Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

UGH.. More false positives
by Matt 08 Dec '04

08 Dec '04

I've got some more false positives.. this one appears to be my.yahoo.com !!! From: "Mark Roberts" <maxmedianews(a)yahoo.com> To: "WGRC" <news(a)wgrc.com> Sent: Tuesday, December 07, 2004 5:48 AM Subject: [SPAM] 12/7 > Spam detection software, running on the system "spamcobra.swift-networks.com", has > identified this incoming email as possible spam. The original message > has been attached to this so you can view it (if it isn't spam) or block > similar future email. If you have any questions, see > the administrator of that system for details. > > Content preview: M.Roberts 12/7/04 News [...] > > Content analysis details: (5.5 points, 5.0 required) > > pts rule name description > ---- ---------------------- ---------------------------------------------- ---- > 0.0 HTML_MESSAGE BODY: HTML included in message > 0.5 HTML_20_30 BODY: Message is 20% to 30% HTML > 5.0 SPAMCOP_URI_RBL URI's domain appears in SpamCop data at http://www.surbl.org/lists.html > [my.yahoo.com is blacklisted in URI RBL at] > [sc.surbl.org] > > The original message was not completely plain text, and may be unsafe to > open with some email clients; in particular, it may contain a virus, > or confirm that your address can receive spam. If you wish to view > it, it may be safer to save it to a file and open it with an editor. > > Subject: 12/7 From: Mark Roberts <maxmedianews(a)yahoo.com> Date: Tue, 7 Dec 2004 02:48:31 -0800 (PST) To: WGRC <news(a)wgrc.com> M.Roberts 12/7/04 News (Northumberland County)---A car and an oil-delivery truck crashed head-on yesterday afternoon in Northumberland County, killing a young Luzerne County woman. Northumberland County Coroner James Kelley identified the victim as 22-year-old Ann Marie Piasecki of Wilkes Barre. Route 487 was closed after the truck and car crashed about 1:30 p-m near the Fleetwood Motor Homes plant near Elysburg. A passenger in Piasecki's car was flown to Geisinger. Police continue to investigate yesterday's fatal Northumberland County Crash. (Montour County)---Plea negotiations are under way in the case of an Amish farmer accused of sexually assaulting several young girls at or around his farm in northern Montour County. The press enterprise says 47 year old Eli Hostetler, of Anthony Township, was granted a trial continuance at the request of defense attorney. Hostetler faces a host of charges including rape, corruption and child endangerment filed by state police at Milton. Some of the allegations made against him date back more than 11 years. (State)---When the Electoral College meets next week, 21 of Pennsylvania's staunchest Democrats will cast their electoral votes for defeated presidential nominee John Kerry. The state's electors will gather in the state House chamber December 13th, the day the 538 members of the Electoral College nationally cast ballots confirming President Bush's victory. (Drugs)---New research suggests that top-selling pain reliever Celebrex does not carry the same heart attack risk as Vioxx, a similar drug pulled from the market in September because of safety concerns. A study by University of Pennsylvania researchers is the first to compare the two arthritis drugs since the recall. (Columbia County)--- The new owner of the Columbia Mall in Buckhorn is promising more stores and a movie theater. Bayview Financial of Florida will take over the mall next month from Columbia Mall Associates. The current owners say the mall has lost nearly 20 (m) million dollars in value since 1995. (Luzerne County)--- The city of Wilkes-Barre has agreed to pay 225-thousand dollars for a former bank building in a prominent downtown location. The building that once housed the First National Bank has been vacant since the flood of 1972. City Leaders are looking at the idea of restoring it. (Northumberland County)---Three people were injured after a crash yesterday morning at route 54 and 44 in the boro of Turbotville, Northumberland County. State Troopers say the crash occurred as 77 year old Annabelle Temple of Milton was attempting to cross 54 when she pulled into the path of 67 year old Sylvia Lawrence of Riverside. Both Lawrence and Temple were transported to Geisinger for treatment. A 2 year old passenger with Temple also suffered minor injuries and was taken to the Evangelical Hospital for treatment after yesterday's crash in Northumberland County. (Perry County)---State Troopers are looking into a Burglary which occurred sometime yesterday afternoon at the Millerstown Town Moose in Greenwood Township, Perry County. Officers explain, suspects entered the building and removed an undetermined amount of money, before fleeing thru a side door. Anyone with information into that robbery yesterday afternoon at the Millerstown moose should contact authorities. (Flu)---More flu vaccine is on the way. The government plans today to announce the purchase some of the five million doses available from plants in Canada and Germany. The Food and Drug Administration has signed off on the safety of a portion of the supply after doing inspections and tests. (Pearl Harbor)---Today marks the 63rd anniversary of the attack on Pearl Harbor. Survivors are returning to the Hawaii site to honor the more than two-thousand soldiers who died in the Japanese surprise attack. (Bloomsburg)--- Bloomsburg has plans to draw up a budget for next year that would reduce property taxes by almost 6.7 percent, but would hike a tax on in-town workers from $10 to more than $35. Today's press enterprise reports the idea was brought up at a workshop meeting last night. The state Legislature recently passed a law allowing municipalities to raise the old occupational assessment tax from $10 up to $52. Bloomsburg Councilmen entered the night looking at a roughly $309,000 budget deficit for next year. (Montour County)---Montour County might lay off a few employees and raise taxes next year to balance its 2005 budget. According to the press enterprise, Montour County is allowed to raise property taxes by only 10 percent, which would mean about $20 more in property tax for the typical resident. Commissioners would not reveal any specific figures from the 2005 budget. They said they will release the tentative budget and new tax rates at their meeting on Thursday. (Dog License)---Don't forget to get lucky or rover his tags….2005 dog licenses go on sale this week. Licenses are required for all dogs more than three months old. If the animal is spayed or neutered, the license is $6. If they are not, the license is $8. In 2004, county treasurers and state agents sold licenses for more than 900,000 dogs. Do you Yahoo!? Meet the all-new My Yahoo! – Try it today!

4 9

a few URL blacklist sources
by Daniel Quinlan 07 Dec '04

07 Dec '04

A great source you probably already know about, Wiki URL blacklists, especially the ones edited on a Wiki: http://moinmaster.wikiwikiweb.de/BadContent http://www.emacswiki.org/cgi-bin/wiki?BannedContent Not quite sure how these are edited: http://spammers.chongqed.org/ or http://blacklist.chongqed.org/ http://www.jayallen.org/blacklist.txt Open source web proxy filter ... maybe willing to share their URL lists? Of course, this is not a spammer list as far as I know, but perhaps it can be used to amplify and verify SURBL whitelist (to eliminate things) or blacklists (to cross-check an addition). http://www.censornet.com/ Huge list of URL blacklists: http://spamlinks.openrbl.org/filter-bl.htm Worth trying something more elaborate? Provide the Wiki folks with a better infrastructure for banning URLs used in Wiki spam (which I'm fairly confident will correlate well with email spam). 1. Get multiple wikis to use a standard format for bad content lists, feed into a SURBL-based Wiki blacklist. 2. All SURBL blacklists can be used on supporting Wikis. So, SURBL gets a new blacklist (the best kind, one fed with a different type of source), Wikis get a much wider blacklist, etc. Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

2 3

RE: [SURBL-Discuss] Re: a few URL blacklist sources
by Chris Santerre 07 Dec '04

07 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, December 07, 2004 1:13 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] Re: a few URL blacklist sources > >> http://www.emacswiki.org/cgi-bin/wiki?BannedContent > >> http://spammers.chongqed.org/ or http://blacklist.chongqed.org/ >> http://www.censornet.com/ > >> http://spamlinks.openrbl.org/filter-bl.htm >With theese in mind, would anyone like to help us research some >of these other possible sources that Daniel brings up? Multiple >opinions could be useful. > *snipped stagnant from above* I will research: >> http://spammers.chongqed.org/ or http://blacklist.chongqed.org/ Any takers on the others? --Chris

1 0

RE: [SURBL-Discuss] Hi I'm new and I like SURBL
by Paul Schwarz 07 Dec '04

07 Dec '04

In our scenario sbl-xbl at the MTA plus SURBL blocks 80% of spam... If I add greylisting the result goes up to over 95%. I use Xwall spam filter. I wish all SMTP servers were greylisting compliant - there are some interesting problems - bummer. Is anyone else recommending or not recommending greylisting and what are your experiences. Seems like surbl should get more effective over the years but right now it probably only stops 50% of our spam if used by itself. Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100 -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Wednesday, December 01, 2004 4:14 AM To: Paul Schwarz Cc: 'SURBL Discussion list' Subject: Re: [SURBL-Discuss] Hi I'm new and I like SURBL On Tuesday, November 30, 2004, 6:02:53 AM, Paul Schwarz wrote: > sbl-xbl.spamhaus.org - reject at SMTP level standard greylisting > SURBL - using multi.surbl.org Hi Paul, sbl-xbl at the MTA plus SURBL use should be an effective combination. It's what I've been recommending to other folks. Preventing spams from even entering your network using spamhaus is quite safe, fast and smart. Jeff C. -- "If it appears in hams, then don't list it."

5 4

RE: [SURBL-Discuss] www.rulesemporium.com down?
by Paul Schwarz 07 Dec '04

07 Dec '04

Seems up now. Paul Schwarz -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Thomas Kinghorn [MTNNS -Rosebank] Sent: Tuesday, December 07, 2004 4:36 AM To: SURBL Discussion list Subject: RE: [SURBL-Discuss] www.rulesemporium.com down? Same result. Looks down. Tom -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Martin Sent: 07 December 2004 11:29 AM To: discuss(a)lists.surbl.org Subject: [SURBL-Discuss] www.rulesemporium.com down? Or is it just here? Thanks / Martin _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

www.rulesemporium.com down?
by Martin 07 Dec '04

07 Dec '04

Or is it just here? Thanks / Martin

2 1

RE: [SURBL-Discuss] Hi I'm new and I like SURBL
by Paul Schwarz 07 Dec '04

07 Dec '04

I'm using XWall and this is what it states: ----------------------------------------------------------- GreyListing GreyListing spam filter, based on http://projects.puremagic.com/greylisting The GreyListing method looks at three pieces of information about any particular mail delivery attempt: The IP address of the host attempting the delivery The envelope sender address The envelope recipient address >From this an unique triplet for identifying a message is created and if this triplet was never been seen before, or the sender is not excluded or on the white list, then the message delivery is refused with a temporary failure. Any normal SMTP server will reschedule the message and will resend it after some time ( usually 10 - 15 minutes ). Spammers however are sending applications designed specifically for spamming. These applications usually adopt the fire-and-forget methodology. That is, they attempt to send the spam to one or several MX hosts for a domain, but then never attempt a true retry as a real SMTP server would. There are some misbehaving mail servers that have a problem with GreyListing and XWall automatically excludes them. You will find the list at GreyListing Exclusions Note: Make sure your backup MX SMTP also runs XWall or any other SMTP server that support GreyListing or else the spammer will bypass XWall by sending to XWall first and then to the backup MX. Max triplets to gather Defines how many triples XWall should member Initial delay of a previously unknown triplet Lifetime of triplets that have allowed mail to pass Lifetime of triplets that have not yet allowed a mail to pass Defines the time interval of the triples Show detailed triplet description (last seen, time elapsed) If this is enabled XWall shows a detailed description about the status of the triplet, including the last seen and elapsed time. ----------------------------------------------------------- -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan Sent: Tuesday, December 07, 2004 1:10 AM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] Hi I'm new and I like SURBL On Monday, December 6, 2004, 8:54:09 PM, Joseph Burford wrote: (Paul Schwarz writes:) >> Is anyone else recommending or not recommending greylisting and what are >> your experiences. Seems like surbl should get more effective over the > Greylisting rocks, however I've been building a greylist whitelist to > help get over the problem of various people who run non-compliant systems. > So with a good list of trusted netblocks not to greylist, it is even > more effective. I've been sharing this with a few people, if you or > anyone else is interested please mail me offlist. OK I think there may be some confusion about the term 'greylisting' here. Greylisting is one of those terms that can mean different things in different contexts. In this case, it looks like: 1. Paul may be referring to putting marginal spams into a separate mail folder or mailbox so that they can be checked manually for spamminess, then delivered or deleted. Perhaps Paul can clarify if that's what he meant. 2. Joseph means using blocklists based on 'grey' criteria, i.e. domains are mentioned in some legitimate mail and also some spams. Jeff C. -- "If it appears in hams, then don't list it." _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

RE: [SURBL-Discuss] www.rulesemporium.com down?
by Thomas Kinghorn [MTNNS -Rosebank] 07 Dec '04

07 Dec '04

Same result. Looks down. Tom -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Martin Sent: 07 December 2004 11:29 AM To: discuss(a)lists.surbl.org Subject: [SURBL-Discuss] www.rulesemporium.com down? Or is it just here? Thanks / Martin _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: Non-Clickable URI's
by Chris Santerre 07 Dec '04

07 Dec '04

>-----Original Message----- >From: RD [mailto:bitoy@lawin.pinoy.org] >Sent: Friday, December 03, 2004 8:21 PM >To: Spamassassin List >Subject: Non-Clickable URI's > > >Hello List, > >I've seen spams where spammers are using >"Cut&Paste_this_URL_to_your_browser" method reason why spamassassin >won't trigger SURBL database lookup. > >Is there a known workaround to catch this non-clickable URIs >and trigger >SURBL lookup? This is in the form of www . domain . com It was mentioned on the SURBL list, and I wrote a quick and dirty SA rule for it. Initial tests were dissmal. Found 2 ham: > http :// www . drugstore . com / ivd0324 > header copied into the body of a forward: > X-Scanned-By: MIMEDefang 2.28 (www . roaringpenguin . com / mimedefang) Also hit 12 spam out of around 70k. A little more testing needed. But I think this shows that it isn't worth the rule. The links break and require end lusers to not only copy and paste, but edit the link to remove the spaces. Clearly more then most users would do. --Chris

2 1

RE: [SURBL-Discuss] Re: a few URL blacklist sources
by Chris Santerre 06 Dec '04

06 Dec '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Monday, December 06, 2004 1:19 PM >To: quinlan(a)pathname.com >Cc: SURBL Discuss >Subject: [SURBL-Discuss] Re: a few URL blacklist sources > > >> http://moinmaster.wikiwikiweb.de/BadContent > >Apparently, this is now just a copy of mt-blacklist: > > http://www.jayallen.org/comment_spam/ > >It looks a little stagnant, but my previous cooperation suggestion >stands. :-) Thanks DQ. Looks like some good sources. I'll talk to Jeff and see if we can come up with something. I know he will want to put this thru a test of some sort to reduce FPs. But a great idea. --Chris

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss