- Discuss - Mailman 3

They found away around SURBL
by Chris Santerre 09 Oct '04

09 Oct '04

No link whatsoever. NO phone number either. No site mentioned. Nothing :) Maybe they just want to tease the reader :) Too bad this scored 15.1 points without surbl :) --Chris ----- Message-ID: <41665F37.67DCCE6F(a)siba.fi> From: Kent Bryan <kbryan_cd(a)siba.fi> To: Chris Santerre <csanterre(a)MerchantsOverseas.com> Subject: This worked for me, and will for you! Date: Fri, 8 Oct 2004 05:34:47 -0400 X-Mailer: Internet Mail Service (5.5.2653.19) ---------------------------------------------------------------------- - R.ated N.O.1 Pe.nis Enlargeme.nt P.ill on the Mar.ket! - - Gain up to 3+ full inches in length. - Increase your peni.s width by 20.%. - Stop Prema.ture Ejacu.lation. - Produce Strong.er and R.ock Ha.rd Erect.ions ----------------------------------------------------------------------

6 5

Re: [SURBL-Discuss] Revised DMOZ data, got Wikipedia domains too
by Frank Ellermann 09 Oct '04

09 Oct '04

Jeff Chan wrote: > Would there be many FNs (missed spams) if we whitelisted > all of these? In other words are these all truly False > Positives? > If not, which ones do you feel are true spammers and why. If WS and SC agree on something (or even more of the SURBLs) they might have a point. I tried to check kit.net (found in your list), and got an "unknown host" error. So maybe that was a FN (= spammer). I also tried to check made.com (on your original DMOZ list, it was listed in SC and AB IIRC), and came to the conclusion that this might be a Korean hoster. The subdomain listed in DMOZ looked pretty ordinary (at least the non-Flash part), no offers to buy something. But that could be misleading, I didn't visit the site with enabled JS. And of course the reason for the SC listing could be another subdomain, not the one listed by DMOZ. But made.com could be a FP (?) Hard to judge. More than one bit in multi is a hint. Bye.

1 0

Revised DMOZ data, got Wikipedia domains too
by Jeff Chan 09 Oct '04

09 Oct '04

Following up on the earlier check of DMOZ domains against SURBL data, I applied some of Quinlan's suggestions and grabbed different revisions of the DMOZ data and joined (intersected) them in order to eliminate changes due to things like editor- removed spammer/abuser domains, etc. This also means that new additions are ignored, but the corpus is so large that the benefits of capturing editor removals is probably more important. Snapshots are the three most recent available from 9/9/04, 9/25/04 and 10/7/04 (file dates) are intersected, resulting in fewer records (only those that are constant across all three snapshots): http://rdf.dmoz.org/rdf/archive/ Here are the line, word and character counts: 2300851 2300851 38065969 dmoz.srt 1169 11690 123909 dmoz-blocklist.summed.txt 1141 11410 120860 dmoz-blocklist.ws 1169 1169 17977 dmoz-blocklist.txt 7394 7394 97011 dmoz-whitelist.txt The above are revised versions of joins on blocklists, with list info, with ws hits, with just domains, and against the whitelist. These are in the whitelists directory, though we are still *not* applying the dmoz domains as whitelists: http://spamcheck.freeapp.net/whitelists/ The previous dmoz (9/25 version only IIRC) and hits are archived as: 2326173 2326173 38494184 dmoz.srt1 1338 13380 141946 dmoz-blocklist1.summed.txt 1173 11730 124298 dmoz-blocklist1.ws 1338 1338 20533 dmoz-blocklist1.txt 7375 7375 96720 dmoz-whitelist1.txt __ I was also able to grab 4 snapshots of the wikipedia, all sections (all languages). Only the two most recent snapshots had comparable numbers of sections so I used only those two. Using only two sets may be ok, since these are much smaller corpora and there's probably more hand-editing of them. http://download.wikimedia.org/ Where dmoz has about 2.3 million domains, wikipedia has about 174k domains: 173828 173828 2633441 wikipedia.srt 188 1880 19631 wikipedia-blocklist.summed.txt 188 188 2713 wikipedia-blocklist.txt 2437 2437 29581 wikipedia-whitelist.txt __ I also took the intersection of the three dmoz snapshots and the two wikipedia snapshots to get a smaller list containing only the ~102k domains found in both wikipedia and dmoz: 101619 101619 1498653 wikipedia-dmoz.srt 116 1160 11928 wikipedia-dmoz-blocklist.summed.txt 116 116 1591 wikipedia-dmoz-blocklist.txt 2223 2223 26854 wikipedia-dmoz-whitelist.txt This intersection of dmoz and wikipedia domains probably represents the best hope for large whitelist additions so far. This is probably imperfect data, but at least it has some checks by human editors and techniques applied to reduce spammer domains, including comparing the snapshots over time and intersecting the two relatively unrelated sources. Can anyone think of any other hand-edited databases, directories, encyclopedias, etc of URIs of hopefully legitimate (non-spammer) domains that are publically available? Please think about it a little, and speak up! While 102k domains isn't nearly as large as the 2.3M in dmoz, it's certainly more than the 12k or so whitelist records we currently have. How does the intersected list look as a potential whitelist? http://spamcheck.freeapp.net/whitelists/wikipedia-dmoz.srt Please also take a look at these blocklist hits (potential FPs) and share what you think: http://spamcheck.freeapp.net/whitelists/wikipedia-dmoz-blocklist.summed.txt Would there be many FNs (missed spams) if we whitelisted all of these? In other words are these all truly False Positives? If not, which ones do you feel are true spammers and why. Jeff C. -- "If it appears in hams, then don't list it."

4 9

RE: Revised DMOZ data, got Wikipedia domains too
by Chris Santerre 09 Oct '04

09 Oct '04

First, great work Jeff. > >While 102k domains isn't nearly as large as the 2.3M in dmoz, >it's certainly more than the 12k or so whitelist records we >currently have. How does the intersected list look as a >potential whitelist? > > http://spamcheck.freeapp.net/whitelists/wikipedia-dmoz.srt > I think this is just plain nuts to whitelist all of these! Why? If we don't try to whitelist the most popular sites, then what the heck it the point? We could whitelist millions of legit domains forever. The popular ones are the most important. Here is one from the above list. Why would listing this help us? http://oigawa-railway.co.jp/ (looks like a real popular site huh!) >Please also take a look at these blocklist hits (potential FPs) >and share what you think: > > http://spamcheck.freeapp.net/whitelists/wikipedia-dmoz-blocklist.summed.txt I picked of few of these that may give us problems, and none of them met our current criteria to list. (sissy-world.com, good grief that had to be a man at one time!) With the ability to now see whitelisted domains in the crossref page, I don't see a problem with whitelisting all these on the list. Because if they do start spamming again, we can see they are whitelisted and remove them. so: -1 for adding all those intersected to WL +1 for whitelisting the blacklist hits. --Chris

3 4

servepath is pissing me off
by Chris Santerre 09 Oct '04

09 Oct '04

they host these idiots and a bunch more! theviralspiral.com I think servepath.com sould be listed. They host obvious spam houses. And they don't host many domains, so to say they didn't know this was a spammer is a complete joke. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 2

RE: [SURBL-Discuss] RE: Revised DMOZ data, got Wikipedia domains too
by Chris Santerre 08 Oct '04

08 Oct '04

>-----Original Message----- >From: Bill Landry [mailto:billl@pointshare.com] >Sent: Friday, October 08, 2004 3:06 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] RE: Revised DMOZ data, got Wikipedia >domains too > > >----- Original Message ----- >From: "Chris Santerre" <csanterre(a)merchantsoverseas.com> > >> >> I think this is just plain nuts to whitelist all of >these! Why? If we >> >> don't try to whitelist the most popular sites, then what >the heck it >> >> the point? We could whitelist millions of legit domains >forever. The >> >> popular ones are the most important. >> > >> >The points: >> > >> > - whitelisting legitimate domains limits the >effectiveness of joe job >> > attacks that result in FPs in various SURBL blacklists >> > - whitelisting could be used as negative points for MAIL FROM if >> > combined with SPF (and more domains is better) >> >> Yeah, but not everyone is using SPF yet. But if they were, sure! >> > >> >In addition: >> > >> > - I would only whitelist those domains (a) subject to editorial >> > removal (b) so long as their domain registration is old >enough and >> > (c) so long as they pass other criteria such as no SBL >listing for >> > NS->A. >> >> Yeah date seems to be key in more and more cases. Granted a >spammer could >> buy one of these older ones, but hasn't happened often enough. >> >> > - I would maintain the automated whitelist separately >from the human >> > edited whitelist and handle it differently. For >example, perhaps >> > automated whitelist entries can only remove a single >blacklist hit >> > (like SpamCop), but to remove two independent blacklist hits, it >> > requires a human decision. >> > >> >> Did you look at the example from the list I gave? It doesn't >even have a >web >> page! Just says testing. I'm all for whitelisting, but popular/useful >> domains only. >> >> >> so: >> >> -1 for adding all those intersected to WL >> >> +1 for whitelisting the blacklist hits. >> > >> >I think there are other options available due to the miracle of >> >programming. ;-) >> >> Well like they say around here, "You can't argue with success." >> >> But taking away spam points based on an autowhitelist still makes me >> nervous. But you might have a few tricks up your sleeve D.Q. >that I don't >> know about yet ;) > >If the whitelist is setup as a SURWL, for example, using it or >not would be >an option to each individual mail administrator. And the >negative weight >applied to reduce the score would be totally dependant on the >discretion of >the SURWL user. > True, and having the option is good. Having the work overhead to do that on top of doing the blacklists is not. And the logic stands if it ain't blacklisted, it must be good ;) --Chris

2 1

RE: [SURBL-Discuss] Revised DMOZ data, got Wikipedia domains too
by Chris Santerre 08 Oct '04

08 Oct '04

>-----Original Message----- >From: Bill Landry [mailto:billl@pointshare.com] >Sent: Friday, October 08, 2004 3:26 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Revised DMOZ data, got Wikipedia domains >too > > >----- Original Message ----- >From: "Ryan Thompson" <ryan(a)sasknow.com> > >> >> I wouldn't appreciate it being whitelisted as then if >there's abuse, >> >> and it does get blacklisted, there's no pressure on the >domain holder >> >> to clean up. >> > >> > I'm hoping UC list will help with that. Anyone who wishes to use it >> > can add a minor score to spam for UC hits. This would put at least >> > some sort of preasure for these grey hats to do something. >> >> Ezzactly. Even if it's worth 0.1 points in SA (or >something), the stigma >> of having one's domain listed in some sort of bad "list" >might be enough >> to promote action, provided the accuracy of UC is quite >good. (I.e., we >> definitely still don't want to list everything :-) "Quite >good" in that >> case probably means < 1% FP, but I think we can do even >better than that >> with a few clever tricks. >> >> Personally, I'm hoping UC will be worth more than 0.1 even with a >> somewhat higher FP rate, since there will be little or no >overlap with >> other SURBL tests, but that'll depend on some mass-checks. :-) > >I have been tracking my hits from UC, and although the hit >rate if fairly >low compared to most of the SURBL lists, it has been giving me >good results >and hitting things I would consider spam. And as such, I have the test >currently weighted at 0.5. > >Bill LOL, thats cause UC just ain't that big yet. I keep trying to keep up with all the domains Jeff keeps whitelisting, but he's like some sort of mad robot on overdrive ;) --Chris (Good grief I've been hungry all day!)

1 0

RE: [SURBL-Discuss] Revised DMOZ data, got Wikipedia domains too
by Chris Santerre 08 Oct '04

08 Oct '04

>-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Friday, October 08, 2004 12:51 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Revised DMOZ data, got Wikipedia domains >too > > >Bill Landry wrote: >> ----- Original Message ----- >> From: "Alex Broens" <surbl(a)alexb.ch> >> >>>Jeff Chan wrote: >>> >>>> http://spamcheck.freeapp.net/whitelists/wikipedia-dmoz.srt >>>> >>>>Please also take a look at these blocklist hits (potential FPs) >>>>and share what you think: >>>> >>>> >> >> >http://spamcheck.freeapp.net/whitelists/wikipedia-dmoz-blocklis >t.summed.txt >> >>>>Would there be many FNs (missed spams) if we whitelisted all >>>>of these? In other words are these all truly False Positives? >>>>If not, which ones do you feel are true spammers and why. >>> >>>probably not a new idea, but why not run a "wl.surbl.org" >with all the >>>whitelisted domains and ppl can choose to use it or not. >> >> >> I like this idea! Whitelist the most commonly used 1,000 or >so domains, and >> then create a wl.surbl.org for the rest of the >wikipedia-dmoz domains. > >WOW... Bill didn't bark at me this time. > >my point is the following: > >take for example "angelfire. com". This domain may have >legitimate users >but my user base would NEVER have contact with anybody hosting >a site or >anything there. If they support spam, list them, put pressure >on them to >stop supporting spammers, bla, bla, bla. >I wouldn't appreciate it being whitelisted as then if there's >abuse, and >it does get blacklisted, there's no pressure on the domain holder to >clean up. I'm hoping UC list will help with that. Anyone who wishes to use it can add a minor score to spam for UC hits. This would put at least some sort of preasure for these grey hats to do something. > >As I imagine we're fighting spam here, not just filtering, I have a >certain difficulty understanding why the world is crying for >whitelisting instead of putting pressure on so called whitehats who >support abuse for a lifetime. I completely agree, but when working with SURBL I can't use this mindset. I have to go by Jeff's vision. However with UC its a whole different ball game. > >as Chris said, you could make whitelisting a lifetime task. >I believe the better approach would be to decrease potential FP's by >increasing the reporting QUALITY !!!!!!!! > >Alex > >//Are we fighting Spam or working for Messagelabs & Co. for free? // OUCH!!! I hear ya.....but OUCH! ;) --Chris

3 2

RE: Revised DMOZ data, got Wikipedia domains too
by Chris Santerre 08 Oct '04

08 Oct '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Friday, October 08, 2004 2:01 PM >To: Chris Santerre >Cc: 'Jeff Chan'; SURBL Discuss; SpamAssassin Developers >Subject: Re: Revised DMOZ data, got Wikipedia domains too > > >Chris Santerre <csanterre(a)MerchantsOverseas.com> writes: > >> I think this is just plain nuts to whitelist all of these! Why? If we >> don't try to whitelist the most popular sites, then what the heck it >> the point? We could whitelist millions of legit domains forever. The >> popular ones are the most important. > >The points: > > - whitelisting legitimate domains limits the effectiveness of joe job > attacks that result in FPs in various SURBL blacklists > - whitelisting could be used as negative points for MAIL FROM if > combined with SPF (and more domains is better) Yeah, but not everyone is using SPF yet. But if they were, sure! > >In addition: > > - I would only whitelist those domains (a) subject to editorial > removal (b) so long as their domain registration is old enough and > (c) so long as they pass other criteria such as no SBL listing for > NS->A. Yeah date seems to be key in more and more cases. Granted a spammer could buy one of these older ones, but hasn't happened often enough. > - I would maintain the automated whitelist separately from the human > edited whitelist and handle it differently. For example, perhaps > automated whitelist entries can only remove a single blacklist hit > (like SpamCop), but to remove two independent blacklist hits, it > requires a human decision. > Did you look at the example from the list I gave? It doesn't even have a web page! Just says testing. I'm all for whitelisting, but popular/useful domains only. >> so: >> -1 for adding all those intersected to WL >> +1 for whitelisting the blacklist hits. > >I think there are other options available due to the miracle of >programming. ;-) > Well like they say around here, "You can't argue with success." But taking away spam points based on an autowhitelist still makes me nervous. But you might have a few tricks up your sleeve D.Q. that I don't know about yet ;) --Chris

2 1

Re: Revised DMOZ data, got Wikipedia domains too
by Daniel Quinlan 08 Oct '04

08 Oct '04

Chris Santerre <csanterre(a)MerchantsOverseas.com> writes: > I think this is just plain nuts to whitelist all of these! Why? If we > don't try to whitelist the most popular sites, then what the heck it > the point? We could whitelist millions of legit domains forever. The > popular ones are the most important. The points: - whitelisting legitimate domains limits the effectiveness of joe job attacks that result in FPs in various SURBL blacklists - whitelisting could be used as negative points for MAIL FROM if combined with SPF (and more domains is better) In addition: - I would only whitelist those domains (a) subject to editorial removal (b) so long as their domain registration is old enough and (c) so long as they pass other criteria such as no SBL listing for NS->A. - I would maintain the automated whitelist separately from the human edited whitelist and handle it differently. For example, perhaps automated whitelist entries can only remove a single blacklist hit (like SpamCop), but to remove two independent blacklist hits, it requires a human decision. > so: > -1 for adding all those intersected to WL > +1 for whitelisting the blacklist hits. I think there are other options available due to the miracle of programming. ;-) Daniel -- Daniel Quinlan ApacheCon! 13-17 November (3 SpamAssassin http://www.pathname.com/~quinlan/ http://www.apachecon.com/ sessions & more)

1 0

RE: [SURBL-Discuss] Revised DMOZ data, got Wikipedia domains too
by Chris Santerre 08 Oct '04

08 Oct '04

>-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Friday, October 08, 2004 11:53 AM >To: Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] Revised DMOZ data, got Wikipedia domains >too > > >Jeff Chan wrote: >> http://spamcheck.freeapp.net/whitelists/wikipedia-dmoz.srt >> >> Please also take a look at these blocklist hits (potential FPs) >> and share what you think: >> >> >http://spamcheck.freeapp.net/whitelists/wikipedia-dmoz-blocklis >t.summed.txt >> >> Would there be many FNs (missed spams) if we whitelisted all >> of these? In other words are these all truly False Positives? >> If not, which ones do you feel are true spammers and why. > >probably not a new idea, but why not run a "wl.surbl.org" with all the >whitelisted domains and ppl can choose to use it or not. > > IMHO More traffic and scan time. Better to just ignore having them in the list. Also things like Yahoo, AOL, ect... will most likely have SA code to not even bother to look those up. --Chris

1 0

Possible large whitelist from DMOZ data
by Jeff Chan 08 Oct '04

08 Oct '04

Daniel Quinlan, one of the principal SpamAssassin architects had some good suggestions for reducing false positives in the SURBL data. One was using public databases of URIs, particularly hand-built ones like dmoz.org and wikipedia.org or even yahoo.com as sources of mostly legitimate domains. (The wikipedia is not a web directory in a conventional sense; it's more like an open encyclopedia, but it has a relatively large collection of URIs.) Presumably most of the URIs in these are legitimate and don't belong to spammers, especially in DMOZ since it's hand-built. So the question is: can these be useful as whitelist sources or perhaps as one of the checks on new SURBL additions. The DMOZ open directory publishes it's data in RDF form at: http://rdf.dmoz.org/ So we downloaded the URL data, extracted the domains and compared them against the SURBL block and whitelists: % join dmoz.srt ../multi.domains.sort | wc 1338 1338 20533 % join dmoz.srt ../whitelist-domains.sort | wc 7375 7375 96720 % join dmoz.srt ../multi.domains.sort > dmoz-blocklist.txt % join dmoz.srt ../whitelist-domains.sort > dmoz-whitelist.txt There were 1338 DMOZ hits against our blocklisted domains and 7375 against our whitelists. You can view those matches at: http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.txt http://spamcheck.freeapp.net/whitelists/dmoz-whitelist.txt Of the 1338 DMOZ hits against our blocklists, which arguably could be false positives, most are in WS. Here is a list with the data from multi.surbl.org showing list membership included: %join dmoz.srt ../multi.domains.summed > dmoz-blocklist.summed.txt http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.summed.txt And some list counts from those hits: [ws] hits: 1173 [ob] hits: 165 [jp] hits: 61 [sc] hits: 8 [ab] hits: 4 [ph] hits: 2 These add up to more than 1338 since some records hit multiple lists. The actual hits are in: http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.ws http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.ob http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.jp http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.sc http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.ab http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.ph Data source folks, please review these and try to determine which ones are FPs and which would result in false negatives if they came off the lists. For ones that are FPs you may want to eliminate them on your end. For the ones that could cause FNs, we'd like to know about those as a measure of using the DMOZ data for whitelisting. Right now I'm leaning towards whitelisting all of these, so please speak up! The 7.4k DMOZ whitelist hits represents a majority of the 12.25k whitelist entries that are not reserved .us geographic domains, so there is significant overlap between DMOZ and our existing whitelists, which is probably speaks well for both lists. % wc dotus_reservedlist_v3.lower.sort 52049 52049 1012735 dotus_reservedlist_v3.lower.sort % wc ../whitelist-domains.sort 64299 64299 1169155 ../whitelist-domains.sort % join dmoz.srt dotus_reservedlist_v3.lower.sort | wc 7 7 112 The DMOZ data has about 2.3 million domains. How does anyone feel about adding them to our whitelists? A 1.2 MB gzip of the extracted domains is at: http://spamcheck.freeapp.net/whitelists/dmoz.srt.gz I think we can safely say that whitelisting DMOZ domains will reduce FPs. Probably a more important question is: how many FNs would that cause? In other words, how many purely spam domains are in DMOZ, where whitelisting them would wrongly exclude spam domains from SURBLs? One way to answer that is to note that the lists ab, sc, jp, ph, which have much lower FP rates than ws (measured by the SpamAssassin corpora checks, for example, and also anecdotally by human FP reports) appear relatively infrequently in the DMOZ hits. In other words, SURBL lists that we know are quite spammy like sc, jp, etc. don't match DMOZ often, so the DMOZ data may not have too many spam domains. Similar tests could be done against other proposed whitelists. (We'll probably try the wikipedia data next.) Another concern is that since these directories are relatively open, spammers could simply add themselves and effectively get whitelisted. However I intend to take a snapshot of these and probably not try to refresh the data very often in future (it at all), instead using them as relatively static snapshots of established domains. Doing that would miss some new additions, but could also prevent some future abuse by spammers. On the other hand 2 million domains is a pretty good start.... :-) Extraction scripts are not perfect, particularly in the simplistic chopping to three levels of cctlds, but they're probably adequate: http://spamcheck.freeapp.net/whitelists/extract-dmoz-domains http://spamcheck.freeapp.net/whitelists/chop-two-level-domains.sed http://spamcheck.freeapp.net/whitelists/reduce-to-third-level.sed Comments please, Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

9 23

Strange domains, Get no hits. Are they trying to fool SURBL?
by Martin 08 Oct '04

08 Oct '04

Hi, Got two different spams not getting caught by SURBL. The domains for both of the spams looks like this: http://ss.net.yourstuffspotMUNGED.com?qd="and a tracking id" AND http://mq.net.yourstuffspotMUNGED.com?r="and a tracking id" I checked the domain at rulesemporium and got a hit on yourstuffspotMUNGED.com but not at the subdomains. Somehow SURBL don't catch it even though it's listed on WS. Are they trying to fool SURBL or what is going on? Thanks in advance / Martin

2 3

RE: [SURBL-Discuss] submission to WS
by Chris Santerre 08 Oct '04

08 Oct '04

>-----Original Message----- >From: Martin [mailto:martin.lyberg@idkommunikation.com] >Sent: Thursday, October 07, 2004 10:25 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] submission to WS > > >Hi, > >How long will it take for a submission made to WS at >http://www.rulesemporium.com/cgi-bin/uribl.cgi to become active? > >I wonder because i got a new fresh spam that i submitted, but it's not >yet listed to WS. > >Edit: i just noticed that it got listed on the OB-list. > These submission used to go just to me, not they get split between a few others. THANK GOODNESS!!! So it depends on the person. We have to hand check them. I myself am behind a little on these. But I checked and don't have yours. SO I guess I can only quote game developers when I say "soon." ;) --Chris

3 2

submission to WS
by Martin 08 Oct '04

08 Oct '04

Hi, How long will it take for a submission made to WS at http://www.rulesemporium.com/cgi-bin/uribl.cgi to become active? I wonder because i got a new fresh spam that i submitted, but it's not yet listed to WS. Edit: i just noticed that it got listed on the OB-list. Thank you Martin

5 5

URIBL with "spam sigs" proposal
by Yves Junqueira 07 Oct '04

07 Oct '04

Hi, In some cases, it would be interesting to provide an alternative zone, with a "spam signature info", for domains that could also be used for legitimate purposes. This zone would feature a special TXT part with a regexp or some encoded string that will be used by checking clients to test the message. A fake example: buyziagra.com TXT: listed in re.surbl.org (etc...) #click here.*buy [zvj]iagra# The text between #'s will be used as an regexp that, if matched against the text in slurp mode (whole buffer checked instead of line-by-line), will make the tool return that that e-mail is Spam. I can adapt my suriproxy to do that very easily. (Btw, there is a new test version of suriproxy avaliable with domain whitelisting and a better uri matching algorithm at http://sourceforge.net/projects/pf-aux. Any new feedback would be appreciated) The format I used is just an illustration. It would be ideal to develop or find a simpler "text matching" format then regexp, and yet more powerful, to accept different character coding. The idea of this "URIBL with spam sigs" is to avoid FP's and, specially, to let us list domains in a less restrictive policy. Even if a domain could used for legimate purposes, it could be added to this special zone. I do agree with the current policy used here, but I have several spam arriving everyday, specially from Brazilian domains, that, if the policy is respected, could not get into the list. Yet we need to find a solution for that, and this is my suggestion. This new feature would, then, take two different collaborative anti-spam solutions types - URIBL and on line content checks (Razor, DCC, etc) in a very efficient way and using existing infra-structure, that is, DNS servers. The odds are it would be a bit more difficult to maintain and spam gangs can change the text all the time. Even then, I believe this could be interesting. Do you think this is worth trying? sorry for my bad english, Yves -- Yves Junqueira http://www.lynx.com.br

1 0

Re: [SURBL-Discuss] Possible large whitelist from DMOZ data
by Daniel Quinlan 07 Oct '04

07 Oct '04

Michele Solutions wrote: >> Although directories such as DMOZ are manually edited there is a danger of >> spammers "grabbing" expired domains and abusing them. I've seen a lot of >> scripts for sale that track dmoz listed domains..... Jeff Chan <jeffc(a)surbl.org> writes: > Thanks. That's definitely good to know about. Ah, you could also look at how long a domain has been registered. ;-) Daniel -- Daniel Quinlan ApacheCon! 13-17 November (3 SpamAssassin http://www.pathname.com/~quinlan/ http://www.apachecon.com/ sessions & more)

1 0

Re: Possible large whitelist from DMOZ data
by Daniel Quinlan 07 Oct '04

07 Oct '04

Jeff Chan <jeffc(a)surbl.org> writes: > Those are all good ideas. Do you know if spammer links do get > deleted? How do the folks who maintain the sites find abusers or > bots? Wikipedia tends to find them eventually. Sometimes, spam links can live on a page or two, so higher count links are going to be safer. Also pages that get updated a lot (and the link stays for each revision). Also, while DMOZ might have some spammer links, I suspect most of the spammer links are very stable, well-listed in SBL and your blacklists, etc. It might be easiest to prioritize links by their S/O ratio: (number of blacklist source hits) --------------------------------- (number of whitelist source hits + number of blacklist source hits) Daniel -- Daniel Quinlan ApacheCon! 13-17 November (3 SpamAssassin http://www.pathname.com/~quinlan/ http://www.apachecon.com/ sessions & more)

1 0

Re: Possible large whitelist from DMOZ data
by Daniel Quinlan 07 Oct '04

07 Oct '04

Chris Santerre <csanterre(a)MerchantsOverseas.com> writes: > Wow, it looks like some of the DMOZ data can't be trusted. Some of those > domains in this WS blocklist are pure spammers. DMOZ (and as far as I know, Wikipedia) don't filter URLs based on email policies of those sites. However, the links *should* generally be categorized correctly in the case of DMOZ and useful in the case of Wikipedia. I would not suggest using either to whitelist automatically, but if you get several of these sources and count the number of hits for each domain, then you should be able to prioritize and possibly automatically whitelist the ones that hit in a large number of databases. I would also take snapshots, but for a different reason than the one Jeff suggested. I would take snapshots and take the intersection of two snapshots for each source (two separate days of DMOZ, etc.) as the authoritative list since some spammer links (especially if added by some bot) will drop off once they are found. Clearly, given that most of the hits are in .ws etc. you're in the tail region of false positives. It'll be hard to find a lot. More sources and looking at source counts seems like the best way. Daniel -- Daniel Quinlan ApacheCon! 13-17 November (3 SpamAssassin http://www.pathname.com/~quinlan/ http://www.apachecon.com/ sessions & more)

2 1

RE: Possible large whitelist from DMOZ data
by Chris Santerre 06 Oct '04

06 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, October 06, 2004 5:58 AM >To: SURBL Discuss >Cc: SpamAssassin Developers >Subject: Possible large whitelist from DMOZ data > *snip* > >And some list counts from those hits: > > [ws] hits: 1173 > [ob] hits: 165 > [jp] hits: 61 > [sc] hits: 8 > [ab] hits: 4 > [ph] hits: 2 > >These add up to more than 1338 since some records hit multiple >lists. The actual hits are in: > > http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.ws Wow, it looks like some of the DMOZ data can't be trusted. Some of those domains in this WS blocklist are pure spammers. adultmovienetwork.com has 135+ NANAS hits, is listed in spamhaus, ect..... These need to ALL be checked carefully. Do not use DMOZ to autowhitelist. I will check A-C in this list. Any takers to check the rest? 1173 FPs......I doubt it. --Chris

2 1

Read this policy please
by Fred 06 Oct '04

06 Oct '04

Ok, As I was reviewing a spam domain to submit, I ran across a somewhat disgusting policy I felt the need to share with everyone here. Here is a snipplet: " Additionally, when you open, preview or click on the advertising portion of our e-mails and/or those of our marketing partners and/or affiliates of GroovyUSA, you have agreed to the terms set forth in our Privacy Policy and agree that as a function of opening, previewing or clicking on the advertising portion of our e-mails, that you will receive new or additional marketing communications from us, our marketing partners and/or affiliates of GroovyUSA. " Right before this, they talk about using clear 1 pixel gifs to track what you view, so they are saying, if you view this message, we will send you more and you accept for us to do whatever we want with your information. http://www.groovyusa-MUNGED.net/ Click on the privacy button at the top of the page.

3 3

Experimental CGI GetURI
by Ryan Thompson 05 Oct '04

05 Oct '04

Hey all, I've started phase two of GetURI's development, in the form of a CGI interface. So far, the interface supports lists of ham and spam domains, which will be especially handy for discussions on this list, and for those of you hand-checking lists of submitted domains. I'll also probably at least add a message checker and maybe even an mbox upload feature, based on feedback and testing. The CGI version produces the same output that the commandline version does. (In fact, it uses some clever tricks to communicate with the commandline version and provide progress to the browser). http://ry.ca/cgi-bin/geturi.cgi This will be *especially* useful for all of these "FP" discussions we've been having lately. Now, f'rinstance, if I proclaim topical7074rneds .com should be whitelisted (it shouldn't!!), I could just feed you this: http://ry.ca/cgi-bin/geturi.cgi?domains=topical7074rneds.com&surbl=ws.surbl… ...which is ugly, and gets uglier in a hurry with more domains. So, I implemented caching and unique IDs, so you can just do the lookup yourself, and then cut and paste the resulting (potentially much shorter) link that will show up in your Address bar, like so: http://ry.ca/cgi-bin/geturi.cgi?id=spam-X52p6q8FMYYEINMCsepAG1 These cached results (if referenced by id, as in the last URL) will be available for at least 30 days from their last access time. The page itself describes the caching algorithm in a bit more detail, for those that are interested. Try it out, please, and make some noise about it. It's experimental (read: I started with an idea in my head and a blank file in my editor about 4.5 hours ago), so there are bound to be some interesting bugs. ;-) - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

3 6

Re: [SURBL-Discuss] Read this policy please
by Rob McEwen 05 Oct '04

05 Oct '04

> OE6 on XPsp2 is smart like this now too, by default blocks all external > content. BTW, does anyone here know of a plug-in (or something) to get Outlook XP (office verion, not "outlook express") to do this external image blocking too? I know that image blocking can be done in Outlook 2003, but I don't want to upgrade until the next version of MS Office. Rob McEwen

1 0

Help checking a few FPs
by Jeff Chan 05 Oct '04

05 Oct '04

Got some more FPs from hams: /home/gorilla/black-gorilla-8_04.txt:servebeer.com /web/antispam/outblaze.domains.sort:pacmanhattan.com /web/antispam/mailsecurity.spam.domains:romp.com /home/prolocation/black-prolocation-master:romp.com These all seem to have legitimate uses to me. servebeer.com belongs to dynamic DNS provider No-IP.com so obviously it's subject to some abuse, but it also seems to have legitimate uses. pacmanhattan.com is apparently a university student project to play Pacman on city steets with people. romp.com appears to be a National Lampoon movie site. I'd like to whitelist all of these but would like to hear from Chris, David, Outblaze and Raymond about why they listed them. None have SBL hits. romp and pacman have no NANAS, and as expected serverbeer has 29 NANAS. The full list from the 5 source hams includes the three probable FPs above and some others which are not in SURBLs, but which should probably be whitelisted since they appear in things like Debian Linux newsletters. catb.org debian.org debianforum.de ffii.org gnu.org harddisk-recovery.nl heise.de infodrom.org kitenet.net leidenuniv.nl linuxtag.org opensource.org pacmanhattan.com romp.com servebeer.com spi-inc.org uu.nl wallsplash.net xtronics.com Comments please, Jeff C. -- "If it appears in hams, then don't list it."

4 7

RE: [SURBL-Discuss] Whitelist kit . net
by Chris Santerre 05 Oct '04

05 Oct '04

>-----Original Message----- >From: Yves Junqueira [mailto:yves.junqueira@gmail.com] >Sent: Monday, October 04, 2004 12:04 PM >To: Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] Whitelist kit . net > > >On Mon, 4 Oct 2004 07:29:14 -0700, Jeff Chan <jeffc(a)surbl.org> wrote: >> The policy is: if it has legitimate uses, then don't list. >> >> Can you provide some examples of legitimate sites on kit.net >> (preferably in English)? >> >> Jeff C. > >Sorry, I couldn't find any in english. > >http://www.tmabc.kit.net - >http://www.1mais1.kit.net - They seem good people. They are a group >of volunteers that assist home less people. Doesn't seem to be a scam. > >I'd suggest whitelisting kit.net if, and only if, you are really >strict to the policy. They do host many trojans and scam sites there. > Why not treat them like the tld is 'kit.net' and list on subdomains? --Chris

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss