- Discuss - Mailman 3

RE: [SURBL-Discuss] Re: Need help checking FP list from Theo
by Chris Santerre 09 Sep '04

09 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, September 07, 2004 9:38 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Re: Need help checking FP list from Theo > > >On Tuesday, September 7, 2004, 6:16:36 PM, Jeff Chan wrote: >> On Tuesday, September 7, 2004, 5:40:47 PM, Joe Wein wrote: >>> Chris Santerre wrote: >>>> Domain List matching contacts_email of hostmaster(a)1and1.com >>>> >>>> * 1: 1-asian-sex.com >>>> * 2: 1and1.com >>> ... >>>> * 48: uptimesoftware.com >>>> * 49: wonderfulldeals.com > >>> I think you're missing the point, Chris. The domain >1and1.com is unlikely to >>> be listed in spam, let alone *only* listed in spam. >Furthermore, of the >>> domains you list I had a hard time finding one that was >both active and >>> SURBL-listed. > >> I hope Chris was showing us some other domains with similar >> registration information. That said, *registrar* information >> isn't to useful except in the case of mostly blackhat registrars. > >I should add, this kind of data is only useful in proving a >blackhat registrar if we also know how many other domains >they have registered. > >If a registrar has 100 spam domains but 100,000 legitimate >ones they're probably not a blackhat registrar. If another >registrar has 100 spam domains but 20 legitimate ones, they're >likely a blackhat. Domains belonging to the second registrar >could be "scored" as more likely spammy by some yet to be >written (or revealed) software. However that only works if >you can see the other 100,000 and the 20, which normally you >can't. > >In other words not enough information may be visible to >draw reliable conclusions about the badness of a given >registrar. On the other hand some general information >about the number of domains some large registrar holds is >available at registration statistics sites like: > > http://www.whois.sc/internet-statistics/registrar-stats-2003.html > Jeff and Joe, This is exactly why I posted this info! For info purposes. I don't know a german web hoster from a hole in the wall! (Thats a crazy american saying for I don't know jack about them!) But I do have access to similar registrar info. And quite a lot more then what I posted. It is my hope that one day I can make it privately availible to SURBL guys. But right now I can't. Look at Jeff's comment: " > Domain List matching cluster of russ-effrig > * 1: 007inkjets.com > * 2: 00inkjets.com > * 3: 111inkjets.com > * 4: 123cartridges.com > * 5: 123inkjets.com [...] >That's interesting, but I think it misses the point:" NO it doesn't! The point was..... its interesting!! :) 123inkjets has been linked to a ton of other spam domains. The fact that they have customers makes it legit???? SO anyone who falls for these spams and buys something, makes it legit? Think about that. Where do you draw the line? All spams will have some suckers. All spams will therefore have customers. All spams will have SOMEONE report it is legit. This shall forever now be known as the Santerre Theory of Spam Legitamicy. :) I fully intend to be the Ying to Jeff's Yang. *giggle* SO we gather a few things from the info I posted, and added to by what you guys know. 1and1 is ok to whitelist. But 123inkjets is a more difficult domain. For me I say leave them listed. Sometimes legit companies spam. If they feel little pain, they will do it again. I hate FPs as much as Jeff. --Chris

2 1

RE: [SURBL-Discuss] Whitelist all Bonded Senders?
by Chris Santerre 09 Sep '04

09 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Saturday, September 04, 2004 5:04 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Whitelist all Bonded Senders? > > >On Saturday, September 4, 2004, 2:01:05 AM, Raymond Dijkxhoorn wrote: >>> >> How about www.senderbase.org ? > >>> > I would not go that way, people can test on >senderbase/bonded sender, and >>> > just like habaes this will be abused also. In my SA setup >the above scores >>> > are also taken, and will bias the score... > >>> Are any of them grey? Bonded sender claims they have paid out >>> only tiny amounts of bonds due to violations. >>> >>> Remember that not everyone uses SA. I'd like to have a list of >>> non-spammers to exclude from SURBLs. > >> I have requested rsync access on the zones, they have >responded to that >> and we will setup a feed, afterwards i can have a look on >the zones, and >> check a little better. More indepth... > >Sounds perfectly reasonable. We can check if any of their >customers hit our lists. > >Are there any other nominally whitehatting organizations >we could check into? Are there any real whitehat >certification groups? Anyone who mentions DMA will be introduced to my hockey stick! Just want to make sure we are all clear on that one ;) -note- DMA = Direct Marketers Assoc. = the evil empire --Chris

3 3

RE: [SURBL-Discuss] Need help checking FP list from Theo
by Chris Santerre 09 Sep '04

09 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, September 07, 2004 6:20 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Need help checking FP list from Theo > > >On Tuesday, September 7, 2004, 9:18:31 AM, Doc Schneider wrote: > >> I'm totally shocked that yale and seti could even be >considered "spammy" > >> And can I help with the flogging? <BOFH> > >Because they appeared in a ham does not mean they're spammy. >Sometimes it just means that some other URI in that message >got tagged. > >E.g., a message like: > > "I buy my pills from walgreens.com (a U.S. brick > and mortar pharmacy) not randompillspammer.com." > >could get tagged since it mentions a spammer. But it >doesn't mean walgreens.com is necessarily a spammer. > >Similarly seti and yale probably got mentioned along >with a listed record. > What the (#&@? So we got a list of ALL domains that were in FP reported emails. Instead of JUST the ones that actually caused the FP??????? *sigh* Well there's a few hours of my life I won't get back! --Chris

2 1

Savvis potentially shutting down 148 spammers on its network
by William Stearns 08 Sep '04

08 Sep '04

Good day, all, http://news.bbc.co.uk/1/hi/technology/3634572.stm , seen on slashdot. I don't know anything more than what's there, but it would be marvelous if their claim of shutting off their spamming customers within 10 days was true. Just in case it does turn out to be true, we ought to release SA 3.0 before they do, so we can take credit for the drastically reduced amount of spam. *grin* Just kidding. Cheers, - Bill --------------------------------------------------------------------------- "Knowledge is of two kinds. We know a subject ourselves, or we know where we can find information upon it." - Dr Samuel Johnson (1775) (Courtesy of David Cozzens, <dcozzens(a)ejhs.k12.vt.us>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

1 0

RE: [SURBL-Discuss] Whitelist Please
by Chris Santerre 08 Sep '04

08 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >In a gamer's analogy, we have the BFG9000 with quad damage >and friendly fire is on. Well now I get it! :-) --Chris

1 0

RE: [SURBL-Discuss] Numerous FPs
by Chris Santerre 08 Sep '04

08 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, September 07, 2004 6:29 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Numerous FPs > > >On Tuesday, September 7, 2004, 8:18:20 AM, Chris Santerre wrote: >> Some info: > >> Domain List matching contacts_email of can_craft(a)yahoo.com > >> * 1: a2zsol.com >> * 2: bannerscape.com >> * 3: db-hosting.com >> * 4: global-submit.com >> * 5: mardox.com <-- >> * 6: safe-mail.com >> * 7: safemaildeluxe.com > >> Domain List matching contacts_email of hostmaster(a)hotels.com > >> * 1: 180096hotel.com >> * 2: 8002hotels.com >> * 3: hoteldiscounts.com <-- >> * 4: hotelresnetwork.com >> * 5: vegashotel.com > >> Not sure if that helps to decide on those 2. But can't hurt >to have the info >> :) > >Are you saying we should whitelist them all or that some >are spammy? > >If you have research that shows one way or the other, >then please let us know. > >Jeff C. > Nope, not saying anything. It was just some info to look at. It didn't sway me either way. But not everyone has access to this info. Matter of fact I can count them on one hand ;) --Chris

1 0

Activating only SURBL and disabling other DNS/network tests in SA 3.0
by Yusuf Goolamabbas 08 Sep '04

08 Sep '04

Let's say that I want to enable only SURBL lookups in my SA 3.0 config. For now, I have to load the plugin and specifiy dns_available yes in my SA config. Since I don't want to do any RBL or other checks which may get activated as a side effect of specifying 'dns_available yes'. I also specify the following use_razor2 0 use_dcc 0 use_pyzor 0 skip_rbl_checks 1 score NO_DNS_FOR_FROM 0 score ROUND_THE_WORLD 0 Is there any other rules/settings I need to configure to prevent them from firing due to 'dns_available yes' Regards, Yusuf -- Yusuf Goolamabbas yusufg(a)outblaze.com

2 1

RE: [SURBL-Discuss] Re: Need help checking FP list from Theo
by Chris Santerre 08 Sep '04

08 Sep '04

OK, you asked for it ;) Some of this info will give you a 'feel' for who the hosts operate. >>Theo got us a list of 112 new false positives >from across all >>SURBLs. He showed me the source >messages which are almost >>all subscribed newsletters and mailing list >messages, so they >>seem quite hammy. > >>Given the type of source messages and some >spot checking, I'm >>inclined to whitelist them all, but I'd like to >ask for some help >>checking them first. Can anyone help check >these? > >123inkjets.com Oh, these guys are on my personal poop list! http://groups.google.com/groups?q=123inkjets.com+abuse&hl=en&lr=&ie=UTF-8&sa =G&scoring=d Domain List matching cluster of russ-effrig * 1: 007inkjets.com * 2: 00inkjets.com * 3: 111inkjets.com * 4: 123cartridges.com * 5: 123inkjets.com * 6: 123lasertoner.com * 7: 411inkjets.com * 8: 911inkjets.com * 9: amazingofferings.com * 10: communicationadvisor.com * 11: customoffers.com * 12: customoffersmail.com * 13: ebabyloninc.com * 14: etoll.net * 15: freecartridges.com * 16: imagerocket.com * 17: inkjetorder.com * 18: itsimazing.com * 19: mosaicdatasolutions.com * 20: niftyoffer.com * 21: proinkjets.com * 22: rocketmouse.net * 23: yourmailsource.com * 24: zbeta.com * @SPAM/spamsource: 553 SPEWS [1] zaconta, see http://spews.org/ask.cgi?S1467; SPEWS [1] tonerbuys, see http://spews.org/ask.cgi?S1506; 207.178.170/24: 553 SPAM,PINK 207.178.128.0/17 iswest.net AS5033 dedicated spam network - S1467,S2747,S2705,S2657,S786,S1467,SBL9192 2003-07 * SPEWS/spews.org: 553 SPEWS2 [1] zaconta, see http://spews.org/ask.cgi?S1467; SPEWS2 [1] tonerbuys, see http://spews.org/ask.cgi?S1506; 207.178.170/24: 553 SPEWS2 [2] zaconta, see http://spews.org/ask.cgi?S1467 >1and1.com http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&scoring=d&q=1and1.com+abu se&btnG=Search Domain List matching contacts_email of hostmaster(a)1and1.com * 1: 1-asian-sex.com * 2: 1and1.com * 3: ansonline.com * 4: attachs.com * 5: autoperl.com * 6: basix.com * 7: bb4f.info * 8: bloated.org * 9: bonzil.com * 10: clickforhosting.com * 11: college-nudes.net * 12: colomb.org * 13: cyber-cd.com * 14: discreetdvd.com * 15: diveadventurers.com * 16: domymarketing.com * 17: dynawebdesigns.com * 18: e-hostonline.net * 19: e-mazingdeals.com * 20: equestriantherapy.org * 21: equotesonline.com * 22: extremmovies.com * 23: ffa-usa.com * 24: freepussypass.com * 25: ghostbiz.com * 26: globaladvt.com * 27: gun-sales.com * 28: ivee.org * 29: ladygodivanetwork.com * 30: linethai.com * 31: marketingconceptsgroup.com * 32: medicalwebservices.net * 33: metreward.com * 34: micacy.com * 35: michigan-business.com * 36: myhouselist.com * 37: myproemail.com * 38: nastiest-teens.com * 39: njmovietime.com * 40: onlinehome-server.com * 41: onlinehome.us * 42: propappr-alachua-fl.org * 43: softwarepark-goa.org * 44: something-else.org * 45: speedyvalues.com * 46: systechintegration.com * 47: theinfoman.com * 48: uptimesoftware.com * 49: wonderfulldeals.com > >Gotomypc.com sells a remote access product >Yale.edu is the domain for Yale University http://spews.org/html/S2611.html Domain List matching spews of S2611 * 1: ca.us * 2: expertcity.com * 3: gotomypc.com * 4: internap.com * 5: pcmag-direct.com * 6: pnap.net * 7: spamlaws.com * 8: twtelecom.net * 9: wd10.com * 10: wd12.com * 11: whew.com * 12: worldatamail.com Results: Positive=5, Negative=25 (2004-09-07 15:44:25 UTC) * @ISP/blackholes.us: 66.151/16: 553 ISP INTERNAP - http://hatcheck.org/google?internap; http://hatcheck.org/sbl?internap [Blockparade] * @SPAM/spamsource: 66.151.158/24: 553 SPEWS [1] expertcity/gotomypc, see http://spews.org/ask.cgi?S2611; 66.151/16: 553 SPAM,PINK,BLOCK 66.150/16 66.151/16 66.151 66.151.44.151 joe4257769(a)mailgeorgebush.net INTERNAP 2003-04 * DRBL/drbl.all: 66.151/16: 553 DRBL weight: 0.6; vote.drbl.vimas.kiev.ua(a)ns.vimas.kiev.ua/0.6 * SPEWS/spews.org: 66.151.158/24: 553 SPEWS2 [1] expertcity/gotomypc, see http://spews.org/ask.cgi?S2611 * FIVETEN/internap.com.spam-support: added 2002-07-07; spam support - hosting sendoutmail.com and jdrmedia.com; added 2003-07-22; spam support - hosting e-i1.com spamming from NET-63-251-54-64-1; added 2003-07-02; spam support - hosting http://www.adaniexports.com on 63.251.163.110; added 2004-03-08; spam support - see http://www.spamhaus.org/SBL/sbl.lasso?query=SBL14734; added 2004-07-31; spam support - see http://www.spamhaus.org/SBL/sbl.lasso?query=SBL10031; added 2004-07-31; spam support - transit for AS30038 whose entire 69.63.160.0/20 is on the SBL; added 2003-01-15; spam support - see http://www.spamhaus.org/sbl/listings.lasso?isp=internap.com; added 2003-05-20; spam support - hosting http://www.pr0debtc0nsu1tants.com on 64.74.96.230, was on 63.251.163.110, was on verio; added 2002-01-22; on sprint.net; added 2002-10-07; spam support - hosting netflip.com; added 2003-02-04; spam support - transit for AS18633; added 2003-04-13; spam support - transit for wholesalebandwidth; added 2002-12-07; spam support - dns service for columbiahouse.com; added 2002-09-17; spam support - see http://spews.org/html/S373.html; added 2002-09-10; spam support - hosting randbad.com on 209.191.175.226; added 2002-07-22; spam support - hosting internetseer.com and roving.com I would love a copy of all the reported FPs. Perhaps they should be moved to the IC list? --Chris

3 5

Need help checking FP list from Theo
by Jeff Chan 08 Sep '04

08 Sep '04

Theo got us a list of 112 new false positives from across all SURBLs. He showed me the source messages which are almost all subscribed newsletters and mailing list messages, so they seem quite hammy. Given the type of source messages and some spot checking, I'm inclined to whitelist them all, but I'd like to ask for some help checking them first. Can anyone help check these? 123inkjets.com 1and1.com 1sound.com 4d.com 65.17.207.40 69.50.139.61 8k.com aaronsw.com achtungachtung.com activatormail.com addictivetechnologies.net aec.at agnitum.com aladdinsys.com amnesty-volunteer.org ampcast.com apple.ru atstake.com barebones.com bbspot.com bis1bp.com bridgingthegapforhealthcare.org classesusa.com clearcredit.com commonwealthclub.org conceptdraw.com crime-research.org ctsg.com default-homepage-network.com design-tools.com dontspyon.us drbott.com drivesavers.com drorshalev.com duckland.org ecsirt.net faithfulamerica.org fetchsoftworks.com fipr.org firearmsandliberty.com firepaige.org firewiredirect.com flingstone.com forest.net geoffmetcalf.com globat.com gotomypc.com guninski.com hasbrouck.org hiramoto.org hnc3k.com imgfarm.com imrsvcs.com inderjeetsodhi.com joegratz.net karelia.com lacie.com lacipeterson.com m-w.com macsales.com mail15.com maliasoft.com moveon.org mutemail.com mysurvey.com navi.cx news-miner.com ourfuture.org oxsemi.com passthison.com pcpitstop.com pivx.com pivxlabs.com popmoney.net port5.com postarmor.com prosoftengineering.com qwik-fix.net ravantivirus.com redhawk.org redlers.com reunion.com safecenter.net salary.com saturnevents.com secnetops.biz secnetops.com seti.org smalldog.com snopes.com soundclick.com spywareinfo.com tex-edit.com the-livingstons.org tidbits.com tu-cottbus.de ukclimbing.com umbrella.name uophx.edu uoregon.edu userfriendly.org vechtwijk.nl virtual.net virusall.com westdam.com wiebetech.com wireless-starter-kit.com wlug.org worldwidemart.com wpi.edu wsacorp.com yale.edu Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

7 25

Numerous FPs
by Ryan Thompson 08 Sep '04

08 Sep '04

Reposting, for those not following the original thread. I found the following FPs in WS in a large recent ham corpus. I suggest whitelisting all of these. buckeye-express.com -- Used in a personal email address, looks legit; 7 examples nm.ru -- Used in a personal email address, looks legit advanstar.com -- Legit uses; found in a well-known dental newsletter; also personal email address of one of the editors; 3 messages 00fun.com -- Confirmed, more than one user on our system sent or received eCards from them northstarconferences.com -- Legit conference host site subscribed to by two users; 9 messages in this corpus mardox.com -- Search engine; registered 1875 days ago, and *looks* like the user did actually submit their site to them. postsnet.com -- Registered exactly one year ago, 51 NANAS, blank home page, ehh... but I have 4 different legit newsletters with links to them. webspawner.com -- Created in 1996; free host/email npdor.com -- Surveys; been around since 1999. 103 NANAS, but they've been advertised by some reputable "word of the day" mailers (dictionary.com) Maybe a good candidate for UC. :-) 2 examples imninc.com -- Domain is 507 days old; they do newsletters. At least one of them is legit. :-) worldhealth.net -- It's 3468 days old today (1995). One of our users attended a conference of theirs, and signed up for a newsletter. hoteldiscounts.com -- 2459 days old (1997), found in actual room booking confirmations for Comfort Inn. - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

5 6

Nonexistent domains
by Ryan Thompson 08 Sep '04

08 Sep '04

What's the deal with nonexistent domains? I've been seeing more of these in my corpora. They don't look like typos. Are spammers making up names, or are they registering domains and having them deleted later (either by their choice, or the registrars'?) Should we even consider listing them, or is poisoning not-yet-registered domains too much of a risk? Here's an example mail. In this case, the other domain in the email, "netdreamwatches.com", is already in many SURBLs, but "netdreamwatches4.com" does not exist. My thought is *not* to list the NX'ers if there's another existing domain in the mail fit for SURBL. ------------------------------------------------------------------------- Received: from 250.93.180.0 by 82.181.73.98; Sat, 04 Sep 2004 21:06:45 -0500 Message-ID: <COYELLCYZAXZCUMLBQUNZDMH(a)hotmail.com> From: "Everett Dooley" <sexdw(a)yahoo.com> Reply-To: "Everett Dooley" <sexdw(a)yahoo.com> To: private(a)email.com Subject: Order now for free shipping on all watches! Date: Sat, 04 Sep 2004 20:09:45 -0600 X-Mailer: AOL 9.0 for Windows US sub 022 MIME-Version: 1.0 Content-Type: text/plain; boundary="--80228313128822712" X-Priority: 3 X-MSMail-Priority: Normal X-IP: 99.152.240.119 hey there!, Great deals on imitation rolex and etc.... go to http://www.netdreamwatches.com for more info kind regards Everett Dooley get out of this sessions http://dreamwatches4.com/beout.asp -------------------------------------------------------------------------- - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

3 2

RE: [SURBL-Discuss] Numerous FPs
by Chris Santerre 08 Sep '04

08 Sep '04

Some info: Domain List matching contacts_email of can_craft(a)yahoo.com * 1: a2zsol.com * 2: bannerscape.com * 3: db-hosting.com * 4: global-submit.com * 5: mardox.com <-- * 6: safe-mail.com * 7: safemaildeluxe.com Domain List matching contacts_email of hostmaster(a)hotels.com * 1: 180096hotel.com * 2: 8002hotels.com * 3: hoteldiscounts.com <-- * 4: hotelresnetwork.com * 5: vegashotel.com Not sure if that helps to decide on those 2. But can't hurt to have the info :) --Chris

2 1

RE: [SURBL-Discuss] Need help checking FP list from Theo
by Chris Santerre 08 Sep '04

08 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, September 07, 2004 4:54 AM >To: SURBL Discussion list >Cc: postmaster(a)outblaze.com >Subject: Re: [SURBL-Discuss] Need help checking FP list from Theo > > >On Monday, September 6, 2004, 11:10:50 PM, Ryan Thompson wrote: > >> bis1bp.com FP: Hmm... Domain doesn't resolve thanks >to their not >> being any authoritative nameservers. >> It's 87 days old. If this was really >found in ham, >> I'd say de-list. > >I found this one in the original message and it's part of a >security mailing list mention of a phishing site. Removing >from whitelist. > > http://seclists.org/lists/bugtraq/2004/Jun/0268.html > >It no longer resolves but should be fine to block on IMO. > >Jeff C. Dang it, I replied to a piece of this thread out of order :) I'll try to reply to all of them now... I am +1 for whitelisting .edu. Heck I'm borderline skiplisting them in the hard code. Once we get these all settled, I'd like to find how they all got in here in the first place! seti.org being listed put up red flags for me! Who put that in here? Even if it was me, I should be flogged! Hold on to your chairs, but I agree with Jeff! :) Cleanup is great, but how do things like yale and seti get listed in the first place???? -_Chris

3 2

RE: ANNOUNCE: Top SURBL DNS queries and whitelist hits
by Chris Santerre 07 Sep '04

07 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, September 06, 2004 9:55 PM >To: SURBL Announce; SpamAssassin Users >Subject: ANNOUNCE: Top SURBL DNS queries and whitelist hits > > >We've made a list of the top SURBL DNS queries into my name server: > > http://www.surbl.org/dns-queries.counts.txt > >and a version with only whitelist hits: > > http://www.surbl.org/dns-queries.whitelist.counts.txt > >The sample size is somewhat small at 32k queries over the last 48 >trailing hours, but it's still somewhat interesting. Specifically >2000 queries are sampled every 3 hours. (Please ignore some of >the junk at the end of the unwhitelisted counts. That's stuff >left over from DNS packets which I haven't cleaned out yet.) > >I'm slightly surprised how high in the total rankings some spam >domains are. That represents a huge amount of spam sent and >blocked. :-) > Would it be possible to hard code a "SKIP" for certain URLs? 175 yahoo.com 157 w3.org 87 msn.com 77 flowgo.com Why have the code even bother to check those? Sort of like a permanent hard coded Whitelist. (Bah, Skiplist! I have to stop calling it a whitelist!) This would save traffic. Just a thought. --Chris

5 5

Re: Need help checking FP list from Theo
by Alden Levy 07 Sep '04

07 Sep '04

>Date: Tue, 7 Sep 2004 11:50:50 -0400 >From: Chris Santerre <csanterre(a)merchantsoverseas.com> >Subject: RE: [SURBL-Discuss] Re: Need help checking FP list from Theo >To: "'SURBL Discussion list'" <discuss(a)lists.surbl.org> >Message-ID: <620A4FF9B83DD511B69900062939D037AC015E(a)internal.merchantsoverseas.com> >OK, you asked for it ;) >Some of this info will give you a 'feel' for who the hosts operate. >>>Theo got us a list of 112 new false positives >from across all >>>SURBLs. He showed me the source >messages which are almost >>>all subscribed newsletters and mailing list >messages, so they >>>seem quite hammy. >> >>>Given the type of source messages and some >spot checking, I'm >>>inclined to whitelist them all, but I'd like to >ask for some help >>>checking them first. Can anyone help check >these? >> >>123inkjets.com > >Oh, these guys are on my personal poop list! > >http://groups.google.com/groups?q=123inkjets.com+abuse&hl=en&lr=&ie=UTF-8&s a >=G&scoring=d > >Domain List matching cluster of russ-effrig > > * 1: 007inkjets.com <snip> > * 24: zbeta.com > > * @SPAM/spamsource: 553 SPEWS [1] zaconta, see >http://spews.org/ask.cgi?S1467; > SPEWS [1] tonerbuys, see http://spews.org/ask.cgi?S1506; > 207.178.170/24: 553 SPAM,PINK 207.178.128.0/17 iswest.net AS5033 >dedicated spam network - S1467,S2747,S2705,S2657,S786,S1467,SBL9192 2003-07 > * SPEWS/spews.org: 553 SPEWS2 [1] zaconta, see >http://spews.org/ask.cgi?S1467; > SPEWS2 [1] tonerbuys, see http://spews.org/ask.cgi?S1506; > 207.178.170/24: 553 SPEWS2 [2] zaconta, see >http://spews.org/ask.cgi?S1467 > >>1and1.com >http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&scoring=d&q=1and1.com+ab u >se&btnG=Search > >Domain List matching contacts_email of hostmaster(a)1and1.com > > * 1: 1-asian-sex.com > * 2: 1and1.com <snip> > * 49: wonderfulldeals.com >> >>Gotomypc.com sells a remote access product >>Yale.edu is the domain for Yale University > >http://spews.org/html/S2611.html > >Domain List matching spews of S2611 > > * 1: ca.us <snip> > * 12: worldatamail.com > Results: Positive=5, Negative=25 (2004-09-07 15:44:25 UTC) > > * @ISP/blackholes.us: 66.151/16: 553 ISP INTERNAP - >http://hatcheck.org/google?internap; http://hatcheck.org/sbl?internap >[Blockparade] > * @SPAM/spamsource: 66.151.158/24: 553 SPEWS [1] expertcity/gotomypc, >see http://spews.org/ask.cgi?S2611; > 66.151/16: 553 SPAM,PINK,BLOCK 66.150/16 66.151/16 66.151 >66.151.44.151 joe4257769(a)mailgeorgebush.net INTERNAP 2003-04 > * DRBL/drbl.all: 66.151/16: 553 DRBL weight: 0.6; > vote.drbl.vimas.kiev.ua(a)ns.vimas.kiev.ua/0.6 > * SPEWS/spews.org: 66.151.158/24: 553 SPEWS2 [1] expertcity/gotomypc, >see http://spews.org/ask.cgi?S2611 > * FIVETEN/internap.com.spam-support: added 2002-07-07; > spam support - hosting sendoutmail.com and jdrmedia.com; added >2003-07-22; > spam support - hosting e-i1.com spamming from NET-63-251-54-64-1; >added 2003-07-02; > spam support - hosting http://www.adaniexports.com on 63.251.163.110; >added 2004-03-08; > spam support - see >http://www.spamhaus.org/SBL/sbl.lasso?query=SBL14734; added 2004-07-31; > spam support - see >http://www.spamhaus.org/SBL/sbl.lasso?query=SBL10031; added 2004-07-31; > spam support - transit for AS30038 whose entire 69.63.160.0/20 is on >the SBL; > added 2003-01-15; > spam support - see >http://www.spamhaus.org/sbl/listings.lasso?isp=internap.com; > added 2003-05-20; > spam support - hosting http://www.pr0debtc0nsu1tants.com on >64.74.96.230, was on 63.251.163.110, was on verio; > added 2002-01-22; on sprint.net; added 2002-10-07; spam support - >hosting netflip.com; > added 2003-02-04; spam support - transit for AS18633; added >2003-04-13; > spam support - transit for wholesalebandwidth; added 2002-12-07; > spam support - dns service for columbiahouse.com; added 2002-09-17; > spam support - see http://spews.org/html/S373.html; added 2002-09-10; > spam support - hosting randbad.com on 209.191.175.226; added >2002-07-22; > spam support - hosting internetseer.com and roving.com >I would love a copy of all the reported FPs. Perhaps they should be moved to >the IC list? >--Chris Chris, I agree that these (with the exception of yale.edu) should be moved to the IC list. Unfortunately, since these companies DO have SOME (ONE?) legitimate function, we can't blacklist them here. Of course, I wouldn't object if they were! --Alden

1 0

RE: [SURBL-Discuss] Open Redirector
by Chris Santerre 07 Sep '04

07 Sep '04

>-----Original Message----- >From: Leonardo Helman [mailto:surbl@lists.com.ar] >Sent: Monday, September 06, 2004 2:17 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Open Redirector > > >I'll sent it. > >I've translated that document to spanish. > >Here is the translation. >--------------------------------------------------------------- I know it has already been said, but Thank You! Little things like this mean a lot! Thanks for taking the time to translate and send!! --Chris

1 0

RE: [SURBL-Discuss] whitelisted x10.com
by Chris Santerre 07 Sep '04

07 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Sunday, September 05, 2004 8:45 PM >To: SURBL Discuss >Subject: [SURBL-Discuss] whitelisted x10.com > > >I've whitelisted x10.com. They are a frequent FP since they >"advertise" so much to their own customers. > >I'm surprised it was not whitelisted earlier. x10.com is >probably significant contributor to the ham scores. > >Jeff C. > OUCH! I HATE their marketing practices, but I've purchased there stuff long pefore they started doing that. Their controls keep my lazy butt firmly planted on the couch :) Thanks for whitelisting! --Chris

1 0

cooleremail research
by Chris Santerre 07 Sep '04

07 Sep '04

the IP also goes here: http://www.impactengine.com/index.asp In case that helps anyone. It doesn't tip the scale in either direction for me. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

Whitelist all Bonded Senders?
by Jeff Chan 07 Sep '04

07 Sep '04

Is it possible or advisable to whitelist all Bonded Senders? Are these truly non-spammers? Does anyone know where a list is published? How about www.senderbase.org ? Jeff C.

3 5

RE: [SURBL-Discuss] Re: ANNOUNCE: Top SURBL DNS queries and white list hits
by Chris Santerre 07 Sep '04

07 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, September 07, 2004 9:17 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] Re: ANNOUNCE: Top SURBL DNS queries and >whitelist hits > > >On Tuesday, September 7, 2004, 6:13:19 AM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>We've made a list of the top SURBL DNS queries into my name server: >>> >>> http://www.surbl.org/dns-queries.counts.txt >>> >>>and a version with only whitelist hits: >>> >>> http://www.surbl.org/dns-queries.whitelist.counts.txt > >> Would it be possible to hard code a "SKIP" for certain URLs? > >> 175 yahoo.com >> 157 w3.org >> 87 msn.com >> 77 flowgo.com > >> Why have the code even bother to check those? Sort of like a >permanent hard >> coded Whitelist. (Bah, Skiplist! I have to stop calling it a >whitelist!) >> This would save traffic. > >> Just a thought. > >> --Chris > >Yes, Theo proposed exactly such a thing for SA. The top ones >should be fairly stable, and also offer the greatest reduction >in queries. *cough* great minds..... *cough* :) > >SpamCopURI comes with a local whitelist. Eric could we ask you >to grab some of these, populate that list in future versions >and make it live? The hooks are already there; we just need >to use them, and the top whitelist hits would be really useful. Does this local skiplist ;) just ignore the link, or does it look it up in the local? What I'm getting at is if there are 21 links, should these even be counted as on of the random 20? Actually I think I'm splitting hairs here. --Chris

1 0

RE: [SURBL-Discuss] Setting SpamAssassin scores for SURBL lists
by Chris Santerre 07 Sep '04

07 Sep '04

*snip* > >Thanks for your stats and checking, and yes please anyone else >with ham corpora, please check for FPs. > There is one SARE ninja testing guru that will come online with SURBL when 3.0 is released. I expect a LOT of testing, because he is addicted to it :) He's actually been trying to work with another ninja to test for SURBL FPs already. But the initial tests failed :( So we should have a really great tester online soon. With human errors, I think an SO ratio of 99% is pretty cool. OF course we won't even have that unless we strive for zero FPs. Its a goal. I hand check pretty much everything, but sometimes one slips by :) --Chris

2 1

postmaster@corp.mailsecurity.net.au
by Mariano Absatz 07 Sep '04

07 Sep '04

Hi, I just got a couple of phishing attempts that were not found by ph. I already reported to SpamCop and Bill via web... as I didn't find a way to report to mailsecurity, I'm Cc-ing the postmaster address supposedly used to report FPs (though this is actually a FN). The phishing URL is http://68.94.232.23:87/cit/index.htm (http://%36%38%2E%39%34%2E%32%33%32%2E%32%33:%38%37/%63%69%74/%69%6E%64%65%78%2E%68%74%6D within the message, and hidden behind https://web.da-us.citibank.com/signin/scripts/login/user_setup.jsp). SpamCop correctly found it and decoded it OK. I just went to the site and it's definitively up & phishing. Below my signature is the full message with headers. Regards. -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com Received: from [200.48.93.178] ([200.48.93.178]:26122 "HELO 200.68.65.130") by homero.pert.com.ar with SMTP id <S147789AbUIFXyz>; Mon, 6 Sep 2004 20:54:55 -0300 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 FCC: mailbox://supprefnum6@citibank.com/Sent X-Identity-Key: id1 Date: Mon, 06 Sep 2004 22:54:10 -0200 From: CitiBank <supprefnum6(a)citibank.com> X-Mozilla-Draft-Info: internal/draft; vcard=0; receipt=0; uuencode=0 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 To: interesting-people(a)lists.com.ar Subject: CitiBank - Urgent Security Notification Content-Type: multipart/related; boundary="------------030400000009010506060006" Message-Id: <20040906235501Z147789-995+5845(a)homero.pert.com.ar> This is a multi-part message in MIME format. --------------030400000009010506060006 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit <html><A hREF="https://web.da-us.citibank.com/signin/scripts/login/user_setup.jsp"><map name="FPMap0"><area coords="0, 0, 610, 395" shape="rect" href="http://%36%38%2E%39%34%2E%32%33%32%2E%32%33:%38%37/%63%69%74/%69%6E%64%65%78%2E%68%74%6D"></map><img SRC="cid:part1.06060509.02080307@supprefnum022662506680@citibank.com" border="0" usemap="#FPMap0"></A></a>MIR in 1955 Let me do it date of birth not at all Justin Timberlake Dragonball in 2003 Excite what do you do? Angelia Jolie we need to get That's definetly not you. Mad Cow Disease Huffington blasts Las Vegas In short. gossip Open your Denisse Richards I wonder what if... Shopping Romeo Classified Mother's Day </html> --------------030400000009010506060006 Content-Type: image/gif; name="politicking.GIF" Content-Transfer-Encoding: base64 Content-ID: <part1.06060509.02080307@supprefnum022662506680@citibank.com> Content-Disposition: inline; filename="politicking.GIF" R0lGODlhawKSAfR3AAABAAAAgMDAwMDcwKbK8AAAQOAgQAAggEBAgEBggGBggOBggICAgOCAgICA wKCgwOCgwKDAwP/78P8AAAAA/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAQA AAAALAAAAABiAosBAAX/YCWOZGmeowQ1S2u0bSOhdG3feK7vfO//wKBwSCwaj8ikcslsHiULw2RK rU5eEKd2y+16v+CweEwum2tQq1ptyJ7f8Lh8Tq/b73CVdC3drxczeIKDhIWGh4iJO2lWBg0QgSIq UY1uipeYmZqbnJ0ojFQLliMEkRINflOWEgQPEQOesbKztLW2PqBXo5IPBwQluRNuAggJCAq3ycrL zM13uYAmDwgFBb8mDVZZBAoJ3bDO4eLj5OU/UDDRwNTV1yYQ6Q0VAgkRDwmR5vr7/P22EgADnhjA zhqNgAArSHigQIEAfxAjSpzISULBh4vyUdzIsaPHIBIGCGCowEGpEgMI/wwYECgkAWLVCjxQ6a5C ypUfc+rcyRMFtwMxYx5wEAloNWQVCARdWi3CiIJOe0qdSpWfBAdMlyIAV9CBCAFGsxaIajFm1Kpo 06qlJUGBWK2wwnpN+rapJKhr8+rdi+jB0gMlHSgIi2BGV0kOEodNkNjkXbN8I0uefGZA2AJEUwxw W1iE3HUxaz62S7m06dNL/MacC+wBxgqHSZRtZ2L2WNS4c+vmUbDzjc+yC4pWiHe38ePIwz7IETuF 8NrFkUufXjrocBTAnYeGDpm69+95hYK70Xy0QdCkwatfz9N6juzmh9s+y76+/Ylh6dcoT3w7+tv3 BSjgPgnEhA8O8PVH2/9/+g3o4IPJYNWdCQKMx59tr2mXHoQcdhiLAEs9kM9CBSgQSILzjcCSggB6 6OKLl1y1VAKu2FOQibCt9h8CBLSCgFMpwijkkITYVtcBcelYgltBAeULiw0SKeWUZ7RVVwEHYMRf UpcdZV6UVIYp5hfTiKWAOwmKoFpQy0E55ptweiGBAA4YU4xJ+RAQwZ7XzaMAAgg4NoIAe0agUZyI Jqrooow26uijkEYq6aSUVmrppZhm+kYAnHbq6aeghirqqKSWauqpqKaq6qqsturqq7DGKuustNZq 66245qrrrrymqumvwAYr7LDEFmvsscgmq+yyzDbr7LPQRivttNRWa+3/tdhmq+223Hbr7bfghivu uOSuBcC56ALgRLrqjtBuCe+yi+4P75ZrLxj1ipDvEfnuW4G/+/qLg8D83mswCQArkTC8JyzMA8FG QHwwuALXOy+8F//7b782tJuuxvo2jHDG6pLMsAkmu+suySxbvLHH52LscswTC1uxyiHjnDPNJ9MQ r84BIyz0xji7jHLRQxsNcs5L8+w00CvXTOzNS+98MtU+Q62vvEMj7XXVOncNMtYcV2102RJLXSnV ZY/sMQoS/8x00CjTfDbTPYv9tsh4j61333urHSzbXG+9N9Zwaw323Hbj/TbPeYcdb8ZNX/33yx8v LjimbCeetOdZzx32/9dWFx242JLzXfnnqWvu+uZrq4625aCzvrrmp/v9tcOX9yw36XfbDnumdCtu ce6R/6780Y6f7rzsjDve+u1mGz/8r/ICDDnmuvucOeMlr8yuzOFXD7b2x5fPvfjsT2825G1fLz9H ac9vfzn136///vz37///AAygAAdIwAIa8IAITKACF8jABjrwgRCMoAQnSMEKWvCCGMygBjfIwQ56 8IMgDKEIR0jCEprwhChMoQOzF4b8Ma8JLgxCDLcwwzjU0Afbe90NI4fDHuTwIzuE2/dwJ77x9fBh L1zX6GqgNCYEcQdPVNglojgwH9JLdTdoYhX7lsUlIiGGVOyYFFHHxf/F7bCGvHOiF2sXRjFqoY0R m+IbrXhEHoaujExc4x3hWLsuwjAJaSRiEnWARixSznAyE1rLyhe/9ZVse5R7ZPsSd8jMte2Qiswh JiP5MiZisnlPc1rM0pc1TiLtYibbJCSJVrfJaTKRpFTZIsc2r/hZspNuc5sRWwmzwuFSlnYLpSiD +cPvGZOVnYwl92YGyVEOknkf+53eUvk0Mj7zdkpb3tasd74kVhOb2fSe4jQ2Ozx+k3rKk2bvuna2 bGqzbuOEWdR2Js16km2N7jTeO98JuJFxU3RsBKhAkVnNb9bTkEnLp0Dtqc9rsnOc0jMd8Lb4UOGN 7nkA1WJESzdRa5r/r5zdKyNIOUrSNC5spCMV5EAxStKQUg91yBuoS1m6TzI2MXf8hOlCfXc5kKZN nSxtaeBu2k87VrRpvuzmR/VIPlOS7qIbrak3LRpU12kUlU81aVFR2rFitnKjQkVoRImq1Ev2MaYv xWlU47lEspoVj7nEJk9b51M/JtJ8WV0pVR36z+LFNXgu1CILcVe4cO50qqYzYvqG2DushsyVjN1q YQvrUcf6rnF4pecuGyu84CX2mFh0KUR7ecu+HtV9pE2ZDjGbzl26lXaGQ5xjBRtby77Wpm6U6wtn +7kfnrWyoZ3eQWVrUfflMa+PZSpUrRrQQZ4UtmWlKDrBqlYd/pa5/1ttrm5lKdaWnlan20VsWLE7 144+la3I9ahpoQldeb4ueeDVKl6Hq92ZgpW89k1uUeEb3c6G9rn+3at4PbtUAeNXtDKtrmHTqtIC /5O/OT0ochE32vsqGLX7teZQITpez+bPrxLe7oJnVl+pcpiu/lyuVUM8Yg2nuL3VJSg+j4rZsbJY vTkVrolFzDDetfjE79MrdRP6YIcdb78GRe9CKWzi4h3Zwe/1ojIniUgdqw+uln3fVX0b1VralMuP DJgm4VdZL+/WzGK+8iep68zMPm7MjbyrOWEZ1y6rz6l3vekqq0w+WoaZym5+LPyIWTFCi9bMfE7m OhHNS3feOanLHP+rUQXBR91U2iOXnkOm6biETUPE03zRqGlA/QZS15cIotYLl+0T2dKsuhOmFuKr 6bVmFdr61rjOta4HZOpY49DXx+0QHIHdwiub6w69BoKniR1scTAbDqnuIx6e7QxqE3KOV+x0qfE3 jmgHF9mYPidkYwvoP/8y0ZJcX27NLetMsm/K6S4ioHXZZ3Wr8s7TFOa7/1vu3qKvX80EuC2BSdpm O7qUrvwqRn82TFm/WeAF5++5o13JVaIS0ZI095ovuWerzRrbIV34aUXZ1xDvUZ0NBdo+iSvSka9V 5cIlMsydK2R6arfJGN6md8XbvUK7XOceXnDeknze7Na8vAzl6OT/5iljmk9XombwccuR3NP2IvG+ Rs/6zhN8zboamMAhtyPYJczkqUtc6Gi13OHEHl+rP13KVS+upAPM9p/zk6xDp3rRWyhWI5cXymGH onG1ntK0A5WvVT68UjObePDuVu9b/+u33yrk+j1uvHkXsIcdv+ivWrfDLna6g02earlRHsF8H7Bq T99OxdZ73aE3r2ZLCz0NR5K1Rczy23mr4rmyHsu47/rfyV5FhtfWq7mvcUlXCukhN/7z+RW1fEef 8zljHuxjkDp7IQ94Pf508P3VOo57zzevi37sFi6lirEvfrPXnP1HM36UsU74o98R8Gkn53Klz++5 v53xirR+cpd6/5kHW783YfcHOvxHd6CngJPWgOFXeW7nfQzmfxA2ecOHYl0kf3HGeBe2O5yXcynV Y/sXe463ec6HZRXYfdm3OyKnZPMFg99Hf+GFVA9WgNr3ZGjHdEsXZIsHZjE4c7KFc+9HfNIVhOfH TkO1Yd8lgikGMWqWco93dEwYaBS4g0BnQ4P2aA2XaFaIbq9HXhRHZnRGZQTTMt6zhYwkZ/vWhpFm Rm0mbfeGem/ohRWXZk+nWhLnhV+GhwlXhfPWPo7GSEDIhorWbnXmf6SnXnDoh3BVLs9mbS0IbYkg iV9gidHibWrUDJj4gHbQiVwAis/SausiiuRgijnwcZqgirvWiv+u+IqwGItxNASBhGq0qFyyKClh BGxxI3i5iD22GIq5dYS/aCnsJm+CdngMF3CrpWbDNG5LxorFOCbiJnOB14PgpIA7hoKaOI1wUniK iF4dCI4VaHreGDt9OHdYOI7QhWC29YjnqCgct3antI5191lZxntIJY3xKCXk2E6HhXltV3sgiHj9 KCb/aDt3l2ElqJAG+G0H+SZEl4UddWM6d2brRZGBF5GJcoxviH6kF4cKl4gX12at1Y0cKS2omJLa gpIsWUCk+JIyOZM0WZM2eZM4mZM6uZM82ZM++ZNAGZRCOZREWZRGeZRImZRKuZRM2ZRO+ZRQGZVS OZVUWZVWaYz/2RNTKylDNpQJILaVnDaLvih82VYLYDkLfuVqdkUHUFgEmNiLV1eW87eWZ5mK0tYT YGSQqraWmtZsXEkGcDmWdTSXw1iXxAiPQCSYySg5n3SM8TaHiahuksmYvqVxAbeMAqdl0DhxRNOB YeiRjDZ78ceMyGiInFSSBDd0zzhvoRloEcdumNkwWHWHCJeZr/eYl1ma5Bab59ab69dxflOZtBmZ eMabk5mATWdyF4mNu1dkWKecy7mQTWeDL7dk5Kd6UghkE1l6JceDy0ljMTdznZd0PYdyPliD3kmF Fxle5pmN3ylTWedWZwieAcliOeaX1OeXVaWV7QiP7dl5EfiB/zcYVIEpgbhlfdeHgQwYYwJKjmqn dHEHgFbIjgjIgKh3T84XZ+hngRdIluYldHyZnwm4n+7njrBXmOmIf55Xjn/XVUbYVjOWXrXIVTIa n+34XPQ4oeB3W3CXXoI4kA4lnQKpNQdoecrXox/ahPhJYK1Go0U3WJLZpPTWXfu4fD9YY4p3eoj4 olzUnhvaYA3JoaZHWccXYwGoX4v4fyLYfB/lS/qIObMUo/+XWsiXXyz4o2Baf9VJjPCXliSapwoK XDwnoNGHdP1pbP2noi2qgScmXzyaUQ6YqGeqf3NqfxkqXWjlpMGGoTpafAK4dxGIpFaKhHw6gH6a fmA6o0FKpf+ESqg1iDyImoQ+Cp9iKqphqqiFKn4Jw4FOSH+P2mCu+qeLGpC4SoLcZ3j9map7+p/B hYJdGmHhyZ7PuaMRykoj5jwWaUbz92RI+EoIKq0EKaS0FK3ZSp2y2qkSindeSp8+SHkg6pw3OKm7 h6zpyWPWuachyqSNyZmG2Jt3uFiGtHGNhWb5to9caIaSSm8hiajrSpn96q9kKGmVRJJdmEtlBz7h KGXKN2UFCLEmuaLkxppxiHe+yUNzmH/RRJyk6YYHJwaGyYmeqA8vKyAzu4re4Zn9ULP3obOYwLNm 6bPb1iz8eJVEW7RGe7Qb4WsU9o1IC5GA9EV3iZxNixtKC7X/Tnu1U7sPlglxDElOcJaGr1WcXxuy pdmYaJhJvZSabIib+qahxVm2vjmxt3dOnFlr00hyeuW20cpZUGevxMq3OPhiBZWtETuuDGmPfYt2 5pik7xmRvxqFTqehzVVOI4igknusmjeBo6qtfdd/RUqQm9uPJPt8yrp4cpqrlSuGJvuptRqqeMph LOeoGahSmiq6A5ujjsqmQ7ShdJqpkQqjZdqrFYqnWkq286WHfgZa4AOtEuqNj8tdnhuXvPutgmq6 tHqpmXur+rWpoZe66cp1zXu31Vo5F4uzBuo1qcupXcq6ilq7sLqt1Bqq0Nlzmmu7jCpjPoev1RlM GYme+kuq//JJrtO0vtpHnQC5rAH2Y4gpi+rKaPMJmbLJjA9XsGs7tiX7SxOLYhB8PgTLV4yFcdSE h7cLVIXrkjRZl0AbtWO0wlnrlp+4Cby4iS1Mi2c5tHUQazZ8bTO8wzzcwz78w0AcxEI8xERcxEZ8 xEicxEq8xEzcxE78xFAcxVI8xVRcxVZ8xVicxVo8P1nJs8wmkoOwWX53i56wi7gYomqTwoTpwpV4 j4yow2F8mDH7xnJ8w46ixsSGx82KtXZJCJaHxlIbl3HcKOgDtv36tl7bb9ZrhxZnaMu4mCU7j5kX b8pVcMYJt8j7b6a5smtVkoUMb3EKTl6VwXy4u8PZbhxbtv+FOyRO1l2Ea415uLrEWlDiSVAoZ35t qsL1maa0LKpEWKnvSTbiyo1fJsD3e5/m2rDXy8p7WKK+K3urc1WJ6qwDB7wJCqqBybw0ap6VO32I 26EDCqn6Obw7d7mzCr5h0khp2X4W6K7WfIIOmWELaKfwF2U71ojqmEVH6sx7y59fF8HiPKLnrHtd 66DfpcYdoc4RDFkE3c5uCrvTHM+mO88MOoD2HM7PdzdgFnxu3JxPejUPTbwqV6cZ5aZYukibdKOg u8YQotDHtbTtfH+x6s0SXc1zpnh3etF/26oaCaQm6NHlnKzgy82yerFC7dO0O8fC1szbt3dMmoGq ancVBn7/lPqDFi1I98zTL8XONC2O0cuuEPpMb2XQA63SU3jGSz2sCixiFZ06nMrLU02DkHu8/mmo 0cN8Ma2aGWmf96uESqaD0DydfmutYO3X1/uu/gjQDnfIEvysLo2IihzWEz1+jL2GLhqxGOexlj2k deixlZ2HxSSSw5myoryrwPmvBvuwbnjBGLzKE4PQCJ0bKAxBsG0spmjCAJTDZaDbd6yFvL3FwB3c wj3cxF3cxn3cyJ3cyr3czN3czv3c0B3d0j3d1F3d1n3d2J3d2r3d3I1BFNAE3y0C4a0D420D5e0E 510B4Z3eOcDeSeDe7o0C8S3ePjDfN/Dd9l0C9p3feMDf/+CS3uPt3zQQ4Dzg3wJuBAD+AwcOBAuu 4EiQ3/h9BA3+3geU4PTN4CPQ4AYOBhbeAxNe4Fvw4TWw3xdOBCIu4RWu3utNAfjN4vTt4hkO4+pN AgRO4BfO4jUO3xEu3jKu3xke4zqe4+v94uWN4z8u4zau3z1u5ETO4zQO5D/u5EOO5E0e5Spe5FS+ 4y3O4wG+5CXO5FJ+4yr+5DP+5Uvu5fEN5lfO5V9+5Ozd5Tn+30Ne5nQO43NO52Q+40m+42Vu5yaw 4m3+51Ge5FY+5zbu53Xu5H1e4nl+54A+5oke6Yb+6JMe6Ic+6JW+6IGu6ZcO6ZQ+6KAu5mY+4KGu 6ZHu6f+CLul3zi2dfuqrnuqJHuGOvumFDuuNzui2LuqmbuGXDt+wPuu6zuulbujDnuuSXuw+HuyW vuzMfuu4nuzOvue1nuwdfuLJ0urSzua/fuR6zuWIjuebjuMtnu1rbuzAvudMfug9nufTnu1Yju3M 3urlDu7HruvzDu/1ju91juTibuXyze/pPu2nXuhU/uzZou+E/uzSLusK7+/N/uYOT+/Cruz1zukn UO3hbvDETvHnfvENz/EeX/EdL/IR/+oGH/IYn/HQjuzdgvAbD+4JT+7AHu2KDu0z3+4Pf+MjD/Eg 3+ZFHuqfLuo1TvMc//JDj+xBf/Q57+ojjvQC/+1Ib/L/B4/pir7lUE7xAn/vYP7uXU7v3n71eL71 Vf/1Mb7rzT7v917r5y32YZ7v3E7jZ+7ukD73AU/wWG7xL67kAA/3Pz/icV/2ZK/nMp/l1o4thT8g h1/f6N0J853m4iLukB/5kj/5lF/5ln/5mJ/5mr/5nN/5nv/5oB/6oj/6pF/6pl/5apP49aHmX6D6 es/hkY/g/9703V37tn/7uJ/7ur/7vN/7vv/7wB/8wj/8xF/8xn/8yJ/8yr/8zN/8zv/8TdvFCzyM XvDbe9GJtWgLM/iXl4jD/LK7sgOlgkzHfUz+1C+METFDzHr+QqD+5q9t0w//HSuX6H8IFCrLYfn+ 509F/9QW238EApU4kmUFjKi5rir7wi5MyvJ846Zr5/3Nn2g+FnBoLBqTyqCu6SwhY8QltAm4Qq+7 E1Zk431T3ZQwO9YKx96qV81cB91xNepM56rQa31bjt9pBYqF6Ql+udXJCfYRFeKRDRYl5iEWBvLx 7QEtah7W6Thm/pFhspVBPp6+9QESgp1y1qQOrsK9UGJtPY12osJF+YDprlJCyu4yDRO3wIoxlykf +3Gh3tnaGUdPVftG62rbUoeHK6ueXas6t3Ebd3dLwg4DPq+jZ7f75ue55y+Tw+P7RUOeunRPCJry d85frSWvAgoMCDAiu3H2IJobBw5JGIYUFZraFLLixf9kJN8ca2bQ4z6Lu6SxQXhSH7+OCWFCy+kS pEqL5cplbMhSI7KD1S6l/NjSI5WHPrvgjPJtZD+UMW9h3IhVJ9GhtYCaqWgTp9WeDX/S4yn0pkFH JcvGWPhRaFJhS02utTe2Lc2daoPOdboNrmBaPG1SORuvJcxpeqm6RJt3qtm7CfF2rdt1rVvCSGue BGeWbtAaovhdg3oRKVhGcDFHBuy2sdSsqENXJRfptuXCRt+mZpwTUeJ+ZJXWqy2Z6VvLVZYfv3y3 o+avVfcCB9389vaXXC/rtk14KzKtK6tTh+Y8TV/m0MmT9orY7+rrmdWHLy64d/jWe9onhVtecQD4 nXT/+SEnXnxiFShRgz61Bxhs55V2VXecQTahSNpBtJRyDyq2GUcUygdefDJtmJ6DuR3hHTHTIfhc ZQXJxiKBJM0zmUz11SSaOTv66OGMxo3GW0kb9jfQkdy9g1qObHUII3OkDClOjSzmeFxKTx7IY4gv JmmjEvvtJuV8bSmSS1qzDHhWmp9MxqZdEu4jymmG0IIJcdnAaRiTenKkWpTTVDcKLrPYeQsaQaoJ ipSGhomlo5MWlqiifcZCZ6MtcILSpqyZAWd06xVXaoumlgqMQ6gOxqqrr8Iaq6yz0ipmrbe2iauu u+ag6q6+JgHsqrwSW6yxxxIrLLKn0ress7U6lqyy/0NMy+yz12KbLbbRanvEad2CG66445Jbrrnn opuuuuuy266778Ibr7zz0luvvffim6+++/Lbr7//AhywwAMTXLDBByOcsMILM9ywww9DHLHEE1Nc scUXY5yxxhtz3LHHH4Mcssgjk1yyySejnLLKK7PcsssvwxyzzDPTXLPNN+Ocs84789yzzz8DHbTQ QxNdtNFHI5200ksz3bTTT0MdtdGdSl211e9eQuKUEw1LLWukKvoD1a3OUO3VZ+d7pmJ4mpgr2c2+ rWyAEb7dNtp3C4wkkeL4BnfdZvcNn95iAmM23ofLWzgreH2y36ZyIrro4mpDaKcduVga15ZpSD6Q K/+mcYu46Msq/thnkMn1JIp0o8lgjDauvuKRlPk9uu2/lu16bNbxvrmXA5LZ+0qupSOk7NjNdbvy z5b+2tiB3ae773Eb+OilfZn3mvO1L989tLlntxV1p08vWm1QgjrlNiqq9d5RoXsf/6vN+/cM+1CO x54U6LcqLH/b5w9Ha5IfAWWVopns736wiR2V9leh7wwOegDcEQDtVsALmgp59fuNlYCku/840EkC XFP5jrIkBFkPgypkVdbe57Z39AlyLmzF8PgCwx9tYmyZAF0yHscmhjxvhUJ0mOGGaMQhFvGISiQg /JboxCdCMYpSnCIVq2jFK2Ixi1rcIhe76MUvgjH/jGIcIxnLaMYzohFVDFjjGsPFgFi9sQRxrFUc 57gEO5oAj+rSY3H4mEcR+DGN9LJjIJVQyB4cEpA5mGMi6ahGfTVykTiIpCDhhUdKTrJUjYwkI52F yRl8Ml2hfMEmK9mvS46AjSt4YxtJoMoKvNKVsARkK2dZyzqmUo63rGUqW8nKTtLSj7H8JS1deUtF 5pGXsZTlMpEJS14as5PQdCYuj+lLQlpTmrsk5CyfeUlWrvKY3fRmNE3JLlSOU4++zCUy+bjOduKy m8CUJTX/WEx51lOO7LxmO/fpTHbi85/9tOc8AVrHeNJTnvHkZ0AVOtB5MhKhwJzmRAfa0FGaE1no /yxoPtMp0I5KtJ7uNKg9PdrQVfqzoyktJEJROk56clKl+azoTFMaUIiSFKQwWChBM9qujQI0pyYd aTDfedGXClWdOY2oO9kYUmq+sqW93KZLiUrOcBpVqRZ96lGHqlOoDjOoU+VpUafqU1Hq06QJxSlS ZepVRVqVo2qValu1+tabltSuNk2oWO9q16eylaZ4/Wpb1brUrZb0rOTiplvZetKk3rOlwhQqZLu6 1q8e1KL75OpebarVrOa1pqLtKlcd69jNPjSyfVUsuJz6zbiW8558Das4PyrbZqp2q9MMZmWfOVhd pnO3mU3rVZNp2WgCNqm1XShTZwtNp4bzt21sLv9rN3ZIjFY3uw27rna727FA7ta74h0vectr3vOi N73qXS972+ve98I3vvKdL33ra9/7ogsB+t3VfmGlXwTMoL8kEDB+u/tf/gL4VQR+gYATvOACs3a/ D5bVhItTYQYnGMLilXCGBwzgAxP4vxnm8IdHXGIPN/jAJRCxCFi8YhWT+MQtlrGLXVyB/uJYxhp+ IodXAOIe39jBQi4xjYGc4xn7WMhIfjGSjxzkJjv5yVJ28o937MQUm4DKSp7ylrW85Ch7+MsdXvII vMxlMpvZzFY+IpaZfOYg17jLcp5xnJMs5iyPOc1zvvObwbxmIYpYxWHu85gJzecHT1jNZc7zntX/ rGc+/xnQjHbzow0NZ0snes+DNvKcYWziO3tax5FW4YJLrWkbPzrEgq4wqgsN5y0/GctgtnGslXzh UeOaCrfGwa5z7esefFrXrv41sX1AayX0utjKXjazm+3sZ0P7BrjtIymT4NqmbpOpVk0mY/ka7QvK VVZ6dam3uWnuck/2o9j9Nt7Q6UjiVjWqpERlt2VbbnizG4PgzSZkwVnMah4UvC/1N0rPHVSCezuX 8uatWeEK13XnO2fpdqhl3zlci4Ny3Mzc+MELm27BAjaito240SZe2oF7drQFTyxMOa7y1ZI2tCgf OcmJZnKQuju5mv2jwYnb87smHLF13Wu4a27zZrSCXOGX9SvNFWrUjhsTpq5lOVkfC/SiG31ops2t QGkK2sImfNw/1zhmU351uma9aM2krbtxTtrrTl2X0PWmtsnNbamDNbYoD2/aozbxTEoM4n0/ut1Z gHWFCX7wQlMnJ/m+MDuGAAAh/nR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0 dHR0dHR0dHR0dHR0a2lldnB3aGpsdHlwcGZ6c2pmb3JtZXRnbmVrc3FvZ3lobmhpa2V6cXdwcWtx c3hieQA7 --------------030400000009010506060006--

3 2

General Questions
by Joey 07 Sep '04

07 Sep '04

OK I needed to review a few things, and was not able to search within the list, but only page through the last few days. I installed the cpan version of surbl plug-in and am running SpamAssassin version 2.64. I copied the /root/.cpan/build/Mail-SpamAssassin-SpamCopURI-0.22/rules/spamcop_uri.cf file to the /etc/mail/spamassassin/ directory. I then restarted spamd so that it would take advantage of the new configuration. I then went to spamcop and grabbed a couple of domain names from the list and emailed them to myself from an outside source, but SpamAssassin did not tag/flag the email with any of the spamcop_uri scores or details within the email. Having said all that, now the question becomes how can I test my configuration to insure that it's working properly? Thanks, Joey

1 1

Re: Need help checking FP list from Theo
by Alden Levy 07 Sep '04

07 Sep '04

>Date: Mon, 6 Sep 2004 20:43:10 -0700 >From: Jeff Chan <jeffc(a)surbl.org> >Subject: [SURBL-Discuss] Need help >checking FP list from Theo >To: SURBL Discuss <discuss(a)lists.surbl.org> >Message-ID: ><352641172.20040906204310(a)supranet.net> >Content-Type: text/plain; charset=us-ascii >Theo got us a list of 112 new false positives >from across all >SURBLs. He showed me the source >messages which are almost >all subscribed newsletters and mailing list >messages, so they >seem quite hammy. >Given the type of source messages and some >spot checking, I'm >inclined to whitelist them all, but I'd like to >ask for some help >checking them first. Can anyone help check >these? 123inkjets.com 1and1.com While these two may also spam, they sell legitimate products. 123inkjets sells ink and toner cartridges and refills, 1and1 is a web hosting firm. Gotomypc.com sells a remote access product Yale.edu is the domain for Yale University Regards, Alden Alden Levy Engine No. 9, Inc. 130 West 57th Street, Suite 12E New York, NY 10019 (212) 981-1122 (212) 725-7202 (fax) www.engineno9inc.com

1 0

RFC: For everyone hand-checking domains
by Ryan Thompson 07 Sep '04

07 Sep '04

Hi All, For those of you hand-checking lists of domains (i.e., from submissions to SURBL lists, either for blocking or whitelisting): would a few of you mind running the new version (1.5) of GetURI (http://ry.ca/geturi/) on one or two of your domain lists? Just export your list of domains to a text file (one domain per line), and run geturi something like so: $ geturi --spamdomains=spamdomains.txt --age > domains.html If you also have lists of domains that appear in ham, even better! Send those to --hamdomains=hamdomains.txt, and you can guard against FPs. Alternatively, if you don't have the time to fiddle with GetURI yourself, then, for a limited time only, you can submit domain lists directly to my email address with "DOMAINS FOR GETURI" in the subject, and I'll run the report for you and post or email the output at your request. I'm curious to know if this is the kind of output you're looking for, and if there'd be anything else that would be a big help to your efforts, without decreasing accuracy. What are you currently doing to hand-check? My main goal is to reduce the effort required to *accurately* hand-check domains so we can focus on the quality of our submissions. Thanks, - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

2 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss