- Discuss - Mailman 3

RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Chris Santerre 28 Sep '04

28 Sep '04

>-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Tuesday, September 28, 2004 9:52 AM >To: SURBL Discussion list >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to >suesingle4y ou.net > > >Chris Santerre wrote: >>>-----Original Message----- >>>From: Jeff Chan [mailto:jeffc@surbl.org] >>>Sent: Monday, September 27, 2004 8:18 PM >>>To: Frank Ellermann >>>Cc: discuss(a)lists.surbl.org >>>Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to >>>suesingle4y ou.net >>> >>> >>>On Monday, September 27, 2004, 5:12:16 PM, Frank Ellermann wrote: >>> >>>>Jeff Chan wrote: >>> >>>>>"A. Add domains that appear only in spam. Do not add any >>>>>domains that appear in ham." >>> >>>>As an absolute rule that won't work, because the criminal >>>>spammer talks with his rogue registrar in "ham". >>> >>>I don't consider spammer's messages to be ham. Only ham from >>>legitimate people (non-spammers) is ordinary ham. >>> >>>Jeff C. >>>-- >>>"If it appears in hams, then don't list it." >>> >> >> >> Oh yeah single4you.net is realy legit.... and I'm the queen >of England. >> Their site is back up, with personal ads that show picts of >people. Too bad >> one of the pics is snoop dog, and another is Conan the Barbarian!! > >LOL > >http://www.single4you.net/membership/homepage.aspx?mid=10980&vi sside=true :-) I read the snoop dog and conan ones. --Chris ( ilike ot play cricket chess)

1 0

RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Chris Santerre 28 Sep '04

28 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, September 27, 2004 8:18 PM >To: Frank Ellermann >Cc: discuss(a)lists.surbl.org >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to >suesingle4y ou.net > > >On Monday, September 27, 2004, 5:12:16 PM, Frank Ellermann wrote: >> Jeff Chan wrote: > >>> "A. Add domains that appear only in spam. Do not add any >>> domains that appear in ham." > >> As an absolute rule that won't work, because the criminal >> spammer talks with his rogue registrar in "ham". > >I don't consider spammer's messages to be ham. Only ham from >legitimate people (non-spammers) is ordinary ham. > >Jeff C. >-- >"If it appears in hams, then don't list it." > Oh yeah single4you.net is realy legit.... and I'm the queen of England. Their site is back up, with personal ads that show picts of people. Too bad one of the pics is snoop dog, and another is Conan the Barbarian!! The only basis we still have is this guys word that he is legit. Are we going to whitelist everyone who simply asks to be whitelisted? Yes or No? --Chris

4 3

RFC: SURBL inclusion policy
by Jeff Chan 28 Sep '04

28 Sep '04

In order to assist people hand-classifying spam URI domains and IPs for inclusion or non-inclusion in SURBLs, I've made a draft policy document: http://www.surbl.org/policy.html Please read it and post your comments. Jeff C. -- "If it appears in hams, then don't list it."

6 38

SA 3.0/URIDNSBL Install Problems
by Alden Levy 28 Sep '04

28 Sep '04

Hi. While installing SA3.0 yesterday, I *think* I had a problem with URIDNSBL. I cannot get URIDNSBL to run unless I put the following in a cf file: loadplugin Mail::SpamAssassin::Plugin::URIDNSBL I originally had it in my /etc/mail/spamassassin/local.cf, but I figure it's better where I have it now. Is it advisable to load this plugin elsewhere? If so, where? I am running RH 7.3, MS 4.33.3, Perl 5.6.1 with ClamAV (Mail::ClamAV v 0.11). The relevant (I believe) output of spamassassin -D --lint is: <snip> debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC debug: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) implements 'parse_config' debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) inhibited further callbacks <snip> debug: ---- MIME PARSER END ---- debug: metadata: X-Spam-Relays-Trusted: debug: metadata: X-Spam-Relays-Untrusted: debug: decoding: no encoding detected debug: Loading languages file... debug: Language possibly: en,sco debug: metadata: X-Languages: en sco debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) implements 'parsed_metadata' debug: is Net::DNS::Resolver available? yes debug: Net::DNS version: 0.48 debug: trying (3) intel.com... debug: looking up NS for 'intel.com' debug: NS lookup of intel.com succeeded => Dns available (set dns_available to hardcode) debug: is DNS available? 1 debug: URIDNSBL: domains to query: debug: Running tests for priority: 0 debug: running header regexp tests; score so far=0 debug: registering glue method for check_uridnsbl (Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454)) debug: all '*From' addrs: ignore(a)compiling.spamassassin.taint.org debug: all '*To' addrs: debug: running body-text per-line regexp tests; score so far=-3.174 debug: running uri tests; score so far=-3.174 Razor is working, Bayes is working and SURBL does work, I'm just wondering if this is optimal, or if I just got lucky. BTW, URIDNSBL.pm is in /usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Plugin/ Any help would be appreciated. Thanks, Alden

2 1

RE: [SURBL-Discuss] SA 3.0/URIDNSBL Install Problems
by Chris Santerre 27 Sep '04

27 Sep '04

>-----Original Message----- >From: Alden Levy [mailto:alden@engineno9inc.com] >Sent: Monday, September 27, 2004 4:01 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] SA 3.0/URIDNSBL Install Problems > > >Hi. > >While installing SA3.0 yesterday, I *think* I had a problem >with URIDNSBL. >I cannot get URIDNSBL to run unless I put the following in a cf file: >loadplugin Mail::SpamAssassin::Plugin::URIDNSBL > >I originally had it in my /etc/mail/spamassassin/local.cf, but >I figure it's >better where I have it now. > >Is it advisable to load this plugin elsewhere? If so, where? > >I am running RH 7.3, MS 4.33.3, Perl 5.6.1 with ClamAV (Mail::ClamAV v >0.11). > >The relevant (I believe) output of spamassassin -D --lint is: ><snip> >debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC >debug: plugin: registered >Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) >debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8d44454) *snip* This "inhibited further callbacks" is exactly what I am getting now. However I haven't changed over the running spamc is still 2.4 for now. I want to solve this problem first. Make sure you have all the prerequesits installed. They are listed int he INSTALL file. I'm doing this tomorrow. If not, I'm wondering if this has to do with my firewall not letting it out or something. Haven't got a chance to dig any further, and that is just a theory. Also how did you get the output captured from the lint?? I tried all the obvious things but it won't redir the output!!! --Chris

2 1

RE: [SURBL-Discuss] RFC: SURBL inclusion policy
by Chris Santerre 27 Sep '04

27 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, September 27, 2004 4:37 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] RFC: SURBL inclusion policy > > >On Friday, September 24, 2004, 9:35:14 PM, Jeff Chan wrote: >> OK I Updated the policy page, taking Ryan's top rules and general >> organizational comments: > >> http://www.surbl.org/policy.html > >> Please let me/us know what you think of it now. > >Does anyone else have any comments on the updated policy >page for adding new records to manual SURBL lists? It >includes changes thanks to comments from Frank, Ryan, >Joe and others. > >Please reply if you have anything to add or change. > The content is good. Somethings I would change the order of importance, but that is a personal preference. So I say go ahead with it. Are you really not even going to mention UC at all? I know you don't agree with it, but at least letting people know about it to make their own decisions would help. --Chris

1 0

RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Chris Santerre 27 Sep '04

27 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, September 27, 2004 11:06 AM >To: SURBL Discuss >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to >suesingle4y ou.net > > >On Monday, September 27, 2004, 7:53:41 AM, Chris Santerre wrote: >> But the fact that this brand new domain, not even a month >old, sent spam, >> and has been removed because it POTENTIALY might be used in >ham worries me >> beyond belief for this project. > >> I need more then, "He might be used for legitin the future." >as a reason to >> remove a blatant spam fool like this. > >This guy is a tiny flea on the rump of the stampeding herd >of mad bulls who are the real spammers. Whatever he's doing >is insignificant compared to the spam gangs. > Sounds exactly like Drug Enforcment. "Lets go after the bug guys, and not worry about the small guy we caught." Big Guy arrested, small guy takes his place. Where do you think the bigger guys come from, the stork? Hell this guy could be in one of those "Make money from home" scams. And you know what, he will go tell his buddies it ain't worth it because he was blacklisted days after he started. --Chris (Riple in the water.....) --Chris

1 0

RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to sue single4 yet
by Chris Santerre 27 Sep '04

27 Sep '04

>-----Original Message----- >From: Ryan Thompson [mailto:ryan@sasknow.com] >Sent: Monday, September 27, 2004 10:53 AM >To: SURBL Discussion list >Subject: RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to sue >single4yet > > >Chris Santerre wrote to 'Jeff Chan' and 'SURBL Discussion list': > >>> Thanks Joe. Hopefully he's learned his lesson. >> >> What the hell?? I just read this whole thread! I would not have taken >> this guy off! No way in hell!!!!! Ray, add this yahoo to UC please! > >Well, first off, you probably meant "Ryan". Second, single4you.net has >been in UC for for days already. :-) > >> The domain is brand new, sends spam, and screams about >getting listed! >> How the hell can he be legit! Did you guys read the NANAS listings >> that showed his wonderful emails? >> >> These are just the ones reported. He 'purchased' a list. So none of >> these were opt in. > >Agreed! Don't forget the temporal aspect of SURBL. It *was* a spammer >domain, but that doesn't mean it still *is* a spammer domain. > >> This is not the last we will hear of this guy. I think taking him off >> is a mistake. And IF he does it again, I'll report his a$$ to every >> RBL I can find, simply because you guys removed this idiot. > >Well, I'm not worried about it at all, because if he has really cleaned >up his act, we won't hear from him again. Otherwise, if I get confirmed >fresh spam for single4you.net, I'll happily spend the 3 >seconds it takes >to re-list, as I'm sure would many people who have read this >thread. ;-) >I'll be watching my daily GetURI runs very, very closely. :-) > >> --Chris (Jaded, fed up, and tired of the BS.) > >Even while following this thread yesterday, I whitelisted 45 domains, >and listed 24 new ones, from a ~6 hour corpus. I'm not going to let a >little bit of BS about *one* measly domain ruin my fun. > >I know, I had to damn near swallow my own tongue before I recommended >de-listing them, but, the point is, if we aren't responsive to the odd >site possibly changing their act, SURBL (and even UC) will be useless. > >- Ryan > Yup, sorry about that. After I sent it I realized I meant you :) I'm still having fun, and I know it seems that Jeff and I don't get along, but we do. Our differences are good for the lists. If you have had more correspondence with this spammer that leads you to this decision, then I trust you have reasons for removing then. --Chris

1 0

RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Chris Santerre 27 Sep '04

27 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, September 27, 2004 10:34 AM >To: SURBL Discuss >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to >suesingle4y ou.net > > >On Monday, September 27, 2004, 7:25:40 AM, Chris Santerre wrote: >> The domain is brand new, sends spam, and screams about >getting listed! How >> the hell can he be legit! Did you guys read the NANAS >listings that showed >> his wonderful emails? > >> These are just the ones reported. He 'purchased' a list. So >none of these >> were opt in. > >And are those the only emails that ever have or ever will mention >the domain? How can you say that of ANY domain we have listed????????? >Do we know that the domain has no legitimate uses or >users? If not should we block all legitimate messages that do >mention the domain? Or any legit message talking about any domain we have listed already?? > >These are difficult questions which we attempted to answer. > >It's much easier to list them, but is that fair to people >who actually use or mention the site in hams? > Show me one freaking legit ham from him!! Where the hell do we draw the line??? I can literaly argue that ANY, and I mean ANY of the domains we have listed have the potential to be used in ham. But the fact that this brand new domain, not even a month old, sent spam, and has been removed because it POTENTIALY might be used in ham worries me beyond belief for this project. I need more then, "He might be used for legitin the future." as a reason to remove a blatant spam fool like this. You're obviously not going to add him back in. So I'm going to wath this guy closer then his proctologist! I'll be all over this guy in every way. When he trips up, I will be there. I be he is relisted in under 3 months. Am I pissed he got removed, yes. Am I pissed at Jeff, no. He is still my schmoopie! :-) Do I think Jeff might have fallen on his head this weekend........ ....it crossed my mind ;) --Chris

2 2

Re: [SURBL-Announce] ANNOUNCE: ccTLDs in two-level-tlds file updated somewhat
by Leonardo Helman 27 Sep '04

27 Sep '04

Hi, don't forget: esc.edu.ar (elementary schools, high schools and other (non-universitary educational institutions). uba.ar (Buenos Aires University) educ.ar There was a thread on this list started by Mariano Absatz on Fri, 18 Jun 2004 10:41:30 On Sun, Sep 26, 2004 at 09:22:23PM -0700, Jeff Chan wrote: > On Saturday, September 18, 2004, 11:58:56 PM, Frank Ellermann wrote: > > [Konqueror list] > >>> | name,ai,au,bd,bh,ck,eg,et,fk,il,in,kh,kr,mk,mt,na, > >>> | np,nz,pg,pk,qa,sa,sb,sg,sv,ua,ug,uk,uy,vn,za,zw > > I have updated the ccTLDs for the ones Frank mentioned, > removed some duplicates, and added some data for a few > other ccTLDs. The results are in: > > http://spamcheck.freeapp.net/two-level-tlds > > Really this is just for completeness since geographic > domains other than .us aren't used in spams too often. > > Jeff C. > -- > "If it appears in hams, then don't list it." > > _______________________________________________ > Announce mailing list > Announce(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/announce

1 0

FP on WS & DS
by Bill Landry 27 Sep '04

27 Sep '04

vault. com is listed on WS & DS. Bill

3 8

Spammer threatening to sue single4you.net
by Joe Wein 27 Sep '04

27 Sep '04

Here's some mail exchange with a spammer who's threating me with a lawsuit. On August 25 I received spam advertising single4you.net in the feed from Prolocation. There were several NANAS postings for it and I blacklisted it. On September 1, the domain owner tried to contact me, but got stuck in my mailfilter, as his sending domain was listed. ==== From: "Webmaster" <mail(a)single4you.net> To: <joewein(a)pobox.com> Sent: Wednesday, 01 September, 2004 9:58 Subject: Spammer??? Why are you blacklisting me? Who put you in charge? If you want to run a spam blacklist, make sure to pick the ones who are spammer’s not small businesses who are trying to make a living. But I guess you don’t’ care and feel good about yourself driving hard working folks like me into the ground. Christian Schiffer Webmaster Singles4you.net ==== Since then I added instructions to my site to help people wanting to contact me to get through the filter and he tried again: ==== From: "Christian Schiffer" <memberservice(a)single4you.net> To: <joewein(a)pobox.com> Sent: Sunday, 26 September, 2004 20:19 Subject: [BLACKLIST] www.single4you.net Notice of legal action Dear Sir, We purchased an opt inn mailing list witch we later found to be no so opt inn as we thought. As soon as we became aware of this we stopped using it. This was a one time mistake from our side and we decided to stop using bulk mail altogether to prevent further mistakes. Instead we purchase other services witch do not include e-mail advertising at all. Therefore we demand to be taken of your list within 24 hours as well as getting written confirmation that you have done this. We did send you an e-mail to witch you neglected to reply in a nice tone of voice several weeks ago. Because of your false accusations more then 50% of our customers witch all have explicitly asked to get e-mail from us are not getting their member mail, notice of e-mails from other members who wish to contact them and so forth. This is totally unacceptable and you are forcing us to sue you for a substantial amount should you not stop blacklisting our domain. We are sure that you wish to stop spamming problems and we find such an effort admirable as every legitimate business on the internet is suffering from spam; however, we are not spammers. We would prefer to solve this matter peacefully, and if you have further questions or concerns please don’t hesitate to bring them to our attention, but be also assured that we will have no other option that to go to severe legal actions against you should you choose to neglect this e-mail and continue your blacklisting of our company. In the future we would advice you to contact businesses you are suspecting to be spammers before making false accusations. Any business witch is falsely accused of spam will have a working return mail address on the mail the send out. And so do we, we had a working return address on our mails before and we have it now, solely because we are not spammers. We are looking forward to hear from you today. Sincerely yours Christian Schiffer webmaster(a)single4you.net www.single4you.net ==== Here's my reply: ==== > Dear Sir, Mr Schiffer, let's get a few things straight: > We purchased an opt inn mailing list witch we later found > to be no so opt inn as we thought. In other words, you are admitting that you sent spam advertising your website. Yet you demand your domain to be removed from a list of domains advertised via spam. As someone who runs a business, you should be familiar with the legal situation of sending bulk email. Since January 1, 20004, sending bulk email to recipients without a valid postal mail address for unsubscribing is a violation of US Federal Law ("Can Spam Act of 2003"), signed into law by President Bush last December. You emails included no such address. Furthermore, sending email to recipients in the European Union with whom one neither has an ongoing business relationship nor who have granted permission to send them email is a violation of EU law. Spam is not about how often you email someone, it is about (lack of) consent. As the anti-spam community has explained for a long time, the only way to avoid spamming people when sending bulk email is to only use confirmed opt-in lists that you yourself have built. Any other approach risks sending bulk email to persons who have not given their consent. > As soon as we became aware of this we stopped using it. > This was a one time mistake from our side and we decided > to stop using bulk mail altogether to prevent further mistakes. Well, that's obviously better than continuing to break the law, but it does not undo the violations that have already happened. You are standing on very shaky ground. > Therefore we demand to be taken of your list within 24 hours > as well as getting written confirmation that you have done this. On what legal grounds? I stated on my website that your domain has been advertised in spam. That is obviously true. In your latest email you yourself admit to that fact. I have copies of at least one unsolicited bulk email for every domain on my blacklist, including yours. The one that advertised your domain was received on August 25, 2004. Furthermore, there is evidence by other people that we came across when we researched your domain, which confirmed our conclusions. For example, take a look at these usenet postings: http://groups.google.com/groups?q=single4you.net > We did send you an e-mail to witch you neglected to > reply in a nice tone of voice several weeks ago. That email didn't make it through our spamfilter, because it originated from a blacklisted domain. To avoid communication problems like that I later addded the advice about [BLACKLIST] in the subject line. That's how we could finally communicate. > Because of your false accusations more then 50% > of our customers witch all have explicitly asked to > get e-mail from us are not getting their member mail, I am not blocking email to your customers. I don't control the mail servers they are using. The only mail I control is the for my own email accounts. When I publish which domains I refuse mail from, I only exercise my freedom of speech. It is up to the postmasters of other servers which mails they choose to accept and which they refuse. But more to the point, even if I were to remove you from my personal list, you would still find your emails blocked because there are numerous other people who have received spam for your domain and added you to blacklists. My personal advice to you is to register a different domain and gradually switch over to that (and this time keep your hands clean). Unfortunately for you, the damage to your domain name is already done and you have no one else to blame for that but your own carelessness. Regards Joe Wein Yokohama, Japan ==== From: "Christian Schiffer" <memberservice(a)single4you.net> To: "'Joe Wein'" <joewein(a)pobox.com> Sent: Monday, 27 September, 2004 0:11 Subject: RE: [BLACKLIST] www.single4you.net Notice of legal action Mr. Wein, This is the absolute last warning. The accusation of spam against our company is not correct; furthermore we do not admit having spammed anyone at any point in time. That the business we purchased our mailing list from are spammers is not our fault, if you need to put someone on your blacklist, put them on, they are the once behind spam, they were advertising their opt inn list as a consented list of users interested in our product. Hiding behind the freedom of speech act and denying other the same right is ridicules. I will not waste anymore time with you but hand over this matter to our lawyer's tomorrow morning. That you admit not having even tried to contact us, having blacklisted us without any reason or concern and then even admitting to hiding by denying our e-mail speaks for itself. Even now after the second mail explaining how this could happen and trying to reach a friendly solution you are still in denial of your offence. We will therefore sue you not only for the business lost in the future but also for the business lost in the past. You are looking at a multimillion dollar lawsuit; I hope you can afford that. I also suspect you working for the completion and our law firm will investigate that too. Should you choose not too submit to our demands within the hour this will be your loss. I can assure you that we will take any action possible within the law to bring you down, both financial and personal, for trying to wreck our business. Christian Schiffer ==== That's it so far Joe -- http://www.joewein.de/sw/spam.htm

5 7

Whitelist Request
by Bitz 27 Sep '04

27 Sep '04

The followings domains are listed at WS_URI_RBL, can we whitelist them please? :-) npd . com - Record created on 27-Jan-1995 sendafriend . com - Record created on 09-Sep-1999 feelgoodpages . com - Record created on 26-Oct-2000 I don't personally use sendafriend and feelgoodpages, but as jeff states on his previous e-mails, they have legit use and shouldn't be listed :-) Thanks, -b.

4 3

mbox folders needed
by Ryan Thompson 26 Sep '04

26 Sep '04

Hi everybody, By popular demand, I'm adding mbox support to GetURI (currently it just works with maildir; directories containing RFC822 messages). I only have a couple different examples of mbox folders from my system. Would a few of you mind sending me some representative mbox samples (10-1000 messages would be ideal)? Either ham or spam is fine. You can compress (.tar.gz preferred, but .zip is okay) and email them to me, or just provide me with a URL to download. I'll delete them once I've run my tests, and I won't make a point of reading the actual messages. - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

1 0

Re: [SURBL-Discuss] Question re: integration with SpamAssassin 3.0
by alden＠engineno9inc.com 26 Sep '04

26 Sep '04

>Hi! >>> A grep inside your rules dir would have told ;) >>> >>> 25_uribl.cf:urirhssub URIBL_SC_SURBL multi.surbl.org. A 2 >>> 25_uribl.cf:urirhssub URIBL_WS_SURBL multi.surbl.org. A 4 >>> 25_uribl.cf:urirhssub URIBL_PH_SURBL multi.surbl.org. A 8 >>> 25_uribl.cf:urirhssub URIBL_OB_SURBL multi.surbl.org. A 16 >>> 25_uribl.cf:urirhssub URIBL_AB_SURBL multi.surbl.org. A 32 >> While it's true that the rules are there, don't we have to add scores to >> local.cf? (I upgraded this AM, too). >No, the scores are in the default rulesets. Again, a simple grep would >have told you ;) >[root at vmx01 spamassassin]# grep SURBL * | grep score >50_scores.cf:score URIBL_AB_SURBL 0 2.007 0 0.417 >50_scores.cf:score URIBL_OB_SURBL 0 1.996 0 3.213 >50_scores.cf:score URIBL_PH_SURBL 0 0.839 0 2.000 >50_scores.cf:score URIBL_SC_SURBL 0 3.897 0 4.263 >50_scores.cf:score URIBL_WS_SURBL 0 0.539 0 1.462 >Bye, >Raymond. Yep. Just realized it before I read this. Sorry, and thanks! --Alden

1 0

Re: [SURBL-Discuss] Question re: integration with SpamAssassin 3.0
by alden＠engineno9inc.com 26 Sep '04

26 Sep '04

> Date: Sun, 26 Sep 2004 19:19:01 +0200 (CEST) > From: Raymond Dijkxhoorn <raymond(a)prolocation.net> > Subject: Re: [SURBL-Discuss] Question re: integration with > SpamAssassin 3.0 > To: SURBL Discussion list <discuss(a)lists.surbl.org> > Message-ID: > <Pine.LNX.4.61.0409261916300.22651(a)mailbox.prolocation.net> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > Hi! > >> I have been using the SURBL plugin with SA 2.64 successfully and have >> just upgraded SA to 3.0. In the docs it states that it is best to >> use multi.surbl.org with 3.0. Is this configured by default >> somewhere or do I need to add the rule to local.cf?? > > This is enabled by default, of you have modules like Net::DNS installed. > >> I have been watching the spam processed so far this morning and I am >> getting hits on the lists I had configured with 2.64 but not multi >> which is why I ask. > > You still see the hits on the seperate lists. > > Thy show up like: URIBL_WS_SURBL and URIBL_OB_SURBL for example. > >> If I do need to add the rule, what is the exact syntax to use for >> 3.0?? > > No need to do that. > >> My apologies if this has been covered before - my searches came up >> pretty empty. > > A grep inside your rules dir would have told ;) > > 25_uribl.cf:urirhssub URIBL_SC_SURBL multi.surbl.org. A 2 > 25_uribl.cf:urirhssub URIBL_WS_SURBL multi.surbl.org. A 4 > 25_uribl.cf:urirhssub URIBL_PH_SURBL multi.surbl.org. A 8 > 25_uribl.cf:urirhssub URIBL_OB_SURBL multi.surbl.org. A 16 > 25_uribl.cf:urirhssub URIBL_AB_SURBL multi.surbl.org. A 32 > > Bye, > Raymond. > > > ------------------------------ While it's true that the rules are there, don't we have to add scores to local.cf? (I upgraded this AM, too). Regards, Alden

2 1

Question re: integration with SpamAssassin 3.0
by Ed Kasky 26 Sep '04

26 Sep '04

I really hope that this is not too obvious but I can't find a clear answer to this so here goes ;-) I have been using the SURBL plugin with SA 2.64 successfully and have just upgraded SA to 3.0. In the docs it states that it is best to use multi.surbl.org with 3.0. Is this configured by default somewhere or do I need to add the rule to local.cf?? I have been watching the spam processed so far this morning and I am getting hits on the lists I had configured with 2.64 but not multi which is why I ask. If I do need to add the rule, what is the exact syntax to use for 3.0?? My apologies if this has been covered before - my searches came up pretty empty. Thanks. Ed . . . . . . . . . . . . . . . Randomly generated quote: A closed mind is like a closed book: just a block of wood.

2 2

mailbacks.com OB FP?
by Jeff Chan 26 Sep '04

26 Sep '04

Does anyone have opinions on whether mailbacks.com should be whitelisted? Currently it's in OB, but it has no NANAS or SBL hits. Registrant: Vincent Associates INc (TOFGMBXNWD) 26 Lesmill Rd Toronto Ontario M3B 2T5 CA Domain Name: MAILBACKS.COM Administrative Contact: Vincent Associates INc royst(a)vincentinc.com 26 Lesmill Rd Toronto Ontario M3B 2T5 CA 416 445 5443 x 236 fax: 416 445 4504 Technical Contact: Retail Holding Inc. NSI nsiholding(a)verisign.com NSI Retail Holding Inc. 13200 Woodland Park Drive Herndon VA 20171 CH 818-547-9420 fax: 818-547-9420 Record expires on 12-Aug-2014. Record created on 12-Aug-2004. Database last updated on 26-Sep-2004 05: 11: 36 EDT. Domain servers in listed order: NS0.VINCENTINC.COM 209.5.255.57 NS1.VINCENTINC.COM 209.167.106.57 NS0.BIZCONTINUITY.COM 209.167.206.130 NS2.BIZCONTINUITY.COM 207.219.9.10 Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 4

Whitelisting doubleclick domains?
by Jeff Chan 26 Sep '04

26 Sep '04

Someone pointed out off list that Doubleclick domains appear in some of the SURBL lists, and that while they do appear in some spams, they also appear in a lot of hams. Therefore should we whitelist Doubleclick domains? Thanks to some good research tools, we have a list of some of them: * 1: 0mm.com * 2: 2clk.net * 3: abacus-direct.com * 4: businesslink-2.net * 5: businesslink.net * 6: cr-mail.org * 7: dartmail.com * 8: dartmail.net * 9: dartmail3.net * 10: dclk.net * 11: destinationwww.com * 12: double-click.com * 13: doubleclick.com * 14: doubleclick.de * 15: doubleclick.net * 16: maildart.net * 17: messagemedia.com * 18: opt-inemail.com * 19: optin-email.com * 20: unitymail.net Again, we know they appear in some spammy mailings. But do they appear in enough hammy messages to whitelist? Comments? Jeff C. -- "If it appears in hams, then don't list it."

2 2

OB FP
by Theo Van Dinter 26 Sep '04

26 Sep '04

Found this during my weekly SpamAssassin net-test run: overseasvote2004.com -- Randomly Generated Tagline: "Spending time with my ex-wife this weekend was more enjoyable than this interview, but it was close." - Unknown

2 1

SURBL classification control panel
by Yves Junqueira 24 Sep '04

24 Sep '04

How exactly do you guys add your domains? I've made another SURBL tool. It's a "spam-operator" interface with efficiency in mind, using Perl. It requires a database (MySQL, SQLite or any DBI-aware). This tool constantly reads a given directory (/var/vmails/spambox(a)domain.tld/) recursively, checking mail contents. At the momment, it's only supposed to gather SURBL in spamboxes, or boxes made of spam reports. The control panel is not intuitive. It is made to be efficient. It will extract all URIs and then use that to make a table, listing all domain it found, showing some info and the control options. ATM, it gives a the following options: 1) View the e-mail source, in plain text 2) Open that message in squirrelmail ( webmail) 3) Whitelist that domain 4) Ignore that domain (later it should only ignore the domain in that message only) 4) Add the "full domain" (kit.net, for example, is a brazilian free host that provide virtual domains. blablabla.kit.net should be added, not the whole kit.net) 5) Add the short domain (in that case, add kit.net) Wouldn't this be of use to some of you? I can show you a sample later, although it's ugly and using portuguese to describe the options. That is just a part of my efforts of making a antispam tools framework. After reading those policy proposed by Jeff Chan, I'll soon find a way to rate the domains and show those in symbolic colors in the list. The idea is to use whois to gather information (domain age, NS and domain owners historic ratings, etc) and other automatic techniques . I could even make historic rates for all domains, trying to certify that "if it appears in hams, then don't list it." What do you think? -- Yves Junqueira http://i-admin.blogspot.com

1 0

Re: [SURBL-Announce] ANNOUNCE: Adding new JP list to multi.surbl.org
by Mariano Absatz 24 Sep '04

24 Sep '04

On Thu, 23 Sep 2004 00:58:42 -0700, Jeff Chan <jeffc(a)surbl.org> wrote: > [Please post follow ups to the SURBL discuss list or to me.] > > One of the distinct data sources currently feeding into > ws.surbl.org includes data from Joe Wein and Raymond Dijkxhoorn > with his colleagues at Prolocation. Raymond and Prolocation > are currently processing more than 300,000 potential spams per > day using Joe's jwSpamSpy server software and combining those > with Joe's own results. In addition to the data processing > software, Joe has an elaborate, thorough, and well-thought-out > set of inclusion criteria which includes age of domain > registration, manual checks, and other factors. The resulting > data are an extensive list of spam URI domains with a very > low false positive rate (hits on legitimate messages). We > are calling this resulting data JP for Joe Wein + Prolocation. > > The bottom line is that JP (called PJ in the table below) has a > significantly lower false positive rate than WS while having > similar spam detection rates, for example as measured against a > large corpora set belonging to Theo Van Dinter of SpamAssassin: > > OVERALL% SPAM% HAM% S/O RANK SCORE NAME > 2424443 2357143 67300 0.972 0.00 0.00 (all messages) > 100.000 97.2241 2.7759 0.972 0.00 0.00 (all messages as %) > 7.595 7.8122 0.0045 0.999 1.00 0.00 URIBL_SC_SURBL > 76.754 78.9448 0.0178 1.000 0.80 0.00 URIBL_OB_SURBL > 77.230 79.4340 0.0208 1.000 0.60 1.00 URIBL_PJ_SURBL > 0.985 1.0126 0.0045 0.996 0.50 0.00 URIBL_AB_SURBL > 82.119 84.4600 0.1367 0.998 0.40 0.00 URIBL_WS_SURBL > 0.021 0.0216 0.0045 0.829 0.00 0.00 URIBL_PH_SURBL > > So we feel the data could usefully be broken out into a > separate list which could safely be scored higher than > WS. We also continue to work on improving the False Positive > rate of WS of course. We propose making JP a separate list > within multi.surbl.org, but *not* a standalone list like > jp.surbl.org, since it's a major effort to set up entirely > new lists and most people should be using multi now. > > The main reason for announcing this change ahead of time > is to allow developers of the many programs (in addition to > SpamAssassin) now using SURBL data to update their code or > configurations to take into account that the result codes in > multi will be changing as a result of adding JP. JP would get > the 64 bitmask, as in: > > 2 = comes from sc.surbl.org > 4 = comes from ws.surbl.org > 8 = comes from phishing list (labelled as [ph] in multi) > 16 = comes from ob.surbl.org > 32 = comes from ab.surbl.org > 64 = comes from jp list > > So a record in SC, WS, and JP would give a value 127.0.0.70. > One with WS, OB, and JP would resolve to 127.0.0.84, etc. > Programs using multi.surbl.org should be updated accordingly. > > Since JP is currently included in WS, there will be 100% > overlap of JP entries in WS so that any record in JP will > also be in WS. In other words about half of the WS records > in multi will increase by 64 due to overlap with JP. But > WS will continue to use the 4 bit, as before. If your > programs are decoding the multi results using the bit > positions, they should need no adjustments to continue to > handle the WS data. > > We hope that 5 days is not too short notice for this kind of > change.... I will try to contact the developers of the various > (non-SA) programs separately to make sure they're aware of the > coming change. Hopefully most of them are on this announcement > list however. > > We were not able to get JP as a separate list in yesterday's > SpamAssassin 3.0.0 full release, but we have gotten it into > SA 3.1 development. > > For now the JP data will continue to be included in WS, > but just before Spam Assassin 3.1 gets released (probably in > 6 months to a year from now), we will remove JP data from WS > to make them separate lists within multi. This means that > SpamAssassin 3.0 and other current users of WS will continue > to to get the benefits of JP under their default shipping > configurations, and that JP can also be used separately by > those who modify their configurations to take advantage of it. > > In summary, we will: > > 1. Add JP to multi.surbl.org on Monday September 27th. > (Note that like PH, JP would not be available as a separate > list, only as part of multi.) > > 2. Keep the JP data in WS for now, so that regular 3.0 users > get the advantages of JP also (as part of WS). > > 3. Ask the SpamAssassin developers to score JP separately in > SA 3.1. > > 4. Remove JP from WS before the final SA 3.1 mass check and > re-scoring is done, to make the two lists more separate > for 3.1 . (Note that the separation is removal of the > specific subset arrangement suggested in #2. If that is > done, there will still be some minor overlap of the records > in WS and JP.) > > 5. Inform people about removing JP from WS before we do it, > so existing WS users can add JP, etc. > > Please post follow up questions or comments to the SURBL discuss > list or to me personally. It looks to me as a sensible way to handle this... I followed your advise about SURBL scoring in a thread a few weeks ago (I think Theo or another ninja also participated), but WS has a somehow low score... I didn't rise it, 'cause I have a setup that is very FP-sensitive (large ISPs), but would love to see high-quality, high-scoring multi sublists... Do you have a current reasonable scoring for jp? (that is, considering that, for now, this score will be added to the ws score, since, until SA3.1, jp will be a subset of ws. Thanx. -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com

2 1

RE: [SURBL-Discuss] RFC: SURBL inclusion policy
by Chris Santerre 24 Sep '04

24 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, September 24, 2004 7:40 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] RFC: SURBL inclusion policy > > >In order to assist people hand-classifying spam URI domains and >IPs for inclusion or non-inclusion in SURBLs, I've made a draft >policy document: > > http://www.surbl.org/policy.html > >Please read it and post your comments. Good work. No footnote for 90% spammy, then send to UC. :) --Chris

1 0

SURBL independent daemon, pluggable into amavis
by Yves Junqueira 24 Sep '04

24 Sep '04

Hi, for those that don't use SpamAssassin and would like to make SURBL checks on their mail, I've adapted Devin Carraway's plugin to qpsmtp, making a daemon that is independent, forking itself as needed. I believe it performs well, even on high traffic mail. Its simple usage interface, that was made with amavisd antivirus code in mind, is possibly usable by other services. Whenever a mail comes, one should connect to it and order it to scan the dir or file that message is on. # telnet 127.0.0.1 20098 SCAN /tmp/ Scanning /tmp/ Checking /tmp/filex8QBXY Checking /tmp/ldap18775 OK. OK Connection closed by foreign host. # # echo 'http://123getnow.com' > /tmp/a # telnet 127.0.0.1 20098 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. SCAN /tmp/ Scanning /tmp/ Checking /tmp/a SPAMMEDURL: 123getnow.com in surblgoiano.com.br (SPAMMER 123getnow.com) Action: deny DENY Connection closed by foreign host. # Just check for "DENY" or "OK" and you're done. In this example, "surblgoiano.com.br" is my local RBL zone for bad URIs. It's easy to plug it into amavis: /etc/amavisd.conf: @av_scanners : (...) ['Suri', \&ask_daemon, ["SCAN {}/../email.txt\n", '127.0.0.1:20098'], qr/^OK/, qr/^DENY/, qr/^SPAMMEDURL:.*[(](.+)[)]/], (...) The important part there is: SCAN {}/../email.txt As you can see, there is a problem here. In this case, all messages with a spamvertised URI will be considered a virus, and actions will be taken aproprietely as per amavis config. In this case, I'd recommend using initially a non-deny "$action" setting, for seeing any potential problems in the logs (syslog) before really applying this "dangerous" policy. In any case, it is very recommended too that you quarantine these "infected" messages. This is a perl beginner's work, so please excuse any mistakes. It was made to fit my needs, as I maintain my own suribl zone, which is small, yet made for as little false positives as possible and with a special attention to brazilian domains. I haven't tested it with SURBL.org zones, yet. I am also making a transparent SMTP proxy for using with Postfix in servers with low traffic and/or running a local RBL daemon (rbldnsd). It would prevent losing e-mail. Any potential false positive would be notified by the SMTP reject code after the end of the DATA command block. Do you think it could be useful? You can get this plugin, that I called SURI, at http://i-admin.blogspot.com . I'd appreciate any comments very much. It's my first free software ever relased :-P -- Yves Junqueira nictuku - irc.freenode.net http://www.lynx.com.br

3 3

Whitelist data: Alexa.com top 500
by Joe Wein 24 Sep '04

24 Sep '04

Alexa by Amazon.com has a top 500 list on its site, which it derives from stats collected via its Alexa toolbar plugin. This may be a good source of whitelist data. Any site making that high score has the potential to cause a lot of collateral damage if blacklisted, since these appear to be sites that lots of real-life users *do* to visit regularly, as opposed to sites that advertisers suggest they visit, so they are likely to be mentioned in legitimate personal or business e-mail. Probably sites popular enough to be there have far more to lose than to gain from spamming anyway. I took the HTML from Alexa's five pages which listed 100 sites each, did a bit of text editing and hey presto: here's the list as an attached ASCII file. A quick check against my local blacklist yielded exactly 0 intersections :-) The following entries appeared in suspicious mail or as sender addresses and had been investigated by my filter (WHOIS lookup, etc.), but were not classified as spam domains: 163.net 39.net 888.com 8u8.com chosun.com ctinets.com dreamwiz.com eastday.com enet.com.cn etang.com freeservers.com globo.com km169.net linksynergy.com marktplaats.nl mingpao.com mingpaonews.com mym.net mypcera.com nastydollars.com nate.com naver.com nifty.com no-ip.com opendiary.com rambler.ru sayclub.com trafficmp.com xaonline.com yesky.com About a third of the top 500 sites (160) were already in my local whitelist. I'll probably add the rest to my whitelist too. Anybody here who can bulk-check these against SURBL, in case there are listed sites? Joe -- http://www.joewein.de/sw/jwSpamSpy/

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss