- Discuss - Mailman 3

RE: [SURBL-Discuss] free host: greatnow.com
by Chris Santerre 26 Oct '04

26 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, October 25, 2004 3:08 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] free host: greatnow.com > > >On Monday, October 25, 2004, 8:18:34 AM, Chris Santerre wrote: >>>>> Fine. Removed. A known blog spammer host gets one FP and we >>>remove then all. >>>>> Done. >>> >>>> Chris, >>>> Instead of withdrawing the list can you give us a chance to >>>> review it? >>> >>>Chris, >>>If you put the file back up with a non-used name, I can turn it >>>into a test SURBL for people to try. After testing and debugging >>>we could look at adding it to a list. The broader the testing, >>>the better the results. >>> >>>I usually put up new lists for people to test as widely as >>>possible before turning them live. > >> No need. Moved to UC list. > >Might it be better to set up the blog spam domains as a separate >list inside multi, but testing them first? We would still want >to find a way to minimize collateral damage and keep otherwise >legitimate domains off a blog list. > Legitimate domains like greatnow.com? http://www.blackjack.greatnow.com http://www.viaga-viagra.greatnow.com http://www.debtconsolidation.greatnow.com http://generic-cialis.greatnow.com http://www.ed.greatnow.com/ http://www.bulk-email.greatnow.com http://www.bonds.greatnow.com http://www.1-dating.greatnow.com http://www.credit-card.greatnow.com http://www.car-insurance.greatnow.com We got the UC list covered. It isn't in the SURBL group. You don't have to worry about it. --Chris

6 10

RE: [SURBL-Discuss] free host: greatnow.com
by Chris Santerre 25 Oct '04

25 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, October 25, 2004 4:05 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] free host: greatnow.com > > >On Monday, October 25, 2004, 12:55:07 PM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>Might it be better to set up the blog spam domains as a separate >>>list inside multi, but testing them first? We would still want >>>to find a way to minimize collateral damage and keep otherwise >>>legitimate domains off a blog list. >>> > >> Legitimate domains like greatnow.com? > >> http://www.blackjack.greatnow.com >> http://www.viaga-viagra.greatnow.com >> http://www.debtconsolidation.greatnow.com >> http://generic-cialis.greatnow.com >> http://www.ed.greatnow.com/ >> http://www.bulk-email.greatnow.com >> http://www.bonds.greatnow.com >> http://www.1-dating.greatnow.com >> http://www.credit-card.greatnow.com >> http://www.car-insurance.greatnow.com > >Probably every free hosting site has abuse, but most have far >more legitimate uses than abusive ones. greatnow may be an >exception. I did find a ton of blog spam for it on google, as >you suggested. The real question is how much legitimate use they >have. I did apparently find some, but it doesn't mean they're a >whitehat. They could be a blackhat with a few incidental or >unintentional legitimate users. :-( > >The question deserves some research. The reason I brought them >up is because some had an apparent legitimate use for >greatnow.com. That's usually a reason to not list them. > >> We got the UC list covered. It isn't in the SURBL group. You >don't have to >> worry about it. > >> --Chris > >If we're thinking about setting up a blog list (as we were >earlier), then it might be useful to test the data before using >it, don't you agree? > >I don't see how dumping lists with arbitrary FPs onto UC helps >either UC or SURBLs. In fact it's one of the bad things we >predicted: that a grey list would become a dumping ground with >some FPs and some domains that belong on a blocklist, all sitting >there underclassified, unchecked or ignored. They are NOT going unchecked. UC is still in beta form right now. So we are testing. Most people have no clue where the server is as it is NOT part of SURBL, so UC.SURBL.ORG doesn't work. Not a dumping ground at all. It will be as active as WS. I fully intend to mirror most of what goes into WS into UC. UC will simply have a different policy. Grey domains need to be considered. UC will do that. You said yourself earlier you didn't want to be any part of a list that handled grey domains. That it would waste time. So you don't have to worry about UC. UC will get as much attention to detail as I put into WS. I just won't delete grey domains, like I do now. I will instead list then in UC. I predict UC won't be ready for prime time for a few weeks at least. And it will be its own animal, not part of the SURBL group. It is also a group effort. As working on this myself would drive me crazier then I am. --Chris

2 1

RE: [SURBL-Discuss] free host: greatnow.com
by Chris Santerre 25 Oct '04

25 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, October 25, 2004 12:50 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] free host: greatnow.com > > >On Friday, October 22, 2004, 3:57:47 PM, Jeff Chan wrote: >> On Friday, October 22, 2004, 11:28:13 AM, Chris Santerre wrote: >>>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>>This was the most recent discussion I could find. It doesn't >>>>seem to mention actually using the jayallen data in WS, though I >>>>might have missed a message: > >>> Fine. Removed. A known blog spammer host gets one FP and we >remove then all. >>> Done. > >> Chris, >> Instead of withdrawing the list can you give us a chance to >> review it? > >Chris, >If you put the file back up with a non-used name, I can turn it >into a test SURBL for people to try. After testing and debugging >we could look at adding it to a list. The broader the testing, >the better the results. > >I usually put up new lists for people to test as widely as >possible before turning them live. No need. Moved to UC list. --Chris

2 1

Nice policy! Adding to UC not WS.
by Chris Santerre 25 Oct '04

25 Oct '04

I have an SURBL submission from a VERY reputible person. With a very good explanation as to how the email address spam'd should NEVER have gotten this email. Now according to WS policy it would NOT be listed because it may have legit uses. Therefore I'm adding it to UC not WS. zatz.com is the domain. http://zatzhq.zatz.com/privacy Pretty much says it will do whatever it wants with your address. Which in this case was harvested, not OptIn. And After trying to unsub the address, the spam floodgates opened for it. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

RE: [SURBL-Discuss] Surbl Headers?
by Thomas Kinghorn 25 Oct '04

25 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Surbl Headers? >where OB_URI_RBL is the default name of a SURBL rule. Will >that work for you? If not you may be able to use exim or some >other mail processing utility to look for headers like that and >add other headers more to your liking. >Jeff C. Thanks Jeff. I am looking along the lines at, for example, X-SURBL-TAG: URL:http://www.blahblah.tld found in XX.surbl.org. Will look at exim for this. Many thanks for the pointer. Regards Tom

4 3

Surbl Headers?
by Thomas Kinghorn 25 Oct '04

25 Oct '04

Apologies for the previous message with no Subject : Mondays :o$ Good morning List. I was wondering if it is possible to add a header In the message indicating which surbl rule was triggered? If yes, how? I have seen it done via a message a stamp using MailMarshal & ASTPS. I am using Exim, sa-exim and SpamAssassin. All are the latest stable releases. Many thanks Regards, Tom

2 1

(no subject)
by Thomas Kinghorn 25 Oct '04

25 Oct '04

Good morning List. I was wondering if it is possible to add a header In the message indicating which surbl rule was triggered? If yes, how? I have seen it done via a message a stamp using MailMarshal & ASTPS. I am using Exim, sa-exim and SpamAssassin. All are the latest stable releases. Many thanks Regards, Tom

1 0

RE: [SURBL-Discuss] free host: greatnow.com
by Chris Santerre 25 Oct '04

25 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, October 22, 2004 2:18 PM >To: Chris Santerre >Cc: 'Jeff Chan'; SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] free host: greatnow.com > > >On Friday, October 22, 2004, 11:00:56 AM, Chris Santerre wrote: >> I thought we had a discussion on this already? The list I >added has been in >> there for like 2 months. I went thru it. I do NOT use this >guys list nilly >> willy. I haven't updated that file in 2 months. I only took >his 100 recent >> changes, and went thru it and pulled a bunch out that were >in question. > >This was the most recent discussion I could find. It doesn't >seem to mention actually using the jayallen data in WS, though I >might have missed a message: > Fine. Removed. A known blog spammer host gets one FP and we remove then all. Done. --Chris

2 4

Fwd: Re: [SURBL-Discuss] Re: Non-SA URIBLs no longer hitting with SA 3.0.1
by Jeff Chan 25 Oct '04

25 Oct '04

This is a forwarded message From: Burnie <burnie(a)dod.no> To: users(a)spamassassin.apache.org Date: Sunday, October 24, 2004, 2:16:08 PM Subject: [SURBL-Discuss] Re: Non-SA URIBLs no longer hitting with SA 3.0.1 ===8<==============Original message text=============== "Bill Landry" <billl(a)pointshare.com> writes: > urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 > header URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') ^^^^^^ Change this to 'body' (Just found this myself. Thanks for the input) >From Changelog: --------- r54022 | felicity | 2004-10-07 22:21:30 +0000 (Thu, 07 Oct 2004) | 1 line bug 3734: uridnsbl rules work on body data, not header data, so change the rule type from header to body --------- -- Bernt 'Burnie' Pettersen /// DoD#2345 NAF <E-mail:burnie@dod.no> /// <URL:http://burnie.sh/> Well, actually I couldn't find a better signature here..... ===8<===========End of original message text===========

2 1

Re: [SURBL-Discuss] Re: Non-SA URIBLs no longer hitting with SA 3.0.1
by Bill Landry 24 Oct '04

24 Oct '04

----- Original Message ----- From: "Burnie" <burnie(a)dod.no> > "Bill Landry" <billl(a)pointshare.com> writes: > > > urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 > > header URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') > ^^^^^^ > > Change this to 'body' > > (Just found this myself. Thanks for the input) > > >From Changelog: > --------- > r54022 | felicity | 2004-10-07 22:21:30 +0000 (Thu, 07 Oct 2004) | 1 > line > > bug 3734: uridnsbl rules work on body data, not header data, so change > the rule type from header to body > --------- Thanks Burnie, that was it. I even saw this in the changelog file when I did the upgrade a couple of days ago, but totally forgot about it when trying to resolve this today. Bill

1 0

Re: Non-SA URIBLs no longer hitting with SA 3.0.1
by Raymond Dijkxhoorn 24 Oct '04

24 Oct '04

Hi! >> The first two are typically very heavy hitters for me, so to see no hits >> since the upgrade is strange. Is anyone else that has upgrade to SA 3.0.1 >> seeing the same results? > Make sure the plugin is loaded in init.pre. Also, try sending a test message > (see the SURBL web site or this list's recent archives for details) while > running SA in debug mode to confirm whether the checks are really being > skipped. They are, 100%, all other URIBL checks are just processed ok, ones that i have inside my local.cf are skipped. Bye, Raymond.

2 6

Re: Non-SA URIBLs no longer hitting with SA 3.0.1
by Bill Landry 24 Oct '04

24 Oct '04

----- Original Message ----- From: "Sahil Tandon" <sahil(a)hamla.org> > > The first two are typically very heavy hitters for me, so to see no hits > > since the upgrade is strange. Is anyone else that has upgrade to SA 3.0.1 > > seeing the same results? > > Make sure the plugin is loaded in init.pre. Also, try sending a test > message (see the SURBL web site or this list's recent archives for > details) while running SA in debug mode to confirm whether the checks > are really being skipped. All SA defined URIBL tests are working fine, it just the ones that I have defined personally in a uribl.cf file in /etc/mail/spamassassin that are not working. These all worked fine with all of the SA 3.0.0 release candidates and with the 3.0.0 release, however, they are not working now since the upgrade to SA 3.0.1. BTW, in my /etc/mail/spamassassin/init.pre: # URIDNSBL - look up URLs found in the message against several DNS # blocklists. # loadplugin Mail::SpamAssassin::Plugin::URIDNSBL I even tried renaming my file to urisbl.bak and adding them directly to the SA 25_uribl.cf file, and they still do not work. Very strange... Bill

2 1

Non-SA URIBLs no longer hitting with SA 3.0.1
by Bill Landry 24 Oct '04

24 Oct '04

The last hit I've seen from any of the following privately defined URIBL lists was Oct 22 21:09:04, which is when I upgraded to SA 3.0.1: ===== urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 header URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') describe URIBL_JP_SURBL Contains a URL listed in the JP SURBL blocklist tflags URIBL_JP_SURBL net score URIBL_JP_SURBL 4.0 urirhsbl URIBL_MP block.rhs.mailpolice.com. A header URIBL_MP eval:check_uridnsbl('URIBL_MP') describe URIBL_MP Contains a URL listed in the MP SURBL blocklist tflags URIBL_MP net score URIBL_MP 2.0 urirhsbl URIBL_UC uc.sasknow.com. A header URIBL_UC eval:check_uridnsbl('URIBL_UC') describe URIBL_UC Contains a URL listed in the UC SURBL blocklist tflags URIBL_UC net score URIBL_UC 0.5 ===== The first two are typically very heavy hitters for me, so to see no hits since the upgrade is strange. Is anyone else that has upgrade to SA 3.0.1 seeing the same results? Bill

2 2

RE: [SURBL-Discuss] SURBL meeting at Linuxworld expo in Boston?
by Chris Santerre 23 Oct '04

23 Oct '04

>-----Original Message----- >From: William Stearns [mailto:wstearns@pobox.com] >Sent: Friday, October 22, 2004 5:06 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] SURBL meeting at Linuxworld expo >in Boston? > > >Good afternoon, Justin, all, > >On Fri, 22 Oct 2004, Justin Mason wrote: > >> Theo Van Dinter writes: >> > On Fri, Oct 22, 2004 at 11:43:56AM -0400, Chris Santerre wrote: >> > > LinuxWorldexpo.com is Feb 14-17 in Boston, MA. Any hope >of having a mini >> > > SURBL/SARE meeting? Just to meet face to face. >> > >> > There's (probably) also the Spam Conference at MIT in >January (it's always a >> > last minute thing). Hey, it was only -7 degrees last year... ;) >> >> It was bracing! seriously, that kind of weather is great fun >for a SoCal >> resident like myself. I'd almost forgotten what cold felt like ;) >> >> > I wasn't planning to goto LWE, but I'd be likely to swing >by to meet >> > folks if there's enough people going. >> >> I'd be unlikely to make it -- transcontinental trips aren't >so easy to get >> unless there's a spam-related conference at the other end :( > > Why don't we plan to meet before/after the spam conference >instead, then? > Cheers, Works for me. Are pants optional? --Chris

3 2

RE: [SURBL-Discuss] free host: greatnow.com
by Matthew Wilson 23 Oct '04

23 Oct '04

Folks, If I were a spammer monitoring this list's traffic (there have got to be some), I would buy up a bunch of domains that were registered a few years ago but expired, throw up a bunch of bogus "legitimate looking" content, send out a bunch of spam using those "legitimate" domain names, and then complain to Jeff et al. that SURBL is generating false positives. According to current policies, my sites would be whitelisted, "yay!". It's my opinion that you have to draw the line somewhere because of this, and hosting entities who don't have compliant AUPs or enforce their AUPs with any speed need to be listed somehow. Jeff, you really should consider creating a separate "semi-legitimate" list for entities such as greatnow.com, if only to appease those of us who don't necessarily keep often-updated private blacklists and whitelists for SURBL queries/hits. Thanks, Matthew Wilson. -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan Sent: Friday, October 22, 2004 1:29 PM To: SURBL Discuss Subject: Re: [SURBL-Discuss] free host: greatnow.com On Friday, October 22, 2004, 11:27:25 AM, Jeff Chan wrote: > There's a difference between removing the entire list and checking > them carefully before using them. > We can use the data if we check it first. Can you post or link the list so we can all see the data and comment on it? Jeff C. -- "If it appears in hams, then don't list it." _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

4 4

SURBL meeting at Linuxworld expo in Boston?
by Chris Santerre 22 Oct '04

22 Oct '04

I know its early, but if I don't schedule early, I may never get the chance to. LinuxWorldexpo.com is Feb 14-17 in Boston, MA. Any hope of having a mini SURBL/SARE meeting? Just to meet face to face. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

6 6

RE: [SURBL-Discuss] free host: greatnow.com
by Chris Santerre 22 Oct '04

22 Oct '04

>-----Original Message----- >From: jm(a)jmason.org [mailto:jm@jmason.org] >Sent: Friday, October 22, 2004 3:49 PM >To: SURBL Discussion list >Cc: csanterre(a)merchantsoverseas.com >Subject: Re: [SURBL-Discuss] free host: greatnow.com > > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >Matthew Wilson writes: >> Folks, >> >> If I were a spammer monitoring this list's traffic (there >have got to be >> some), I would buy up a bunch of domains that were registered a few >> years ago but expired, throw up a bunch of bogus "legitimate looking" >> content, > >yep, the google-spammers are doing that already. > >> send out a bunch of spam using those "legitimate" domain names, >> and then complain to Jeff et al. that SURBL is generating false >> positives. According to current policies, my sites would be >> whitelisted, "yay!". > >this is a possible problem, alright. But as far as I can see Jeff >has been saying to *check* the possible false positive domains, not >to just blindly whitelist them. And we do check them. Find that they have in the past, and currently host a BUNCH of spam. But they get one legit use. So they get whitelisted on WS, according to the policy. So I follow the policy of WS. Only choice is to submit this stuff to a list with a different policy. --Chris

1 0

RE: [SURBL-Discuss] free host: greatnow.com
by Chris Santerre 22 Oct '04

22 Oct '04

There is such a list being worked on called UC. I haven't been putting much effort into it as much as WS. But that is about to change very soon. And I COMPLETELY agree with your example. More then you know. And I can't in good concience let that happen. --Chris >-----Original Message----- >From: Matthew Wilson [mailto:matthew@boomer.com] >Sent: Friday, October 22, 2004 3:25 PM >To: SURBL Discussion list >Cc: csanterre(a)merchantsoverseas.com >Subject: RE: [SURBL-Discuss] free host: greatnow.com > > >Folks, > >If I were a spammer monitoring this list's traffic (there have >got to be >some), I would buy up a bunch of domains that were registered a few >years ago but expired, throw up a bunch of bogus "legitimate looking" >content, send out a bunch of spam using those "legitimate" >domain names, >and then complain to Jeff et al. that SURBL is generating false >positives. According to current policies, my sites would be >whitelisted, "yay!". > >It's my opinion that you have to draw the line somewhere because of >this, and hosting entities who don't have compliant AUPs or enforce >their AUPs with any speed need to be listed somehow. > >Jeff, you really should consider creating a separate "semi-legitimate" >list for entities such as greatnow.com, if only to appease those of us >who don't necessarily keep often-updated private blacklists and >whitelists for SURBL queries/hits. > >Thanks, >Matthew Wilson. > >-----Original Message----- >From: discuss-bounces(a)lists.surbl.org >[mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan >Sent: Friday, October 22, 2004 1:29 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] free host: greatnow.com > >On Friday, October 22, 2004, 11:27:25 AM, Jeff Chan wrote: >> There's a difference between removing the entire list and checking >> them carefully before using them. > >> We can use the data if we check it first. > >Can you post or link the list so we can all see the data and comment on >it? > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > > > >

1 0

RE: [SURBL-Discuss] SURBL meeting at Linuxworld expo in Boston?
by Chris Santerre 22 Oct '04

22 Oct '04

LOL I was on my way up last Jan, when my car froze up by the MA line! Going to check my antifreeze BEFORE I go this year. So I hope to be at both. --Chris >-----Original Message----- >From: Theo Van Dinter [mailto:felicity@kluge.net] >Sent: Friday, October 22, 2004 2:28 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] SURBL meeting at Linuxworld expo >in Boston? > > >On Fri, Oct 22, 2004 at 11:43:56AM -0400, Chris Santerre wrote: >> LinuxWorldexpo.com is Feb 14-17 in Boston, MA. Any hope of >having a mini >> SURBL/SARE meeting? Just to meet face to face. > >There's (probably) also the Spam Conference at MIT in January >(it's always a >last minute thing). Hey, it was only -7 degrees last year... ;) > >I wasn't planning to goto LWE, but I'd be likely to swing by to meet >folks if there's enough people going. > >-- >Randomly Generated Tagline: >"Fuel gauges seem to be difficult to design. For example, the FAA > requires aircraft fuel gauges to be accurate at one point only, when > showing EMPTY. When I am 10,000 feet in the air and the tank >is empty on > my single engine plane, I have very obvious indication that >it is empty. > The sudden quiet is the loudest sound you will ever hear!" - Al Hodges >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] free host: greatnow.com
by Chris Santerre 22 Oct '04

22 Oct '04

gone. >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, October 22, 2004 2:14 PM >To: Chris Santerre >Cc: 'Jeff Chan'; SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] free host: greatnow.com > > >On Friday, October 22, 2004, 11:00:56 AM, Chris Santerre wrote: >> I thought we had a discussion on this already? The list I >added has been in >> there for like 2 months. I went thru it. I do NOT use this >guys list nilly >> willy. I haven't updated that file in 2 months. I only took >his 100 recent >> changes, and went thru it and pulled a bunch out that were >in question. > >> So the original file was looked thru by me and never >changed. And only 80 or >> so were added out of the 100 latest updated. I probably >won't look at this >> again for another 2 months as it takes a while to go thru them. > >> I don't add anything blindly. I don't want FPs either. > >> Why, is greatnow.com being listed a problem? > >Because it had a mention in a ham, which you got cc'ed on. >It was about bluetooth code hosted at greatnow.com. > >Here are some more possible FPs from that list, based >on DMOZ hits (they're not all FPs, but some are): > > http://spamcheck.freeapp.net/whitelists/check-ws-dmoz.txt > >/home/gorilla/black-gorilla-9_7_04_SCblog.txt in nouse-white-jeffc-dmoz Snip

1 0

RE: [SURBL-Discuss] free host: greatnow.com
by Chris Santerre 22 Oct '04

22 Oct '04

I thought we had a discussion on this already? The list I added has been in there for like 2 months. I went thru it. I do NOT use this guys list nilly willy. I haven't updated that file in 2 months. I only took his 100 recent changes, and went thru it and pulled a bunch out that were in question. So the original file was looked thru by me and never changed. And only 80 or so were added out of the 100 latest updated. I probably won't look at this again for another 2 months as it takes a while to go thru them. I don't add anything blindly. I don't want FPs either. Why, is greatnow.com being listed a problem? "Talk to me Goose!" --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, October 22, 2004 1:39 PM >To: Chris Santerre >Cc: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] free host: greatnow.com > > >On Friday, October 22, 2004, 7:21:56 AM, Chris Santerre wrote: >> Thanks, I'll add his last 100 changes as well. > >> --Chris > >>>-----Original Message----- >>>From: Steven Champeon [mailto:schampeo@hesketh.com] >>>Sent: Friday, October 22, 2004 10:01 AM >>>To: 'SURBL Discussion list' >>>Subject: Re: [SURBL-Discuss] free host: greatnow.com >>> >>> >>> >>>Yep - confirmed. 'greatnow.com' is listed. >>> >>>http://www.jayallen.org/comment_spam/blacklist.txt > >I really think we should discuss AND TEST adding new data sources >before adding them to WS or any other list. There seem to be >a lot of FPs in this blog list. > >If we don't discuss and test these first, I may just remove them >from WS. > >Jeff C. >-- >"If it appears in hams, then don't list it." >

2 2

RE: [SURBL-Discuss] free host: greatnow.com
by Chris Santerre 22 Oct '04

22 Oct '04

These are the only hits you had listed from that list of blog sites: da.ru home.ro it.tt netfirms.com sexushost.com xfreehosting.com I wouldn't consider this a 'new' source either. The source is still me. I'm responsible for checking them and adding. If there is an FP it is my fault. I will remove these from the original file. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, October 22, 2004 1:39 PM >To: Chris Santerre >Cc: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] free host: greatnow.com > > >On Friday, October 22, 2004, 7:21:56 AM, Chris Santerre wrote: >> Thanks, I'll add his last 100 changes as well. > >> --Chris > >>>-----Original Message----- >>>From: Steven Champeon [mailto:schampeo@hesketh.com] >>>Sent: Friday, October 22, 2004 10:01 AM >>>To: 'SURBL Discussion list' >>>Subject: Re: [SURBL-Discuss] free host: greatnow.com >>> >>> >>> >>>Yep - confirmed. 'greatnow.com' is listed. >>> >>>http://www.jayallen.org/comment_spam/blacklist.txt > >I really think we should discuss AND TEST adding new data sources >before adding them to WS or any other list. There seem to be >a lot of FPs in this blog list. > >If we don't discuss and test these first, I may just remove them >from WS. > >Jeff C. >-- >"If it appears in hams, then don't list it." >

1 0

RE: [SURBL-Discuss] free host: greatnow.com
by Chris Santerre 22 Oct '04

22 Oct '04

Thanks, I'll add his last 100 changes as well. --Chris >-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Friday, October 22, 2004 10:01 AM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] free host: greatnow.com > > > >Yep - confirmed. 'greatnow.com' is listed. > >http://www.jayallen.org/comment_spam/blacklist.txt > >-- >join us! http://hesketh.com/about/careers/web_designer.html > join us! >hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us! http://hesketh.com/about/careers/account_manager.html join us! _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

RE: [SURBL-Discuss] free host: greatnow.com
by Chris Santerre 22 Oct '04

22 Oct '04

I sent you info on the whitelist list. HUGE spam host for blog spammers. HUGE! They don't care who the heck they host for as long as they have money. I gave you quite a good list of examples. Greatnow.com needs to stay forever listed. They are scumbags. Large ones at that, not the fly by night ones. They just don't fit withn the normal radar we look at for SURBL. Steve C originaly gave me the submission. You will notice the file name they hit on contains 'blog'. You can look at some of the outright damage this domain has done to people's blogs around the web. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, October 22, 2004 5:34 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] free host: greatnow.com > > >On Friday, October 22, 2004, 12:10:38 AM, Jeff Chan wrote: >> Got an FP report about greatnow.com, an apparent free hosting >> company. Based on DMOZ hits, they seem to have some legitimate >> uses. They also have a few NANAS hits. They are not in SBL. >> They probably have some minor abuse. > >> Does anyone know anything more about them? > >> Source is: > >> /home/gorilla/black-gorilla-9_7_04_SCblog.txt:greatnow.com > >> Jeff C. > >Since this domain appears to have legitimate uses, I went >ahead and whitelisted them. Chris if you get a chance, >please review and see why we listed them originally. > >Thanks, > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 2

Strategies for killing abusive glue records
by Andy Warner 22 Oct '04

22 Oct '04

Has anybody on the list found a good strategy for getting registrars to terminate name server glue records that are widely used to provide name service to spamvertised domains. (i.e. ns1.fast111.biz) I've had good luck with a few registrars (Joker, GoDaddy), but at most, I'm running to a brick wall. Either the abuse folks are not empowered to remove glue records or they don't even know what a glue record is. It is scary how many folks who work for registrars think REGISTRAR-HOLD status will kill the glue records too when it only prevents the name servers from that domain being published to the roots in association with the domain in question). As it can be fairly time consuming to build a good case for killing a glue record, I wanted to see if other folks were working on this and if anybody might be having better luck. -- Andy Warner andy(a)andy.net

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss