Discuss

discuss@lists.surbl.org

1 participants
1864 discussions

squid?
by Robert Brooks 18 Jun '04

18 Jun '04

I couldn't find any way of using a dns blacklist such as sc.surbl.org as a squid acl, has anyone done this? -- Robert Brooks, Network Manager, Cable & Wireless UK <robb(a)hyperlink-interactive.co.uk> http://hyperlink-interactive.co.uk/ Tel: +44 (0)20 7339 8600 Fax: +44 (0)20 7339 8601 - Help Microsoft stamp out piracy. Give Linux to a friend today! -

3 2

proxypots
by jm＠jmason.org 17 Jun '04

17 Jun '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jeff Chan writes: >We are also looking into some other potential spam >URI data sources such as proxypots, etc.: > > http://proxypot.org/ Jeff -- a quick note on this; it has to be done very carefully. Many spammers are using "link poisoning" stuff like this: Get ov<A href="http://www.gimbel.org"></A>er 300 medicatlons online shlpp<A href="http://www.omniscient.com"></A>ed over<A href="http://www.proton.net"></A>nig<A href="http://www.cravet.org"></A>ht to your fr<A href="http://www.aristotelean.org"></A>ont do<A href="http://www.barnacle.com"></A>or with no pr<A href="http://www.lordosis.net"></A>escrlption. All of those are "www.{RANDOMWORD}.{com|net|org}". Eventually there's one real link, which *is* SURBL-listed. These are chaff. Now, SORBS for one seems to be listing some of these sites; presumably because they have a spamtrap-driven feed without enough human moderation. That's the danger here. (btw, there's arguments to be made that a better selection mechanism can "weed those out", but that needs to be careful too. - - Ignore .org/.net/.com? spammer will use .biz, .info, and ccTLDs. - - Ignore 0-length links (<a href=...></a>)? spammer will change to use <a href=...>{RANDOMWORD}</a>. - - Ignore "dictionary words" somehow? spammer will use random URLs from google, so "real" sites. so I don't think those approaches have much merit alone.) - --j. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Exmh CVS iD8DBQFA0JPeQTcbUG5Y7woRAnYYAJ9/fZaT3WLmU+gT8aAnT2rcduDo7QCg6BE1 dF1r9ciWtFpEdC4OBHdRSKE= =mnKX -----END PGP SIGNATURE-----

6 6

Local RBL list?
by Jeff Taylor 17 Jun '04

17 Jun '04

I haven't been able to find this covered anywhere, but I would like to use both the spamcop list (which has been working pretty well) and a local URI blacklist in which to put my own domains that I have problems with. Since I find it hard to believe I am the only one wanting to do this, I can only assume I must have missed the how-to somewhere along the way. Can anyone lend a hand, or provide some links on how I can add in my own list?

5 5

Somewhat away from email for a while
by Jeff Chan 17 Jun '04

17 Jun '04

I will be somewhat away from email for a few days. May be able to check in on and off. My hosting company knows how to reach me at support at supranet.net if there are any emergencies. Jeff C.

1 0

Re: Where do I read about surbl/SA v3.x?
by Jeff Chan 16 Jun '04

16 Jun '04

On Wednesday, June 16, 2004, 11:51:45 AM, Lucas Albers wrote: > Bill Landry said: >> We receives about 200,000 e-mail messages per day, split between two > mail >> gateways, and have had no resource issues with using the additional > redirect >> options with spamcop_uri. You can find info on how to setup and support > the >> redirect options in the "rules/spamcop_uri.cf" file of the spamcopuri > tarball. > Jeff, > How bout changing the default surbl in 2.63 in the next release, > so redirector support is enabled. > It appears to not have any signifigant effect on performance, as per this > email. This is a suggestion for Erik Kolve, who is the author of SpamCopURI. SURBLs themselves are only the data side of things. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

double checking
by Chris Santerre 16 Jun '04

16 Jun '04

If I add this emailfactory.co.uk it will add the whole thing right? Not co.uk Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

[SURBL-Discuss] multi.surbl.org combined list available for development
by Jeff Chan 16 Jun '04

16 Jun '04

I've set up a bitmasked, combined SURBL list with sc, ws, and ph data: multi.surbl.org as described earlier, except that the TXT message is customized to each entry in the list rather than generic, for example: areyoureallysatisfied.biz 600 IN A 127.0.0.6 600 IN TXT "Blocked, areyoureallysatisfied.biz on sc, ws lists, See: http://www.surbl.org/lists.html" aridanti.com 21600 IN A 127.0.0.4 21600 IN TXT "Blocked, aridanti.com on ws lists, See: http://www.surbl.org/lists.html" citi-protection.info 600 IN A 127.0.0.14 600 IN TXT "Blocked, citi-protection.info on sc, ws, ph lists, See: http://www.surbl.org/lists.html" cmbcag.biz 600 IN A 127.0.0.2 600 IN TXT "Blocked, cmbcag.biz on sc lists, See: http://www.surbl.org/lists.html" The description of multi on the Lists page has been updated to reflect this beta version of the list: http://www.surbl.org/lists.html#multi Currently this zone is served only on my name server. There is no need for any name servers to carry this zone yet since there probably won't be code to use it for a while. Hopefully it can be useful to the developers though. Once the code is written to use the combined list, we will need to get the zone out to all the name servers. I have not finished modifying my rbldnsd zone file creation script, so there is only a BIND version currently. I hope there's still some time to get support for this into the SA 3.0.0 release. The data is live, and inclusion in the combined list and other parameters are all governed from control files, so they're easy to change, for example to add future lists. Please send me any feedback, including about the proposed wording of the TXT message. Cheers, Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

4 8

Re: Anti-phishing on SURBL
by Jeff Chan 16 Jun '04

16 Jun '04

On Tuesday, June 15, 2004, 8:51:40 AM, Smart,Dan Smart,Dan wrote: > What ever happened to the Anti-phishing rules on surbl. Never saw any > domain come forward on this. Hi Dan, The anti-phishing data is in the combined list multi.surbl.org. Because this is bitmasked data, as described on our lists page: http://www.surbl.org/lists.html#multi ... some code needs to be written to decode the results. Hopefully the SA coders will perhaps get a chance to get support for this into the 3.0.0 release. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 2

SURBL works well on envelope sender
by Daniel Quinlan 16 Jun '04

16 Jun '04

Here's a test on my last 4 days of ham and spam. The T_DNS_FROM* rules are using the envelope sender (that is, the MAIL FROM added by my MTA to the message headers). They have a reasonably good hit rate (6.43% of spam hit one of tested SURBL zones) and a 0% FP rate in this test. Only 7 out of 103 of those did not hit one of the URIBL rules, but they did do it with zero FPs (I get FPs mostly because people discuss spam domains in some of the ham tested here. That's another issue, though.) Maybe it would be worthwhile factoring this into future development. That is, also list known spammer envelope senders domains, maybe get SpamCop to provide lists for that too, I suspect there's some overlap in the other direction as well. OVERALL% SPAM% HAM% S/O RANK SCORE NAME 2598 1602 996 0.617 0.00 0.00 (all messages) 100.000 61.6628 38.3372 0.617 0.00 0.00 (all messages as %) 3.580 5.8052 0.0000 1.000 1.00 0.01 T_DNS_FROM_SURBL_WS 0.885 1.4357 0.0000 1.000 0.67 0.01 T_DNS_FROM_SURBL_SC 9.161 14.5443 0.5020 0.967 0.56 1.00 URIBL_BE_SURBL 36.066 57.5531 1.5060 0.974 0.44 1.00 URIBL_WS_SURBL 0.423 0.6866 0.0000 1.000 0.33 0.01 T_DNS_FROM_SURBL_BE 29.908 47.5655 1.5060 0.969 0.11 1.00 URIBL_SC_SURBL How's the multi roll-out going? It would definitely be handy for this test (the code to support it already exists). Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

2 1

Where do I read about surbl/SA v3.x?
by Chuck Campbell 16 Jun '04

16 Jun '04

I've seen tons of email on this list about surbl and uribl, but I haven't really made sense of it yet. Is ther a FAQ on this stuff for SA users? Does it deal with performance issues? thanks, -chuck

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss