Discuss

discuss@lists.surbl.org

1862 discussions

[SURBL-Discuss] IN the interest in a bigger SA score and fewer FPs.....
by Chris Santerre 31 Aug '04

31 Aug '04

I have removed a rather large group of domains from WS. Time and time again FPs came from this rather large set of data from July. Since we have improved our contributor methods and numbers, I decided to yank them. If they continue to spam, they would just be readded by us anyway. So you might see a slight decrease in file size. And a few more slipping thru we will have to add again. But this will reduce overall FPs. --Chris (Did you know you can get dominoes to deliver to a parking lot at 1 AM!)

3 2

FP
by Chris Santerre 31 Aug '04

31 Aug '04

This was on the bottom of a legit email to a co worker. _______________________________________________ AsianAvenue.com free e-mail - www.asianavenue.com. Click into Asian America. Check out our Special Introductory Offer - E-mail Forwarding for just $5.95 per year! Powered by Outblaze Whitelist asianavenue.com or is it a spam site. Going to it looks fishy. But it is from outblaze, which is VERY antispam I think. --Chris

2 1

RE: [SURBL-Discuss] RFC: Public false positve reporting form
by Chris Santerre 31 Aug '04

31 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, August 30, 2004 7:33 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] RFC: Public false positve reporting form > > >How does anyone feel about a public false positive reporting >form? Such a form would include the reporting party, the >domain(s) or IPs, reasons why it's a false positive, etc. > I think the public needs a way to report FP, to be listed, and greylist domains. However, only if more then one person can work on these. ;) >It could be processed publically or privately in a bug >tracking system. It would be hand checked by some of our >experienced spam fighters. The results could be published >or simply aggregated without public announcement into the >overall whitelist. > >Is this a good or bad idea? good >What level of publication should there be? Answers to none. They give, we take info. Too time consuming to answer all. > >What forms of proof (if any) does anyone like? spam with headers. The rest is up to us. > >Other comments? Who was the first nut ever to think up pole vaulting? "Hey Jim, see that there bush? I bet if I run fast enough with this here flagpole......." --Chris

2 1

FP on WS
by Bill Landry 31 Aug '04

31 Aug '04

Okay, here we go again... ;-) ===== Domain, proflowers.MUNGEDcom is listed on WS. ===== ===== Sending IP listed on two aggressive RBLs, otherwise looks clean: http://www.dnsstuff.com/tools/ip4r.ch?ip=198.31.62.30 ===== ===== Domain, proflowers.com, registered through Network Solutions and domain registered in early 1998: Record created on 04-Feb-1998 ===== ===== Address space owned by Level 3: [whois.arin.net] Level 3 Communications, Inc. LVLT-ORG-198-31 (NET-198-31-0-0-1) 198.31.0.0 - 198.31.255.255 Subnet delegated to: Double Click DOUBLECLICK7-62-28 (NET-198-31-62-0-1) 198.31.62.0 - 198.31.63.255 RegDate: 2003-03-28 ===== ===== No NANAS listings: References: [ Proflowers: 0 ] ===== Anything else needed for this one? :-\ Bill

5 7

Re: [SURBL-Discuss] FP on WS
by Rob McEwen 30 Aug '04

30 Aug '04

> Domain, proflowers.MUNGEDcom is listed on WS. Thanks Bill for your good work. I hope this gets removed fast. I've heard Jeff ask in the past, "hey, what caused this to get on in the first place?" ...well, even though I often lean towards the aggressive side of the arguments, it seems like FPs like this one really are getting on SURBL too often. Therefore, I hope that Jeff or someone can find and correct the source of these particularly egregious types of FPs soon. Rob McEwen

1 0

FP on OB list
by Bill Landry 30 Aug '04

30 Aug '04

Found the link below in a Ziff Davis "Baseline Magazine" renewal notification e-mail, and it was tagged by OB: omessage.MUNGEcom The URI was used in an unsubscribe link. Bill

5 13

SURBL WS test scores in SA 3.0
by Fred 29 Aug '04

29 Aug '04

Hello Group, This is my first post here, let me introduce myself. I've been very active in fighting spam for the past 3-4 years, I just recently became a submitter to the WS surbl list and I am hoping to start some action to help get a few things improved for all of us. I've created a number of rulesets for SARE (tripwire, OEM, Spoof) and released my own rules to the public, now I am focusing on SURBL_WS and doing what I can to improve all aspects of it. First off I am looking for people who use SpamAssassin and have access to a corpus of ham e-mail. The score for the WS SURBL test in 3.0 is very low, I am really focused on improving this and hope to get the score to 2 or 3 by the release of SA 3.1 I want to track down False Positives and get these whitelisted. The statistics-set1.txt file shows: The first number is % of e-mails hit (spam and ham), the next is % of spam, followed by % of ham. 51.999 78.4712 0.4756 URIBL_WS_SURBL With detection at 78.5% this rule is only outperformed by RAZOR2 and this shows our potential. If we could reduce those FPs it would greatly increase or scores and improve everyones perception of how good we are. Even the most basic rule of HTML_MESSAGE only hit on 75% of spam, we are doing more than great so far! Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400 mailto:info@i-is.com

5 12

WL. klm-email.com
by Alex Broens 27 Aug '04

27 Aug '04

Jeff Could you pls get this whitelisted? klm-email.com * 5.0 OB_URI_RBL URI's domain appears in ws database at ob.surbl.org * [klm-email.com is blacklisted in URI RBL at] Domain Name: KLM-EMAIL.COM Registrar: SAFENAMES LTD Whois Server: whois.safenames.net Referral URL: http://www.safenames.net Name Server: A.NS.KLM-EMAIL.COM Name Server: B.NS.KLM-EMAIL.COM Name Server: C.NS.KLM-EMAIL.COM Name Server: D.NS.KLM-EMAIL.COM Name Server: E.NS.KLM-EMAIL.COM Name Server: F.NS.KLM-EMAIL.COM Status: REGISTRAR-LOCK Updated Date: 24-may-2004 Creation Date: 17-may-2004 Expiration Date: 17-may-2006 ---------------------- From: KLM Belgium [SMTP:klm_belgium@klm-email.com] Sent: 27 August 2004 14:23 To: xxxxxxxxxxxx Subject: 10 Crazy Days of Internet USA from 321 euro Fasten your seatbelts as KLM's 10 days of internet will be in the air again from August 31st until September 9th. For 10 days in a row you can book your flights to 76 destinations at extra special prices via www.klm.be (http://klm-email.com/a/MUNGED / www.klm.lu (http://klm-email.com/a/MUNGED/link5. The offer being limited, be sure to book in time! Check the complete list of destinations and prices on www.klm.be (http://klm-email.com/a/MUNGED/link4) / www.klm.lu (http://klm-email.com/a/MUNGED/link4) as of August 31st. Visit www.airfrance.be (http://klm-email.com/a/MUNGED/link6) for other attractive offers. KLM The Reliable Airline --------------------------------

2 1

RE: [SURBL-Discuss] another new TLD?
by Chris Santerre 27 Aug '04

27 Aug '04

getin.to file.to surf.to all reported spams the past few days. >-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Thursday, August 26, 2004 4:47 PM >To: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] another new TLD? > > >on Thu, Aug 26, 2004 at 04:39:21PM -0400, Chris Santerre wrote: >> File.to >> >> from >> http://File.to/ooo >> >> OK to add as well? Looks like spammers are trying to get >around the standard >> com, net, info , biz. > >Not new at all. That's Togo, who sold rights to their NIC and which TLD >we often saw in redirection services (e.g., 'http://surf.to') >back in the >mid-nineties. > >Didn't someone post a complete list of TLDs here just recently? > >-- >hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/ _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

3 3

another new TLD?
by Chris Santerre 26 Aug '04

26 Aug '04

File.to from http://File.to/ooo OK to add as well? Looks like spammers are trying to get around the standard com, net, info , biz. --Chris

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss