- Discuss - Mailman 3

OB FPs
by Alex Broens 30 Sep '04

30 Sep '04

While I always read how reliable OB should be, of the few WL requests I've triggered, all except 1 were from OB. These were pretty ugly ones indeed, an Adobe child site, a Genuine abused Webmail site, etc, etc. juts wondering.... Alex

5 9

Please test: PailPolice fraud list, jp.surbl.org
by Jeff Chan 30 Sep '04

30 Sep '04

This is a request for folks to please test the MailPolice fraud list and jp.surbl.org: MailPolice Fraud list with SpamCopURI: uri MP_URI_RBL eval:check_spamcop_uri_rbl('fraud.rhs.mailpolice.com','127.0.0.2') describe MP_URI_RBL URI's domain appears in MailPolice fraud list tflags MP_URI_RBL net score MP_URI_RBL 3.0 And for SA 3.0 with the URIDNSBL plug-in: urirhsbl URIBL_MP fraud.rhs.mailpolice.com. A header URIBL_MP eval:check_uridnsbl('URIBL_MP') describe URIBL_MP URI's domain appears in MailPolice fraud list tflags URIBL_MP net score URIBL_MP 3.0 (Note that the above is a separate, external list, so it can't be used like multi.) JP SA 2.63 and 2.64 rule and score using SpamCopURI 0.22 or later: uri JP_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0+64') describe JP_URI_RBL URI's domain appears in JP at http://www.surbl.org/lists.html tflags JP_URI_RBL net score JP_URI_RBL 4.0 JP SA 3.0 rule and score using URIBL's urirhssub: urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 header URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') describe URIBL_JP_SURBL Contains a URL listed in JP at http://www.surbl.org/lists.html tflags URIBL_JP_SURBL net score URIBL_JP_SURBL 4.0 In particular we'd like to hear about any false positives on either list. If the MailPolice fraud data looks good, we'll add it to PH, but we need your help in testing it. You can test these on hand selected test corpora or live mail, but please try not to melt the MailPolice name servers. ;-) Please give these a try and let us know what you find. Note that you'll probably want to remove the MailPolice fraud list after testing as a separate list if we add it to PH. Jeff C. -- "If it appears in hams, then don't list it."

2 3

RE: [SURBL-Discuss] FP in OB g4techtv .com
by Chris Santerre 30 Sep '04

30 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, September 29, 2004 12:32 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] FP in OB g4techtv .com > > >On Wednesday, September 29, 2004, 9:15:56 AM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>On Wednesday, September 29, 2004, 7:58:16 AM, Chris Santerre wrote: >>>> 2.0 URIBL_OB_SURBL Contains an URL listed in the OB >>>SURBL blocklist >>>> [URIs: g4techtv .com] >>> >>>> Ahhhhhhh my game news!!!!!! >>> >>>> --Chris >>> >>>I heard they spam... ;-) >>> >>>Whitelist them with documentation. > >> But it is on OB list, I thought I could only whitelist for WS? > >The SURBL whitelist applies to all SURBLs. > >Jeff C. >-- Done deal. --Chris (I hold in my hand, the first Hot Chocolate of the season!)

2 1

Re: [SURBL-Announce] ANNOUNCE: New JP list is now part of multi.surbl.org
by Mariano Absatz 30 Sep '04

30 Sep '04

On Mon, 27 Sep 2004 16:24:00 -0700, Jeff Chan <jeffc(a)surbl.org> wrote: > JP is now active as part of multi. Please give it a try. We > think you'll like the results. :-) > __ > > http://www.surbl.org/quickstart.html > > jp - jwSpamSpy + Prolocation data source > > Joe Wein's jwSpamSpy program is used both by Joe's own systems > and also Raymond Dijkxhoorn and his colleagues at Prolocation to > process more than 300,000 likely spams per day. The resulting > list has a very good spam detection rate around 80% and a very > low false positive rate below 0.02%. This data is only available > in the combined list multi.surbl.org. > > An SA 2.63 and 2.64 rule and score using SpamCopURI 0.22 or later > looks like this: > > uri JP_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0+64') > describe JP_URI_RBL URI's domain appears in JP at http://www.surbl.org/lists.html > tflags JP_URI_RBL net > > score JP_URI_RBL 4.0 > > An SA 3.0 rule and score using URIBL's urirhssub looks like this: > > urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 > header URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') > describe URIBL_JP_SURBL Contains a URL listed in JP at http://www.surbl.org/lists.html > tflags URIBL_JP_SURBL net > > score URIBL_JP_SURBL 4.0 > __ > > Note that JP is not available as a separate list, only as part of > multi.surbl.org. Use it with urirhssub or SpamCopURI 0.22 as > described above. Please see the lists document mentioned in the > description for more information about JP. > If I understand this right, ws still has jp data, even within multi, is it? That is, if I want to score the rest of ws at 1.3 and jp at 4.0, I should set jp's score at 2.7, right? -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com

2 1

RE: [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Tim A 29 Sep '04

29 Sep '04

Are there a SURBL clan in JO?? Where do I find them :) > -----Original Message----- > From: Chris Santerre <csanterre(a)merchantsoverseas.com> > Date: Tue, 28 Sep 2004 10:04:43 -0400 > Subject: RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to > suesingle4y ou.net > To: Jeff Chan <jeffc(a)surbl.org>, SURBL Discussion list <discuss(a)lists.surbl.org> > > > > >-----Original Message----- > >From: Jeff Chan [mailto:jeffc@surbl.org] > >Sent: Tuesday, September 28, 2004 9:45 AM > >To: SURBL Discuss > >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to > >suesingle4y ou.net > > > > > >On Tuesday, September 28, 2004, 6:43:09 AM, Chris Santerre wrote: > >> The only basis we still have is this guys word that he is > >legit. Are we > >> going to whitelist everyone who simply asks to be > >whitelisted? Yes or No? > > > >No. > > Oh, now your taking the fun out of arguing with you ;) > > Did you break your JO cd? DOn't see ya playing much. > > --Chris (I need cover fire on the bridge!!!) > > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] Help classify quickinspirations.com
by Chris Santerre 29 Sep '04

29 Sep '04

>-----Original Message----- >From: Patrik Nilsson [mailto:patrik@patrik.com] >Sent: Wednesday, September 29, 2004 3:59 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Help classify quickinspirations.com > > >At 15:11 2004-09-29 -0400, Chris Santerre wrote: >>quickinspirations.com >>Thoughts on this guy? 48 NANAS hits. Listed in dnsbl.njabl.org > >As well as in: >http://spews.org/html/S1436.html > >>Didn't we already classify this? > >I can find a whitelisting email from Jeff, but not the original >whitelisting request. Seems to be lost in my archives. > >>I wonder if we can get a crossref lookup of >>the global whitelist, so we can see what has already been whitelisted. >> >>I belive this is a spammer in sheeps clothing. But it fools >people into >>signing up for a stupid inspiration newsletter. But the >subjects of the >>newsletter are stuff like: >>Subject: Get a Credit Report Instantly! >>Then a inspiration quote, then a big ad. I think we may see >more of this in >>the future. >>I think it is a UC candidate. Do we have enough listed in UC >for testing >>yet? > >I think it's a surbl candidate. >Why was it whitelisted? >Any actual examples of it showing up in real ham, rather than only in >"fooled into signing up for" spam? > Did you just create a new term? "Fisuf Spam" Works for me! I think I had a "discussion" about this domain with Jeff before. Which is why I rang a bell. I think this may be one of the ones that started the whole UC debate. Hmmm.... could more Fisuf Spam be around the corner? --Chris

1 0

Re: [SURBL-Discuss] Help classify quickinspirations.com
by Patrik Nilsson 29 Sep '04

29 Sep '04

At 15:11 2004-09-29 -0400, Chris Santerre wrote: >quickinspirations.com >Thoughts on this guy? 48 NANAS hits. Listed in dnsbl.njabl.org As well as in: http://spews.org/html/S1436.html >Didn't we already classify this? I can find a whitelisting email from Jeff, but not the original whitelisting request. Seems to be lost in my archives. >I wonder if we can get a crossref lookup of >the global whitelist, so we can see what has already been whitelisted. > >I belive this is a spammer in sheeps clothing. But it fools people into >signing up for a stupid inspiration newsletter. But the subjects of the >newsletter are stuff like: >Subject: Get a Credit Report Instantly! >Then a inspiration quote, then a big ad. I think we may see more of this in >the future. >I think it is a UC candidate. Do we have enough listed in UC for testing >yet? I think it's a surbl candidate. Why was it whitelisted? Any actual examples of it showing up in real ham, rather than only in "fooled into signing up for" spam? Patrik

1 0

Re: [SURBL-Announce] ANNOUNCE: ccTLDs in two-level-tlds file updated somewhat
by Leonardo Helman 29 Sep '04

29 Sep '04

Hi, don't forget: gov.ar (government) mil.ar (armed forces) edu.ar (universities and university-related research groups) esc.edu.ar (elementary schools, high schools and other (non-universitary educational institutions). uba.ar (Buenos Aires University) educ.ar There was a thread on this list started by Mariano Absatz on Fri, 18 Jun 2004 10:41:30 On Sun, Sep 26, 2004 at 09:22:23PM -0700, Jeff Chan wrote: > On Saturday, September 18, 2004, 11:58:56 PM, Frank Ellermann wrote: > > [Konqueror list] > >>> | name,ai,au,bd,bh,ck,eg,et,fk,il,in,kh,kr,mk,mt,na, > >>> | np,nz,pg,pk,qa,sa,sb,sg,sv,ua,ug,uk,uy,vn,za,zw > > I have updated the ccTLDs for the ones Frank mentioned, > removed some duplicates, and added some data for a few > other ccTLDs. The results are in: > > http://spamcheck.freeapp.net/two-level-tlds > > Really this is just for completeness since geographic > domains other than .us aren't used in spams too often. > > Jeff C. > -- > "If it appears in hams, then don't list it." > > _______________________________________________ > Announce mailing list > Announce(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/announce

4 5

RE: [SURBL-Discuss] FP in OB g4techtv .com
by Chris Santerre 29 Sep '04

29 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, September 29, 2004 11:09 AM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] FP in OB g4techtv .com > > >On Wednesday, September 29, 2004, 7:58:16 AM, Chris Santerre wrote: >> 2.0 URIBL_OB_SURBL Contains an URL listed in the OB >SURBL blocklist >> [URIs: g4techtv .com] > >> Ahhhhhhh my game news!!!!!! > >> --Chris > >I heard they spam... ;-) > >Whitelist them with documentation. > But it is on OB list, I thought I could only whitelist for WS? --Chris "If it appears in spam, do not whitelist."

3 2

RE: [SURBL-Discuss] FP in OB g4techtv .com
by Chris Santerre 29 Sep '04

29 Sep '04

>-----Original Message----- >From: Fred [mailto:tech2@i-is.com] >Sent: Wednesday, September 29, 2004 1:35 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] FP in OB g4techtv .com > > >Jeff Chan wrote: >> I heard they spam... ;-) >> >> Whitelist them with documentation. >> >> Jeff C. > >They were bought by Comcast and we know how much they care about spam.. >Maybe things have changed recently, in the past we were being >attacked by a >different customer daily. > >I want LEO back and I'm still mad at TechTV for taking off the >shows they >did. I say keep them listed ;) > > >If they bring back Leo then we can whitelist them :) I grew >up watching Leo >teach people about computers now I do it myself, but I still miss him! > I agree! X-Play seems lost. Sweat and Players are stupid shows. Bring back Leo!! --Chris (Burnout 3 is hurting my thumbs!)

1 0

FP in OB g4techtv .com
by Chris Santerre 29 Sep '04

29 Sep '04

2.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist [URIs: g4techtv .com] Ahhhhhhh my game news!!!!!! --Chris

3 2

ignore
by Doc Schneider 29 Sep '04

29 Sep '04

Just a test... I got a bounce back from this on my last post. -Doc

1 0

RE: Why such a low score?
by Chris Santerre 29 Sep '04

29 Sep '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Wednesday, September 29, 2004 11:10 AM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail); Spamassassin-Talk (E-mail) >Subject: Re: Why such a low score? > > >Chris, > >> What was the reason WS got such a low score in SA 3.0??? .5 >is a joke! Hell >> BigEvil was scored a 3 and now one complained, and it is the >same data!! I >> don't understand. Did the mass check not go well? > >We pointed this out several times, the mass checker found way too many >FP's and so SA decided to score it lower. Its 'our own' >problem, we have >to get out those FP's. The scoring is done with SA 3.1 again, >so lets try >to do better there... > >And yes, i am disappointed also with this very low scoring, >personally i >have raised it via my local.cf. > I am as well. I wonder when they did the testing. We have changed so much of WS to reduce FPs. And with the rates reported now, you can see why I was stunned to see this score. (I do vaguley remember a post from Theo or DQ about this.) I'd love to know what a new GA run would say about this now. --Chris

1 0

Fwd: Re: Why such a low score?
by Jeff Chan 29 Sep '04

29 Sep '04

This is a forwarded message From: Matt Kettler <mkettler(a)evi-inc.com> To: Chris Santerre <csanterre(a)MerchantsOverseas.com>, users(a)spamassassin.apache.org Date: Wednesday, September 29, 2004, 8:13:27 AM Subject: Why such a low score? ===8<==============Original message text=============== At 10:55 AM 9/29/2004, Chris Santerre wrote: >What was the reason WS got such a low score in SA 3.0??? .5 is a joke! Hell >BigEvil was scored a 3 and now one complained, and it is the same data!! I >don't understand. Did the mass check not go well? Upon closer inspection, the WS mass-check went pretty well, but WS had the greatest number of nonspam hits of all the SURBL lists. It also hit the most spam, but the OB list hit nearly as much spam, and almost no nonspam. Since the GA treats FP's as 100 times worse than FNs, the GA is going to heavily bias the score of any overlapping spam hits to the one that has the least nonspam hits. I suspect that in the spam cases, most of the WS hits also hit either OB or SC, which have better FP ratios, and the scores assigned reflect this. Admittedly the amount of nonspam WS hit is small (0.4%), but that's over 6 times more nonspam than OB did, and 100 times more than SC did. Thus WS got a lowish score not for being a bad rule, but for not doing as well as it's neighbors that catch the same spams. From STATISTICS-set1.txt OVERALL% SPAM% HAM% S/O RANK SCORE NAME 10.497 15.8904 0.0008 1.000 0.98 2.01 URIBL_AB_SURBL 18.019 27.2741 0.0046 1.000 0.97 3.90 URIBL_SC_SURBL 49.029 74.1861 0.0654 0.999 0.74 2.00 URIBL_OB_SURBL 51.999 78.4712 0.4756 0.994 0.45 0.54 URIBL_WS_SURBL 0.010 0.0146 0.0012 0.927 0.39 0.84 URIBL_PH_SURBL From STATISTICS-set3.txt: OVERALL% SPAM% HAM% S/O RANK SCORE NAME 7.022 14.4233 0.0061 1.000 0.95 4.26 URIBL_SC_SURBL 30.471 62.5514 0.0632 0.999 0.74 3.21 URIBL_OB_SURBL 2.950 6.0208 0.0385 0.994 0.73 0.42 URIBL_AB_SURBL 33.807 68.9994 0.4494 0.994 0.47 1.46 URIBL_WS_SURBL 0.019 0.0390 0.0008 0.981 0.44 2.00 URIBL_PH_SURBL grep SURBL 50_scores.cf: score URIBL_AB_SURBL 0 2.007 0 0.417 score URIBL_OB_SURBL 0 1.996 0 3.213 score URIBL_PH_SURBL 0 0.839 0 2.000 score URIBL_SC_SURBL 0 3.897 0 4.263 score URIBL_WS_SURBL 0 0.539 0 1.462 ===8<===========End of original message text===========

1 0

Why such a low score?
by Chris Santerre 29 Sep '04

29 Sep '04

What was the reason WS got such a low score in SA 3.0??? .5 is a joke! Hell BigEvil was scored a 3 and now one complained, and it is the same data!! I don't understand. Did the mass check not go well? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

Re: Why such a low score?
by Matt Kettler 29 Sep '04

29 Sep '04

At 10:55 AM 9/29/2004, Chris Santerre wrote: >What was the reason WS got such a low score in SA 3.0??? .5 is a joke! Hell >BigEvil was scored a 3 and now one complained, and it is the same data!! I >don't understand. Did the mass check not go well? Chris... Calm down a sec. The score assigned by the GA does not indicate how well or poorly a rule performs. In this case WS probably got a low score due to a large amount of overlap with the other URIBL rules. Remember, the GA tunes the scores so the optimal amount of spam and ham end up in the right baskets. This means that rule scores aren't a function of just the rule, but a function of how that rule interacts with other rules.

1 0

RE: [SURBL-Discuss] Possible FP
by Chris Santerre 29 Sep '04

29 Sep '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Tuesday, September 28, 2004 9:20 PM >To: Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] Possible FP > > >Hi! > >>>> cellular4free . com >> >>>> No hits from Google/NANAS >> >>> Domain 1.2 years old, no SBL hits. >> >>> Any WS guys know why this one got added? >> >>> Jeff C. >> >> Can anyone with access to WS data sources tell us anything >> about this domain or why it was added? Otherwise we may need >> to whitelist it. >> >> Bill, Chris, Raymond? Can you say where it came from? > >Not here... > Not here either. --Chris

1 0

surbl and squid
by Jose Marcio Martins da Cruz 29 Sep '04

29 Sep '04

Hello, I've just adapted an old script I use with squid to remove unwanted ads to use surbl... This works as a redirector - this means, each time someone ask for an url matching surbl database, squid will redirect the query to a locally saved web page - e.g. a web page showing the site policy or a simple error message. For the while, this is a very draft script, but it works fine. I'll surely improve it and maybe write a C version which shall be much faster for huge domains. You can get it at : http://j-chkmail.ensmp.fr/surbl/squid-surbl-it All feedback is welcome. Best Jose-Marcio -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

2 2

Test points
by Daniel Kleinsinger 29 Sep '04

29 Sep '04

Are there test points for any of the SURBLs besides SC? The surbl-org-permanent-test-point-MUNGED.com one only seems to hit SC. I'm asking cause I haven't had any hits on PH since I upgraded to SA3... I get hits on all the others. Thanks, Daniel

3 2

FP on WS
by Bill Landry 29 Sep '04

29 Sep '04

Another one that does not need much in the way of justification: pitneyworks. com But in an effort to keep Jeff happy and quite: ;-) - Domain owned by Pitney Bowes and domain record created on 13-Aug-1998 - No SBL listings - No NANAS listings Bill

3 2

Possible WS FP: interactivefmg.com
by Jeff Chan 29 Sep '04

29 Sep '04

Does anyone with WS data source visibility know why this one was added: This is a forwarded message From: Jody Powell <jpowell(a)interactivefmg.com> To: whitelist(a)surbl.org Date: Tuesday, September 28, 2004, 6:47:36 AM Subject: Blacklisted Domain Sirs, Our domain interactivefmg.com is on your blacklist. This domain handles our day-to-day corporate e-mail and no commercial solicitations orginiate from this domain with the exception of individual information packets sent to clients who have requested them via the telephone. Please remove us from your blacklist, or let us know what we need to do to meet the requirements to be whitelisted. Thanks, Jody Powell Network Administrator InterActive Financial Marketing Group, LLC 114 Virginia Street Richmond, Virginia 23219 -- Jeff Chan mailto:whitelist@surbl.org http://www.surbl.org/

2 3

RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Chris Santerre 28 Sep '04

28 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, September 28, 2004 9:45 AM >To: SURBL Discuss >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to >suesingle4y ou.net > > >On Tuesday, September 28, 2004, 6:43:09 AM, Chris Santerre wrote: >> The only basis we still have is this guys word that he is >legit. Are we >> going to whitelist everyone who simply asks to be >whitelisted? Yes or No? > >No. Oh, now your taking the fun out of arguing with you ;) Did you break your JO cd? DOn't see ya playing much. --Chris (I need cover fire on the bridge!!!)

1 0

RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Chris Santerre 28 Sep '04

28 Sep '04

>-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Tuesday, September 28, 2004 9:52 AM >To: SURBL Discussion list >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to >suesingle4y ou.net > > >Chris Santerre wrote: >>>-----Original Message----- >>>From: Jeff Chan [mailto:jeffc@surbl.org] >>>Sent: Monday, September 27, 2004 8:18 PM >>>To: Frank Ellermann >>>Cc: discuss(a)lists.surbl.org >>>Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to >>>suesingle4y ou.net >>> >>> >>>On Monday, September 27, 2004, 5:12:16 PM, Frank Ellermann wrote: >>> >>>>Jeff Chan wrote: >>> >>>>>"A. Add domains that appear only in spam. Do not add any >>>>>domains that appear in ham." >>> >>>>As an absolute rule that won't work, because the criminal >>>>spammer talks with his rogue registrar in "ham". >>> >>>I don't consider spammer's messages to be ham. Only ham from >>>legitimate people (non-spammers) is ordinary ham. >>> >>>Jeff C. >>>-- >>>"If it appears in hams, then don't list it." >>> >> >> >> Oh yeah single4you.net is realy legit.... and I'm the queen >of England. >> Their site is back up, with personal ads that show picts of >people. Too bad >> one of the pics is snoop dog, and another is Conan the Barbarian!! > >LOL > >http://www.single4you.net/membership/homepage.aspx?mid=10980&vi sside=true :-) I read the snoop dog and conan ones. --Chris ( ilike ot play cricket chess)

1 0

RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Chris Santerre 28 Sep '04

28 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, September 27, 2004 8:18 PM >To: Frank Ellermann >Cc: discuss(a)lists.surbl.org >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to >suesingle4y ou.net > > >On Monday, September 27, 2004, 5:12:16 PM, Frank Ellermann wrote: >> Jeff Chan wrote: > >>> "A. Add domains that appear only in spam. Do not add any >>> domains that appear in ham." > >> As an absolute rule that won't work, because the criminal >> spammer talks with his rogue registrar in "ham". > >I don't consider spammer's messages to be ham. Only ham from >legitimate people (non-spammers) is ordinary ham. > >Jeff C. >-- >"If it appears in hams, then don't list it." > Oh yeah single4you.net is realy legit.... and I'm the queen of England. Their site is back up, with personal ads that show picts of people. Too bad one of the pics is snoop dog, and another is Conan the Barbarian!! The only basis we still have is this guys word that he is legit. Are we going to whitelist everyone who simply asks to be whitelisted? Yes or No? --Chris

4 3

RFC: SURBL inclusion policy
by Jeff Chan 28 Sep '04

28 Sep '04

In order to assist people hand-classifying spam URI domains and IPs for inclusion or non-inclusion in SURBLs, I've made a draft policy document: http://www.surbl.org/policy.html Please read it and post your comments. Jeff C. -- "If it appears in hams, then don't list it."

6 38

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss