- Discuss - Mailman 3

RE: Image Composition Analysis
by Chris Santerre 02 Dec '04

02 Dec '04

Yeah this is a definite candidate for SURBL. This is the Huntsville-consulting spam gang: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL20528 353+ domains diretly linked. This is going to be the next trend. The final destination of this pron spam was throatstuffers . com, but it used a throw away domain of marlacell . com as a forwarder. Not directly either. That domain simply hosted a mirrored page of throatstuffers . com. We are seeing an increase in throw away domains being used to reroute to other domains that will NEVER show up directly in a spam. All in attempts to get passed SURBL. No biggy, the more pople that submit and manage SURBL the faster they get added. However there has been discussion on blocking the final destinations via web proxy's and host files. I think we will begin to see an increase in companies blocking these IPs or domains at the firewall or proxy server. Its actually helping some antispammers. We are able to tie more spammers together thru looking at who is trying to get passed SURBL thru throw away domains. Some of the small guys are only rogues of the bigger ones. We got people watching spammers six ways from Sunday. Funny how much they don't realise we know ;) --Chris >-----Original Message----- >From: Smart,Dan [mailto:SmartD@VMCMAIL.com] >Sent: Wednesday, December 01, 2004 4:57 PM >To: spamassassin-users(a)incubator.apache.org >Subject: RE: Image Composition Analysis > > >Attached is the spam that got through. I changed the porn URL to not >offend. It's a little mangled as it was forwarded by the user >via Outlook, >and tags got mangled by my Sanitizer. > >I capture the headers of all files, and here is what they look >like. The >bayes = 0 is what got this through. > ><<Dan>> > >======================================== >From filter Wed Nov 3 01:29:14 2004 >Return-Path: <Bebeskbs(a)kmanus.com> >Received: from great.amberalist.com (great.amberalist.com >[209.200.9.222]) > by dalton.vul.com (Vulcan E-mail Relay) with SMTP id 56BD89BB2C > for <xxxxxxx(a)vmcmail.com>; Wed, 3 Nov 2004 01:29:14 >-0600 (CST) >Received: from mail pickup service by kmanus.com with >Microsoft SMTPSVC; > Wed, 3 Nov 2004 14:17:54 -0800 >Received: from 194.3.74.35 by by7fd.bay7.kmanus.com with HTTP; > Wed, 3 Nov 2004 14:17:54 GMT >X-Originating-IP: [194.3.74.35] >X-Originating-Email: [Bebeskbs(a)kmanus.com] >X-Sender: Bebeskbs(a)kmanus.com >From: Bebe <Bebeskbs(a)kmanus.com> >To: XXXXX <XXXXXXX(a)vmcmail.com> >Subject: re: our appreciation >Date: 3 Nov 2004 14:17:54 -0500 >Mime-Version: 1.0 >Content-type: text/html >Message-ID: <SR0-81197F1166274AB5A8701DBB47173D6E(a)kmanus.com> >X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on >dalton.vul.com >X-Spam-DCC: : dalton 1182; Body=1 Fuz1=1 Fuz2=1 >X-Spam-AWL: Auto_Whitelist= >X-Spam-Status: No, hits=1.7 required=6.5 >tests=BAYES_00,CP_RANDOMWORD_10, > HTML_MESSAGE,MIME_HTML_NO_CHARSET,MIME_HTML_ONLY,OB_URI_RBL, > RCVD_IN_SBL,SARE_HTML_FSIZE_1ALL,WS_URI_RBL autolearn=no >version=2.64 >X-Spam-Level: * >Status: RO >X-Status: >X-Keywords: >X-UID: 1219 > >====================================== ><<Dan>> > > > > >> -----Original Message----- >> From: John Andersen [mailto:jsa@pen.homeip.net] >> Sent: Wednesday, December 01, 2004 2:45 AM >> To: spamassassin-users(a)incubator.apache.org >> Subject: Re: Image Composition Analysis >> >> On Tuesday 30 November 2004 01:27 pm, Smart,Dan wrote: >> >> > Catching image only E-mail with pornographic images is >> really difficult. >> > My users are offended when they get one, and wonder how I >> could not >> > catch it. Explaining that the document was text, filled >with bayes >> > poison, and the one porn image with no porn words in the document >> > doesn't seem to have much of an impression on them. >> >> Open the image with a text editor and challenge them to >> determine if it is spam or not. >> >> Really, people this dumb should not be turned loose on the internet. >> >> -- >> _____________________________________ >> John Andersen >> > >

3 2

FP: rgc3.net
by Rob McEwen (PowerView Systems) 01 Dec '04

01 Dec '04

Potential False Positive: If found the following in a header of an e-mail that was a legitimate Realtor.com/HomeStore newsletter: rgc3.net Examine e-mail here: http://www.pvsys.com/fp.txt (I know that SURBL is not suppose to be used to check headers... but this still raises a red flag that this domain would be found in such a legit newsletter) Thanks, Rob McEwen

2 1

Re: [SURBL-Discuss] FP: rgc3.net
by Rob McEwen (PowerView Systems) 01 Dec '04

01 Dec '04

RE: rgc3.net After looking into this some more, I also found it in the header of a legitimate OfficeDepot newsletter Rob McEwen

1 0

RE: [SURBL-Discuss] virtumundo.com
by Paul Schwarz 01 Dec '04

01 Dec '04

Shows up on this page http://www.stearns.org/sa-blacklist/sa-blacklist.current.domains Paul Schwarz -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan Sent: Wednesday, December 01, 2004 11:06 AM To: Paul Schwarz Cc: 'SURBL Discussion list' Subject: Re: [SURBL-Discuss] virtumundo.com On Wednesday, December 1, 2004, 6:47:37 AM, Paul Schwarz wrote: > Why doesn't multi.surbl.org stop > virtumundo.com > It is listed in the ws.surbl.org if I look it up manually > the online surbl lookup tool doesn't detect it either. It's not listed for me: % dig virtumundo.com.ws.surbl.org a ; <<>> DiG 8.3 <<>> virtumundo.com.ws.surbl.org a ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10041 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUERY SECTION: ;; virtumundo.com.ws.surbl.org, type = A, class = IN Jeff C. -- "If it appears in hams, then don't list it." _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: [SURBL-Discuss] Hi I'm new and I like SURBL
by Paul Schwarz 01 Dec '04

01 Dec '04

Thank you for your response ! Who on this list was using greylisting and then decided to turn it off. Looking for more feedback. What rates of spam detection are you getting with surbl ? And what methods do you use to complement it. I would like to run some RFC checks but some of them seem to stringent.... I.E - Reverse PTR checks, etc Thanks again ! Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100 -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Chris Santerre Sent: Tuesday, November 30, 2004 9:53 AM To: 'SURBL Discussion list' Subject: RE: [SURBL-Discuss] Hi I'm new and I like SURBL >-----Original Message----- >From: Paul Schwarz [mailto:Paul.Schwarz@starktruss.com] >Sent: Tuesday, November 30, 2004 9:03 AM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] Hi I'm new and I like SURBL > Greetings noob, I mean Paul :-) >what are others thoughts of the effectiveness of SURBL , risks of false >positives, CPU usage, etc SURBL rocks, but I'm a bit partial. The risks of FP are low, and we strive to get them to zero. And anything reported as an FP is dealt with right away, by numerous people. We take them very seriously. Lookups are quick and getting quicker with each new mirror added. If you have a LOT of traffic you can rsync to get lookups local. Directions are on the SURBL.org site. > >I'm currently doing my spam checking in this order > >sbl-xbl.spamhaus.org - reject at SMTP level standard greylisting SURBL >- using multi.surbl.org I like everything but greylisting. It can have some issues when a timely email is needed. Particularly with airline info. We've seen it here from another SURBL contributor. > >How are you guys doing it and do you have any suggestions ? >Low false >positives are my goal in my setup. I wondered if surbl should replace >greylisting or RBL or should just complement. Complement is always better, but if anything I would remove greylisting for now. With SURBL I don't think you need it. But if you have the time and don't mind waiting sometimes 20 minutes for some companies to resend, then go ahead. I think you will be very happy with SURBL. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

4 5

virtumundo.com
by Paul Schwarz 01 Dec '04

01 Dec '04

Why doesn't multi.surbl.org stop virtumundo.com It is listed in the ws.surbl.org if I look it up manually the online surbl lookup tool doesn't detect it either. Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100

2 1

Hi I'm new and I like SURBL
by Paul Schwarz 01 Dec '04

01 Dec '04

what are others thoughts of the effectiveness of SURBL , risks of false positives, CPU usage, etc I'm currently doing my spam checking in this order sbl-xbl.spamhaus.org - reject at SMTP level standard greylisting SURBL - using multi.surbl.org How are you guys doing it and do you have any suggestions ? Low false positives are my goal in my setup. I wondered if surbl should replace greylisting or RBL or should just complement. thank you Paul

2 1

RE: [SURBL-Discuss] Hi I'm new and I like SURBL
by Kristopher Austin 30 Nov '04

30 Nov '04

Paul, if you are still interested in greylisting you might consider a solution that allows you to run SpamAssassin at SMTP time. I use sa-exim (I believe there are others for different MTAs) and this allows me to greylist based on score. For example, if the score is above 3 points then it is greylisted, otherwise it is immediately let through. However, I would go with Chris's suggestion first and see if you even need to bother. In our situation, we have to be very liberal on the score to keep the FP's down, so we use greylisting on the uncertainties. Kris -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Chris Santerre Sent: Tuesday, November 30, 2004 8:53 AM To: 'SURBL Discussion list' Subject: RE: [SURBL-Discuss] Hi I'm new and I like SURBL >-----Original Message----- >From: Paul Schwarz [mailto:Paul.Schwarz@starktruss.com] >Sent: Tuesday, November 30, 2004 9:03 AM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] Hi I'm new and I like SURBL > Greetings noob, I mean Paul :-) >what are others thoughts of the effectiveness of SURBL , risks of false >positives, CPU usage, etc SURBL rocks, but I'm a bit partial. The risks of FP are low, and we strive to get them to zero. And anything reported as an FP is dealt with right away, by numerous people. We take them very seriously. Lookups are quick and getting quicker with each new mirror added. If you have a LOT of traffic you can rsync to get lookups local. Directions are on the SURBL.org site. > >I'm currently doing my spam checking in this order > >sbl-xbl.spamhaus.org - reject at SMTP level >standard greylisting >SURBL - using multi.surbl.org I like everything but greylisting. It can have some issues when a timely email is needed. Particularly with airline info. We've seen it here from another SURBL contributor. > >How are you guys doing it and do you have any suggestions ? >Low false >positives are my goal in my setup. I wondered if surbl should replace >greylisting or RBL or should just complement. Complement is always better, but if anything I would remove greylisting for now. With SURBL I don't think you need it. But if you have the time and don't mind waiting sometimes 20 minutes for some companies to resend, then go ahead. I think you will be very happy with SURBL. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: [SURBL-Discuss] Hi I'm new and I like SURBL
by Chris Santerre 30 Nov '04

30 Nov '04

>-----Original Message----- >From: Paul Schwarz [mailto:Paul.Schwarz@starktruss.com] >Sent: Tuesday, November 30, 2004 9:03 AM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] Hi I'm new and I like SURBL > Greetings noob, I mean Paul :-) >what are others thoughts of the effectiveness of SURBL , risks of false >positives, CPU usage, etc SURBL rocks, but I'm a bit partial. The risks of FP are low, and we strive to get them to zero. And anything reported as an FP is dealt with right away, by numerous people. We take them very seriously. Lookups are quick and getting quicker with each new mirror added. If you have a LOT of traffic you can rsync to get lookups local. Directions are on the SURBL.org site. > >I'm currently doing my spam checking in this order > >sbl-xbl.spamhaus.org - reject at SMTP level >standard greylisting >SURBL - using multi.surbl.org I like everything but greylisting. It can have some issues when a timely email is needed. Particularly with airline info. We've seen it here from another SURBL contributor. > >How are you guys doing it and do you have any suggestions ? >Low false >positives are my goal in my setup. I wondered if surbl should replace >greylisting or RBL or should just complement. Complement is always better, but if anything I would remove greylisting for now. With SURBL I don't think you need it. But if you have the time and don't mind waiting sometimes 20 minutes for some companies to resend, then go ahead. I think you will be very happy with SURBL. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

how does the white list work ?
by Paul Schwarz 29 Nov '04

29 Nov '04

I use multi.surbl.org to check the emails and wondered is there a whitelist for each individual surbl list or one the encompasses them all ? Who maintains it etc. thanks much ! Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100

3 2

RE: [SURBL-Discuss] how does the white list work ?
by Paul Schwarz 29 Nov '04

29 Nov '04

Thank you for the web site! Sorry about the accidental double post Paul Schwarz -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan Sent: Monday, November 29, 2004 1:44 PM To: Paul Schwarz Cc: 'discuss(a)lists.surbl.org' Subject: Re: [SURBL-Discuss] how does the white list work ? On Monday, November 29, 2004, 10:17:24 AM, Paul Schwarz wrote: > I use multi.surbl.org to check the emails and wondered is there a whitelist > for each individual surbl list or one the encompasses them all ? Who > maintains it etc. Individual lists (data sources) may have their own internal whitelists which cause exclusions from those lists, but there are also shared whitelists which get sorted together and globally applied across all SURBLs. The former would be largely invisible to the outside world. The latter can be found at: http://spamcheck.freeapp.net/whitelist-domains.sort but it includes a lot of high-level geographic domains. Raymond, Various people are using our whitelist. Perhaps we could consider putting it on the rsync server for more efficient transfers. Jeff C. -- "If it appears in hams, then don't list it." _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: [SURBL-Discuss] how does the white list work ?
by Paul Schwarz 29 Nov '04

29 Nov '04

Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100 -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Paul Schwarz Sent: Monday, November 29, 2004 1:17 PM To: 'discuss(a)lists.surbl.org' Subject: [SURBL-Discuss] how does the white list work ? I use multi.surbl.org to check the emails and wondered is there a whitelist for each individual surbl list or one the encompasses them all ? Who maintains it etc. thanks much ! Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100 _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

href...
by Jose Marcio Martins da Cruz 29 Nov '04

29 Nov '04

Some spammers are now putting links this way... <a href="todayspecialrx.com"> -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

1 0

Re: Please remove our domain pushline.com from blacklist (fwd)
by William Stearns 29 Nov '04

29 Nov '04

---------- Forwarded message ---------- Date: Tue, 23 Nov 2004 22:53:18 -0500 (EST) From: William Stearns <wstearns(a)pobox.com> To: Ivan Rudev <ivan(a)webstel.com> Cc: William Stearns <wstearns(a)pobox.com> Subject: Re: Please remove our domain pushline.com from blacklist Good day, Ivan, On Tue, 23 Nov 2004, Ivan Rudev wrote: > Our partners cannot receive our newsletters because our domain > pushline.com is in your ws.surbl.org and multi.surbl.org blacklists. > We don't send spam! > http://www.pushline.com/ - just the partner program site where our partners have the ability > to create own Phone Cards Internet Shop and receive commission from sales. > > Please remove pushline.com from blacklists! Your domain was added because of spam from it, an activity the web site encourages: Date: Sun, 15 Aug 2004 11:35:26 +0300 From: ____(a)pushline.com To: wstearns(a)pobox.com Subject: Cheap long distance phone cards INSTANTLY DELIVERED PHONE CARDS BEST AVAILABLE RATES WORLDWIDE ______________________________________________________________________________________________________________ Wide range of phone cards to choose from Easy to compare the rates and select the best card for you Instantly get the PIN online Available worldwide Live customer service Visa/MC/Discover accepted ______________________________________________________________________________________________________________ Using prepaid phone cards wisely can help you control your phone bills. Prepaid phone cards are also very convenient. For consumers who do not want to switch their long distance carriers, stand-alone prepaid phone cards are the answer. You receive mobility (calling from any phone including cellular), independence from local carrier and anonymity. CLICK HERE FOR OUR SPECIAL RATES FOR YOU Because you benefit from your partners actions, you're responsible for their emails. Cheers, - Bill --------------------------------------------------------------------------- "My fellow Americans. I've signed legislation that will outlaw Russia forever. We begin bombing in five minutes." - President Reagan, before a scheduled radio broadcast, unaware that the microphone was already on... (Courtesy of Brian S. Dellinger <Brian.Dellinger(a)Dartmouth.EDU>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

1 0

RE: hotnudiegirls.com URI as false positive
by Chris Santerre 25 Nov '04

25 Nov '04

1) Dude that is one hell of a cool domain name for a non pron site! Cool!! 2) quasirhombicosidodecahedron.com also rocks as a domain name! 3) Your original complaint, doesn't exhist :) You are NOT listed. Something is up. We have seen these more then a few times. hotnudiegirls.com is not listed in ANY SURBL. www.rulesemporium.com/cgi-bin/uribl.cgi to check it out. I have no idea if it is corrupt cache data, or some sort of goofyness in the SA code. Is it possible we have a FUBAR SURBL mirror? I've cc'd just about anyone having any clue to help. This is about the 4th report in 3 days. --Chris >-----Original Message----- >From: Samat Jain [mailto:samat@quasirhombicosidodecahedron.com] >Sent: Wednesday, November 24, 2004 2:23 PM >To: postmaster(a)outblaze.com; whitelist(a)surbl.org >Subject: hotnudiegirls.com URI as false positive > > >Hello, > >When sending an e-mail to myself, I apparently got my message >tagged as spam >with SpamAssassin: > > 3.9 URIBL_SC_SURBL Contains an URL listed in the SC >SURBL blocklist > [URIs: hotnudiegirls.com] > 2.0 URIBL_OB_SURBL Contains an URL listed in the OB >SURBL blocklist > [URIs: hotnudiegirls.com] > >These were picking up my website (whose tagline I've removed >from this e-mail) >URL that is in the signature of all my e-mail messages. > >My domain is not an origin of spam, nor has it ever, or any source of >questionable material. It is a personal domain used only for >hosting some >services and ONE website that I keep on the signature portion >of my e-mails. > >Thank you, >Samat > >-- >Samat Jain > >Flap's Law: Any inanimate object, regardless of its position, >configuration, >or purpose, may be expected to perform at any time in a >totally unexpected >manner for reasons that are either entirely obscure or else completely >mysterious. >-- Anonymous (586) >

3 2

RE: [SURBL-Discuss] general questions.....
by Chris Santerre 25 Nov '04

25 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, November 23, 2004 6:24 PM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] general questions..... > *snip* > >> We have seen numerous times a legit company sending a newsletter to a >> spamtrap. Numerous reasons and excuses. But they never would >have known >> about it if they were not listed. And I think if they send >to a spamtrap we >> have a right to list. Regardless of how legit, it is a >wakeup call because >> obviously something went wrong to send to a spamtrap. > >IMO, It's not our job to "educate" legitimate companies about >how to use email. Who's job is it? That line scares me. You want to solve the spam problem? You can't do that with a narrow net. You must fight war on all fronts. You educate the legit users on what not to do. This has been all over the news recently. Everyone thinks everyone else is a spammer, but not them. I'm also VERY surprised at your comment. More then a few time YOU have educated people who have contacted us for removal from SURBL. >We want to list as many true spammer domains >as we can find and also prevent legitimate domains from being >listed. Again, legit? Once ANY company hits a spamtrap, IMHO, they are no longer legit. Not until they find out how they hit that trap. Possibly they purchased, as in gave money to a spammer, a list. With education, they will NOT do that again. Thus reducing income for spammers. Possibly they have an xploitable web subscription form? How the hell would they know unless someone tells them? *snip* > >The goal with a greylist should be to cast a wider net but >to eventually filter those down to some truly black entries >that can be listed more broadly on full blacklists. > My goal is to stop spam. Using any method. Education is probably THE biggest way to do this. Imagine if all the clueles users suddenly could spot 100% of spam emails, and NOT fall for them. Problem solved. Its the whole teach a man to fish thing. And I'm not rehashing the argument about SURBL. I clearly state I DO NO list what I want to list. I list what makes Jeff happy :) --Chris

3 2

RE: hotnudiegirls.com URI as false positive
by Chris Santerre 24 Nov '04

24 Nov '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Wednesday, November 24, 2004 5:07 PM >To: Chris Santerre >Cc: 'Daniel Quinlan'; 'Samat Jain'; postmaster(a)outblaze.com; >whitelist(a)surbl.org; dev(a)spamassassin.apache.org; SURBL Discussion list >(E-mail) >Subject: RE: hotnudiegirls.com URI as false positive > > >My guess is that the site was actually listed in SpamCop and Outblaze >(and may still be), but was either delisted by those lists or was >whitelisted by the SURBL folks. > "Negative ghostrider, the pattern is full." No whitelist has been made. But it is possible it got added and removed quickly. I sent up the flags because this isn't the first incident we have seen this week like this. --Chris

2 1

RE: hotnudiegirls.com URI as false positive
by Chris Santerre 24 Nov '04

24 Nov '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Wednesday, November 24, 2004 4:25 PM >To: Chris Santerre >Cc: 'Samat Jain'; postmaster(a)outblaze.com; whitelist(a)surbl.org; >dev(a)spamassassin.apache.org; SURBL Discussion list (E-mail) >Subject: Re: hotnudiegirls.com URI as false positive > > >We'd need a full example message that has been marked up as a false >positive, including the SpamAssassin headers, to be able to debug this. > ASk and yee shall receive...you sexy thing! :*) --Chris begin 600 e-mail2.txt M4F5C96EV960Z(&9R;VT@;&]C86QH;W-T(&)Y(&-A;&EG=6QA#0H@=VET:"!3 M<&%M07-S87-S:6X@*'9E<G-I;VX(a),RXP+C$I.PT*(%=E9"P@,C0@3F]V(#(P M,#0@,3(Z,C<Z-3,@+3`V,#`-"D9R;VTZ(%-A;6%T($IA:6X@/'-A;6%T0'%U M87-I<FAO;6)I8V]S:61O9&5C86AE9')O;BYC;VT^#0I4;SH@9V%M97-`;F%B M;&%D97-I9VXN8V]M#0I3=6)J96-T.B!T97-T(&US9PT*1&%T93H@5V5D+"`R M-"!.;W8@,C`P-"`Q,3HS,3HS-2`M,#<P,`T*365S<V%G92U)9#H@/#(P,#0Q M,3(T,3$S,2XS-3@T-2YS86UA=$!Q=6%S:7)H;VUB:6-O<VED;V1E8V%H961R M;VXN8V]M/@T*6"U3<&%M+49L86<Z(%E%4PT*6"U3<&%M+4-H96-K97(M5F5R M<VEO;CH@4W!A;4%S<V%S<VEN(#,N,"XQ("@R,#`T+3$P+3(R*2!O;B!C86QI M9W5L80T*6"U3<&%M+5-T871U<SH@665S+"!S8V]R93TU+CD@<F5Q=6ER960] M-2XP('1E<W1S/55224),7T]"7U-54D),+`T*(%5224),7U-#7U-54D),(&%U M=&]L96%R;CUN;R!V97)S:6]N/3,N,"XQ#0I8+5-P86TM3&5V96PZ("HJ*BHJ M#0I-24U%+59E<G-I;VXZ(#$N,`T*0V]N=&5N="U4>7!E.B!M=6QT:7!A<G0O M;6EX960[#0H(a)(&)O=6YD87)Y/2(M+2TM+2TM+2TM/5\T,4$T1#)!.2XW-#%" M0D(P12(-"E(a)M54E$.B`S.#$-"E(a)M3&5N9W1H.B`S,C$R#0H-"E1H:7,@:7,@ M82!M=6QT:2UP87)T(&UE<W-A9V4@:6X@34E-12!F;W)M870N#0H-"BTM+2TM M+2TM+2TM+3U?-#%!-$0R03DN-S0Q0D)",$4-"D-O;G1E;G0M5'EP93H@=&5X M="]P;&%I;@T*0V]N=&5N="U$:7-P;W-I=&EO;CH@:6YL:6YE#0I#;VYT96YT M+51R86YS9F5R+45N8V]D:6YG.B`X8FET#0H-"E-P86T@9&5T96-T:6]N('-O M9G1W87)E+"!R=6YN:6YG(&]N('1H92!S>7-T96T@(F-A;&EG=6QA(BP@:&%S M#0II9&5N=&EF:65D('1H:7,@:6YC;VUI;F<@96UA:6P@87,@<&]S<VEB;&4@ M<W!A;2X@(%1H92!O<FEG:6YA;"!M97-S86=E#0IH87,@8F5E;B!A='1A8VAE M9"!T;R!T:&ES('-O('EO=2!C86X@=FEE=R!I="`H:68@:70@:7-N)W0@<W!A M;2D@;W(@;&%B96P-"G-I;6EL87(@9G5T=7)E(&5M86EL+B`@268@>6]U(&AA M=F4@86YY('%U97-T:6]N<RP@<V5E#0IT:&4@861M:6YI<W1R871O<B!O9B!T M:&%T('-Y<W1E;2!F;W(@9&5T86EL<RX-"@T*0V]N=&5N="!P<F5V:65W.B`@ M=&5S="!M<V<@+2T@4V%M870@2F%I;@T*("`\:'1T<#HO+W1A;6%S<F5P=7,N M:&]T;G5D:65G:7)L<RYC;VT^($$@;6%N(&-A;B!B92!D97-T<F]Y960@8G5T M(&YO=`T*("!D969E871E9"X@+2T@17)N97-T($AE;6EN9W=A>2`H,C`V*2!; M+BXN72`-"@T*0V]N=&5N="!A;F%L>7-I<R!D971A:6QS.B`@("@U+CD@<&]I M;G1S+"`U+C`@<F5Q=6ER960I#0H-"B!P=',@<G5L92!N86UE("`@("`@("`@ M("`@("!D97-C<FEP=&EO;@T*+2TM+2`M+2TM+2TM+2TM+2TM+2TM+2TM+2TM M("TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM M+2TM+2TM#0H@,RXY(%5224),7U-#7U-54D),("`@("`@("`@0V]N=&%I;G,@ M86X@55),(&QI<W1E9"!I;B!T:&4@4T,@4U520DP@8FQO8VML:7-T#0H@("`@ M("`@("`@("`@("`@("`@("`@("`@("`@6U5227,Z(&AO=&YU9&EE9VER;',N M8V]M70T*(#(N,"!54DE"3%]/0E]355)"3"`@("`@("`@($-O;G1A:6YS(&%N M(%523"!L:7-T960@:6X@=&AE($]"(%-54D),(&)L;V-K;&ES=`T*("`@("`@ M("`@("`@("`@("`@("`@("`@("`(a)(%M54DES.B!H;W1N=61I96=I<FQS+F-O M;5T-"@T*#0H-"BTM+2TM+2TM+2TM+3U?-#%!-$0R03DN-S0Q0D)",$4-"D-O M;G1E;G0M5'EP93H@;65S<V%G92]R9F,X,C([('@M<W!A;2UT>7!E/6]R:6=I M;F%L#0I#;VYT96YT+41E<V-R:7!T:6]N.B!O<FEG:6YA;"!M97-S86=E(&)E M9F]R92!3<&%M07-S87-S:6X-"D-O;G1E;G0M1&ES<&]S:71I;VXZ(&EN;&EN M90T*0V]N=&5N="U4<F%N<V9E<BU%;F-O9&EN9SH@.&)I=`T*#0I2971U<FXM M4&%T:#H@/'-A;6%T0'%U87-I<FAO;6)I8V]S:61O9&5C86AE9')O;BYC;VT^ M#0I8+4]R:6=I;F%L+51O.B!G86UE<T!N86)L861E<VEG;BYC;VT-"D1E;&EV M97)E9"U4;SH@>&IJ:T!N86)L861E<VEG;BYC;VT-"E)E8V5I=F5D.B!F<F]M M('-M='`V+FUI;F1S<')I;F<N8V]M("AS;71P-BYM:6YD<W!R:6YG+F-O;2!; M,C`W+C8Y+C(P,"XQ,3!=*0T*(&)Y(&YA8FQA9&5S:6=N+F-O;2`H4&]S=&9I M>"D@=VET:"!%4TU44"!I9"`S1$0Q,S8Q1`T*(&9O<B`\9V%M97-`;F%B;&%D M97-I9VXN8V]M/CL@5V5D+"`R-"!.;W8@,C`P-"`Q,CHR-SHT-R`M,#8P,"`H M0U-4*0T*4F5C96EV960Z(&9R;VT@:"TV-BTQ-C<M-#,M-C@N<&AN9&%Z.3$N M9'EN86UI8RYC;W9A9"YN970@*%LV-BXQ-C<N-#,N-CA=(&AE;&\];6%C:&EN M82D-"B!B>2!S;71P-BYM:6YD<W!R:6YG+F-O;2!W:71H(&5S;71P("A%>&EM M(#,N,S,@(S$I#0H@:60@,4-8,6]2+3`P,#98,2TP,`T*(&9O<B!G86UE<T!N M86)L861E<VEG;BYC;VT[(%=E9"P@,C0@3F]V(#(P,#0@,3,Z,C0Z,C`@+3`U M,#`-"E)E8V5I=F5D.B!F<F]M(&UA8VAI;F$N:&]M92`H;6%C:&EN82YH;VUE M(%LQ,"XP+C`N,3`P72D-"B!B>2!M86-H:6YA("A0;W-T9FEX*2!W:71H($53 M3510(&ED($$Y.3,P-#$X#0H@9F]R(#QG86UE<T!N86)L861E<VEG;BYC;VT^ M.R!7960L(#(T($YO=B`R,#`T(#$Q.C,Q.C,V("TP-S`P("A-4U0I#0I&<F]M M.B!386UA="!*86EN(#QS86UA=$!Q=6%S:7)H;VUB:6-O<VED;V1E8V%H961R M;VXN8V]M/@T*5&\Z(&=A;65S0&YA8FQA9&5S:6=N+F-O;0T*4W5B:F5C=#H@ M=&5S="!M<V<-"D1A=&4Z(%=E9"P@,C0@3F]V(#(P,#0@,3$Z,S$Z,S4@+3`W M,#`-"E5S97(M06=E;G0Z($M-86EL+S$N-RXQ#0I-24U%+59E<G-I;VXZ(#$N M,`T*0V]N=&5N="U4>7!E.B!T97AT+W!L86EN.PT*("!C:&%R<V5T/2)U<RUA M<V-I:2(-"D-O;G1E;G0M5')A;G-F97(M16YC;V1I;F<Z(#=B:70-"D-O;G1E M;G0M1&ES<&]S:71I;VXZ(&EN;&EN90T*365S<V%G92U)9#H@/#(P,#0Q,3(T M,3$S,2XS-3@T-2YS86UA=$!Q=6%S:7)H;VUB:6-O<VED;V1E8V%H961R;VXN M8V]M/@T*#0IT97-T(&US9PT*+2T@#0I386UA="!*86EN(#QH='1P.B\O=&%M M87-R97!U<RYH;W1N=61I96=I<FQS+F-O;3X-"@T*02!M86X@8V%N(&)E(&1E M<W1R;WEE9"!B=70@;F]T(&1E9F5A=&5D+@T*+2T@17)N97-T($AE;6EN9W=A M>2`H,C`V*0T*#0HM+2TM+2TM+2TM+2T]7S0Q031$,D$Y+C<T,4)"0C!%+2T- #"@T* ` end

2 1

FP: pop.com.br
by Yves Junqueira 24 Nov '04

24 Nov '04

pop.com.br is in WS. pop.com.br is a very known free internet access provider in brazil. It's defintely in HAM boxes. (added to my local white list) - Yves

2 1

Bigfoot Interactive
by Brett Cove 24 Nov '04

24 Nov '04

I noticed that a number of their domains are in the surbl whitelist (more specifically bfi0.com), even though it is obvious to me that they are a spamhaus. Are they truly "whiter" than they appear, or would blocking them cause too much collateral damage (FPs)? -Brett

2 1

Re: hotnudiegirls.com URI as false positive
by Daniel Quinlan 24 Nov '04

24 Nov '04

We'd need a full example message that has been marked up as a false positive, including the SpamAssassin headers, to be able to debug this. Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

1 0

RE: [SURBL-Discuss] general questions.....
by Chris Santerre 24 Nov '04

24 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, November 22, 2004 8:41 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] general questions..... > > >On Monday, November 22, 2004, 5:25:14 PM, Justin Mason wrote: >> Important to note that SURBL *can* increase its efficiency, >by changing >> its methods -- ie. adding more data sources, modifying the moderation >> model, etc. can increase efficiency. > >I like to think so too, but one of Terry's hypotheses is that >detecting spam in the remaining variance (the ~15% currently >undetected) may require some "third dimension of spam" and that >about half of that variance may be truly "noise" and therefore >inherently undetectable (paraphrasing him from off-list >discussions). But he doesn't have data to support that claim >yet, just empirical observations across different classification >systems. > >It's good to hear that Henry Stern is getting a PhD for his >work in this area, since it can be worthy of that honor. >It's not a particularly easy problem. > >Jeff C. Wow that was a good email. It makes me think about things from a higher level then the trenches. The whole thing has to be thought of in sections. If we are thinking of JUST SURBL, then I agree that to get this 15% remaining requires more manpower thrown at the overall project. I say overall, because there are other antispam projects that support SURBL that would also be MUCH better with more help. Looking at it from another view, the 15% IS caught! THe bigger picture is antispam. You throw DNSRBL, SURBL, BAYES, SARE, and SA at the problem, and classification jumps an order of magnitude that you wanted. Which for most end users can be 99.99%. Differences being tastes in the definition of the classification. Which is a human trait that can't be removed. But I believe there is still a huge leap SURBL can make in classification. With an increase in data mining, research, and a little more help from major ISPs and registrars. Thanks for that informative email Jeff!! You saved me a google ;) --Chris

5 9

RE: [SURBL-Discuss] general questions.....
by Rob McEwen (PowerView Systems) 24 Nov '04

24 Nov '04

>>Who's job is it? That line scares me... Chris: During this time while we are waiting on UC, why not blow off some of this steam by sharing with us your top 10 (or 25, or 50) domains which you consider the most abusive, but would generate enough FPs to stay out of SURBL. This list might be those which you would be most excited about having in U.C. By getting this list now, some of us could then place these in our local blocklists :) Rob McEwen

1 0

RE: arscenic.info blacklisted domain
by Chris Santerre 24 Nov '04

24 Nov '04

Greetings Quentin, Something is seriously wrong with your setup. arscenic.info is NOT listed in ANY of these SURBL lists! You can even try the simple: ping arscenic.info.ws.surbl.org you won't get a 127.0.0.x in return. Or you can do a lookup here: http://www.rulesemporium.com/cgi-bin/uribl.cgi HTH, Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin >-----Original Message----- >From: Quentin Drouet [mailto:kent1@arscenic.info] >Sent: Wednesday, November 24, 2004 11:52 AM >To: whitelist(a)surbl.org >Subject: arscenic.info blacklisted domain > > >This is a professionnal server and the mailing lists it contains are >subscribed by people, so I don't understand why it's now in blacklist. > > > >Received: from localhost by arscenic.info > with SpamAssassin (version 3.0.1); > Wed, 24 Nov 2004 17:18:58 +0100 >From: sympa(a)anart.no >To: kent1(a)arscenic.info >Subject: Welcome in list syndicate >Date: Wed, 24 Nov 2004 17:18:31 +0100 >Message-Id: <E1CWzqg-000GaG-PK(a)kilby.copyleft.no> >X-Spam-Flag: YES >X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on >arscenic.info >X-Spam-Level: ***** >X-Spam-Status: Yes, score=5.1 required=5.0 >tests=AWL,INFO_TLD,NO_REAL_NAME, > URIBL_AB_SURBL,URIBL_OB_SURBL,URIBL_PH_SURBL,URIBL_SC_SURBL, > URIBL_WS_SURBL autolearn=no version=3.0.1 >MIME-Version: 1.0 >Content-Type: multipart/mixed; > boundary="----------=_41A4B472.BBD5F64C" >X-UID: 22 >X-Length: 7330 > >------------=_41A4B472.BBD5F64C > >Spam detection software, running on the system "arscenic.info", has >identified this incoming email as possible spam. The original message >has been attached to this so you can view it (if it isn't >spam) or label >similar future email. If you have any questions, see >the administrator of that system for details. > >Content preview: Welcome in list syndicate(a)anart.no Welcome in list > syndicate(a)anart.no. Your subscrition email is >kent1(a)arscenic.info Your > password : init2d62e46e [...] > >Content analysis details: (5.1 points, 5.0 required) > > pts rule name description >---- ---------------------- >-------------------------------------------------- > 0.2 NO_REAL_NAME From: does not include a real name > 0.5 INFO_TLD URI: Contains an URL in the INFO >top-level domain > 0.8 URIBL_PH_SURBL Contains an URL listed in the PH >SURBL blocklist > [URIs: arscenic.info] > 2.0 URIBL_AB_SURBL Contains an URL listed in the AB >SURBL blocklist > [URIs: arscenic.info] > 0.5 URIBL_WS_SURBL Contains an URL listed in the WS >SURBL blocklist > [URIs: arscenic.info] > 2.0 URIBL_OB_SURBL Contains an URL listed in the OB >SURBL blocklist > [URIs: arscenic.info] > 3.9 URIBL_SC_SURBL Contains an URL listed in the SC >SURBL blocklist > [URIs: arscenic.info] >-4.8 AWL AWL: From: address is in the auto >white-list > > > >------------=_41A4B472.BBD5F64C >Content-Type: message/rfc822; x-spam-type=original >Content-Description: original message before SpamAssassin >Content-Disposition: inline >Content-Transfer-Encoding: 8bit > >Content-Disposition: inline >Content-Type: message/rfc822; > x-spam-type=original >Content-Description: original message before SpamAssassin >Content-Transfer-Encoding: 8bit > >Return-Path: <sympa(a)kilby.copyleft.no> >X-Original-To: kent1(a)arscenic.info >Delivered-To: kent1(a)arscenic.info >Received: from kilby.copyleft.no (kilby.copyleft.no [66.154.100.54]) > by arscenic.info (Postfix) with ESMTP id 67A8D6B9D1 > for <kent1(a)arscenic.info>; Wed, 24 Nov 2004 17:17:49 +0100 (CET) >Received: from sympa by kilby.copyleft.no with local (Exim >4.34 (FreeBSD)) > id 1CWzqg-000GaG-PK > for kent1(a)arscenic.info; Wed, 24 Nov 2004 17:18:31 +0100 >To: kent1(a)arscenic.info >From: sympa(a)anart.no >Subject: Welcome in list syndicate >Message-Id: <E1CWzqg-000GaG-PK(a)kilby.copyleft.no> >Sender: Sympa Owner <sympa(a)kilby.copyleft.no> >Date: Wed, 24 Nov 2004 17:18:31 +0100 >X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on >arscenic.info >X-Spam-Level: >X-Spam-Status: No, score=0.4 required=5.0 >tests=AWL,INFO_TLD,NO_REAL_NAME > autolearn=no version=3.0.1 >X-Sanitizer: Ce mail a été assaini >MIME-Version: 1.0 >Content-Type: > > >------------=_41A4B472.BBD5F64C-- >

1 0

RE: [SURBL-Discuss] comparison of my local blacklist w/ws
by Chris Santerre 24 Nov '04

24 Nov '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Tuesday, November 23, 2004 2:37 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] comparison of my local blacklist w/ws > > > >I've just grabbed Bill's list of domains and compared it to my local >domains blacklist, with some interesting results. The following is a >breakdown (expressed in line counts, each line representing a domain) >of the similarities and differences. > > 27546 comparelists.intersection > 155709 comparelists.notboth > 117662 comparelists.onlyin.localbl > 38046 comparelists.onlyin.sa-blacklist.current.domains > 183256 comparelists.union > >Quick interpretation: my local blacklist has 117662 domains not listed >in SURBL. Jeff owes me a cookie! I've had lots of these submitted, but without decent checking, they go unlisted. Its a manpower issue. He wanted to reduce FPs, which increases time to get listed. Snowballs, and some domains gather dust. :( I like oatmeal rasin, and Milanos! ---Chris

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss