summarized): Its simple, thats ok. =3D) > Received: from mx51.AfClawFrog1.us (mx51.afclawfrog1.us [216.162.182.51]) > Subject: [Target-removed] Free Break-In & Fire Protection System > Message-ID: >=20 > [text part with a snippet of fictional text] >=20 > [html part containing several links to=20 >=20 > =20 > > Sorry, I don't have time to deal with the distinction. Because for me, for > the most part, there quite simply is no distinction. You should be rather picky what you submit, if you are not sure, dont=20 submit. It will harm the effectiveness and accuracy of the whole SURBL=20 idea if people (sorry, no offence) only do some script magic and submit=20 tons of domains. You see for example with the relatively small SC dataset a LOT of hits.=20 Its not the quantity but the quality that counts in a project like this. #1 26728 BAYES_99 #2 19956 HTML_MESSAGE #3 19723 RCVD_IN_SBL+XBL #4 19126 RCVD_IN_BL_SPAMCOP_NET #5 18141 WS_URI_RBL #6 17354 OUTBLAZE_URI_RBL #7 16352 RCVD_IN_SORBS #8 13000 SPAMCOP_URI_RBL #9 12988 RCVD_IN_DSBL #10 12717 MIME_HTML_ONLY #11 12660 ABUSEBUTLER_URI_RBL #12 10270 RCVD_IN_DYNABLOCK #13 7644 DNS_FROM_RFCI_ABUSE #14 7471 RCVD_IN_AHBL #15 6763 RCVD_IN_NJABL #16 6318 MIME_HTML_ONLY_MULTI #17 6274 MIME_HTML_NO_CHARSET #18 6064 CLICK_BELOW #19 5169 HTML_FONT_BIG #20 4776 MSGID_FROM_MTA_HEADER #21 4506 LOCAL_XMESSAGEINFO #22 4489 HTML_LINK_CLICK_HERE #23 4081 RCVD_IN_RFCI #24 3739 RCVD_IN_NJABL_PROXY #25 3614 HTML_60_70 #26 3360 6DOS_URI_RBL If you look at this data, 6DOS, has a list thats holding many more=20 entry's. Still SPAMCOP_URI_RBL is listing more hits.=20 Bye, Raymond. --===============8844829307059232355==-- From lindsay@pa.net Thu Jul 8 21:39:31 2004 From: Lindsay Snider To: discuss@lists.surbl.org Subject: Re: [SURBL-Discuss] Submissions to SURBL list thru SARE website. Date: Thu, 08 Jul 2004 15:39:21 -0400 Message-ID: <40EDA2E9.9090304@pa.net> In-Reply-To: <20040708192634.GE27275@hesketh.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1970940881387486782==" --===============1970940881387486782== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Steven Champeon wrote: > on Thu, Jul 08, 2004 at 03:17:52PM -0400, Chris Santerre wrote: >=20 >>Good grief. Let me say this slowly.... >> >>SURBL is for domains in LINKS, URLS, websites, images, things you click on, >>images hosted in the email. >> >>SURBL is NOT, will never be used, doesn't care, /dev/null's, any domain or >>IP the email came from.=20 >=20 >=20 > Well, I for one won't be sending any more domains along if I have to also > distinguish between the domains I happened to find in email bodies from > those I happened to find in message headers. Sorry. The overlap is far too > great, as for example in a recent message I got (summarized): >=20 > Received: from mx51.AfClawFrog1.us (mx51.afclawfrog1.us [216.162.182.51]) > Subject: [Target-removed] Free Break-In & Fire Protection System > Message-ID: >=20 > [text part with a snippet of fictional text] >=20 > [html part containing several links to=20 >=20 > =20 > ] >=20 > I ran a rDNS scan on the netblock and found another 40+ domains all of > the same type. As they are found in both the body and the message headers, > I want to be able to block all future mail rather than archiving it; which > I can do from sendmail. SURBL just lets me filter after acceptance. >=20 > Sorry, I don't have time to deal with the distinction. Because for me, for > the most part, there quite simply is no distinction. >=20 --===============1970940881387486782==--