- Discuss - Mailman 3

WS List Removal
by Moritz Nagl 24 Feb '09

24 Feb '09

One of our customers wants to be removed from your WS list. He had been sending mass emails to his customers because he move his headquarters. I tried to fill out your removal form, but I have some trouble with it. I pasted the full source code of the email in the field "full source of message body". But I always get the message "error in message body". Is there any chance, that I can give you the required information directly? OR can you explain to me how I can use the form without getting such errors? Sincerely, Moritz Nagl Telefon +49 (0)89 / 18 94 56 21 Fax +49 (0)89 / 18 94 56 25 moritz(a)wagnerit.com | www.wagnerit.com <http://www.wagnerit.com/> ____________________________________________________ Laden-/Post-/Lieferanschrift: Wagner IT - Hüterweg 24 - 85748 Garching - Germany Firmensitz: Wagner IT - Isarstraße 17 - 85386 Eching - Germany Inhaberin: Isabella Wagner - USt.-IdNr. DE259191815 - Steuer-Nr. 115/284/30076.

2 1

Re: [SURBL-Discuss] [SURBL-Announce] Individual SURBL lists to be shut down on public nameservers February 28, 2009. Use multi.
by Marc Perkel 04 Feb '09

04 Feb '09

Good call. BTW - does SURBL need any more resources? I have extra computing power and bandwidth I can contribute. SURBL Announcement list [READONLY] wrote: > For historical reasons, the SURBL public nameservers were serving > individual lists ab, sc, ob and ws in addition to multi. However > these individual lists have all been deprecated in favor of multi for > several years since multi contains all lists. Traffic for the > individual lists is relatively very low, and no one should be using > them any more, so in order to reduce unnecessary and redundant network > traffic we will be turning off public nameservice for the individual > lists on February 28th, 2009. > > Everyone should be using multi.surbl.org instead, and this has been > the case for many years now. Therefore if anyone is using the > individual lists, please stop doing so and use multi instead. A > single query to multi will check all SURBL lists. > > http://www.surbl.org/lists.html > > Cheers, > > Jeff C. > _______________________________________________ > Announce mailing list > Announce(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/announce >

1 0

Help using the SURBL removal tool
by John Zulim 05 Jan '09

05 Jan '09

Hello, I am using http://george.surbl.org/cgi-bin/lookup.cgi I am trying to remove the domain progressingaspconfirm1.com I believe I am following the directions correctly. The only section I am having a problem with is: Full source of the mesage body: (required) What is 'full source of the message body'? I have chosen to view the message in full in gmail and the following appears. Can you please tell me what the first and last line would be for the Full Source of the Message Body because I must be excluding or adding something I'm not supposed to because I get an error when submitting detailing a problem with this section. Example Message:. Delivered-To: john.zulim(a)adrevolution.com Received: by 10.140.35.7 with SMTP id i7cs411545rvi; Mon, 5 Jan 2009 09:00:14 -0800 (PST) Received: by 10.100.3.4 with SMTP id 4mr11138845anc.27.1231174813487; Mon, 05 Jan 2009 09:00:13 -0800 (PST) Return-Path: <johnzulim(a)yahoo.com> Received: from n26.bullet.mail.mud.yahoo.com (n26.bullet.mail.mud.yahoo.com [68.142.206.221]) by mx.google.com with SMTP id d21si36762694and.46.2009.01.05.09.00.11; Mon, 05 Jan 2009 09:00:12 -0800 (PST) Received-SPF: pass (google.com: domain of johnzulim(a)yahoo.com designates 68.142.206.221 as permitted sender) client-ip=68.142.206.221; DomainKey-Status: good (test mode) Authentication-Results: mx.google.com; spf=pass (google.com: domain of johnzulim(a)yahoo.com designates 68.142.206.221 as permitted sender) smtp.mail=johnzulim(a)yahoo.com; domainkeys=pass (test mode) header.From=johnzulim(a)yahoo.com Received: from [209.191.108.97] by n26.bullet.mail.mud.yahoo.com with NNFMP; 05 Jan 2009 17:00:11 -0000 Received: from [76.13.13.26] by t4.bullet.mud.yahoo.com with NNFMP; 05 Jan 2009 17:00:11 -0000 Received: from [76.13.10.177] by t3.bullet.mail.ac4.yahoo.com with NNFMP; 05 Jan 2009 17:00:10 -0000 Received: from [127.0.0.1] by omp118.mail.ac4.yahoo.com with NNFMP; 05 Jan 2009 17:00:10 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 892938.9901.bm(a)omp118.mail.ac4.yahoo.com Received: (qmail 64964 invoked by uid 60001); 5 Jan 2009 17:00:10 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Message-ID; b=FwstWXexedSW3xl/LGaOZrh6SOjg6V7f8iJhovt6a1p7zNWC6fsF2ELfqPS8kvs6bnS/xaZrzEh2Gg6BXbzz2eTdrtiCFDCVdlZ+kN8DYAEJxMGJfoRtkhtWZJ89z3fYDOI4LUsEp7NLq0Ws3uDIbiwkcjeHxMSW/q9ujkPN1W4=; X-YMail-OSG: kC7bMsIVM1nHi93ONset2qvPSCjnsB.jo_8_uQoH_nqo3HHWDueWhOkujQsjiS8gnjlI7BReY_vJRx3oEAmBuAyqPf4tyQpJHztwbIkpYkI.TrHvdPdGBj2NdifTfJbiZIIbJ8cT6qwVHnd4ITaJjQDMa13FE6zD6EIqJJTHwrawIpoHcNtE.leyZF3ZEyQZ6mvwzhrvFsCx.AcNca8- Received: from [69.71.97.98] by web59702.mail.ac4.yahoo.com via HTTP; Mon, 05 Jan 2009 09:00:10 PST X-Mailer: YahooMailWebService/0.7.260.1 Date: Mon, 5 Jan 2009 09:00:10 -0800 (PST) From: John Zulim <johnzulim(a)yahoo.com> Reply-To: johnzulim(a)yahoo.com Subject: Fw: Confirm Here To: john.zulim(a)adrevolution.com MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="0-1128263733-1231174810=:64192" Message-ID: <795526.64192.qm(a)web59702.mail.ac4.yahoo.com> --0-1128263733-1231174810=:64192 Content-Type: text/plain; charset=us-ascii Note: forwarded message attached. --0-1128263733-1231174810=:64192 Content-Type: message/rfc822 X-Apparently-To: johnzulim(a)yahoo.com via 76.13.12.209; Mon, 05 Jan 2009 08:23:15 -0800 X-YMailISG: v.b.oVMWLDuJZVL_FqiJJNL9YMsoQDvmOxXz1JgsCVM.CLEEMTQ3ghdUXdKvZ7gSV3vm2.jlGnSJgp8D7YuWjm8B_cqEJK8rFli1OClyz70rxXftR6xcHn1ty8GW6RJRiR1PqkPAyHWzDRswA7y2BPIFng.axrXguGMCTDTidVtVTcTFrpDSDI0GvElhJuRADXHWQ14EqeTnG0UOaPg4DciQYJ0pg0XW_LufpjJ4hgsppEABnHN56hORApaX4QwryyUHbLOefvWPvhG7AQ8HTAPr_lYMfxiq8pMb3wwsOTyrgkntuvIFlWdDTHHUbwurkdytuw-- X-Originating-IP: [64.20.245.46] Authentication-Results: mta173.mail.ac4.yahoo.com from=progressingaspconfirm3.com; domainkeys=pass (ok) Received: from 64.20.245.46 (EHLO mail.progressingaspconfirm3.com) (64.20.245.46) by mta173.mail.ac4.yahoo.com with SMTP; Mon, 05 Jan 2009 08:23:15 -0800 DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws; s=dksignature; d=progressingaspconfirm3.com; h=Date:Mime-Version:Subject:From:To:Content-Type:List-Unsubscribe:Reply-To:Accreditor:X-Habeas-Report; b=VISjF1AlDHLIxhy1hl7CaFtQlyN1v/AUXXkdr//rgUVv3E98YgDHht0liXUAoxx0 AhQflwWk6/ggZMweOn5lYhmnI2JA0tp/IoG127m0tKiV/vNNYAIXssfGVMJux4hk Date: Mon, 05 Jan 2009 10:23:15 -0600 Mime-Version: 1.0 Subject: Confirm Here From: "Nike vs Adidas Survey" <NikevsAdidasSurvey(a)progressingaspconfirm3.com> To: <johnzulim(a)yahoo.com> Content-Type: text/html; List-Unsubscribe: <http://www.progressingaspconfirm3.com/scripts/unsub.php?email_md5=c24d3fa43…> Reply-To: <c24d3fa4312f8302f59b5a94809f3307.79968800.954517136(a)progressingaspconfirm3.com> Accreditor: Habeas X-Habeas-Report: Please report use of this mark in spam to <http://www.habeas.com/report/> Content-Length: 2536 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <META http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>Brand Survey Panel - Please Confirm</title> </head> <body style="font-family:Arial, Helvetica, sans-serif; margin: 0px; padding: 0px; color: rgb(130, 16, 210);"> <div id="message_header" style="background-image:url('http://static.progressingaspconfirm3.com/content_unindexed/member/header_sp…'); background-repeat:no-repeat; height:164px; left:0; margin:0; padding:0; position:relative; text-align:center; top:0; width:970px; z-index:1; "> <div id="subject" style="float:left; left:0; margin:0 20px 0 95px; padding:0; position:absolute; top:0; width:320px; z-index:3;"> <h1 style="font-size:25pt; font-variant:small-caps; font-weight:normal; letter-spacing:0px; line-height:40px; margin: 0px; padding:0px; text-align:justify;"> Brand <strong style="padding: 0pt; display: block; font-size: 35pt; font-weight: normal; margin-left: 30px; color: rgb(0, 60, 255);">Survey</strong> <em style="display: block; font-style: normal; margin-left: 60px; text-align: left;">Panel </em> </h1> </div> <div id="system_menu" style="clear:right; float:left; height:130px; left:430px; margin:0; padding:0; position:absolute; width:445px; z-index:3; vertical-align: middle;"> <span id="account_options"> <a style="font-family:cursive,arial,helvetica,sans-serif; font-size:11pt; text-indent:1px; text-transform:capitalize; color: rgb(0, 0, 255);" href="http://www.progressingaspconfirm3.com/scripts/profile.php?customer_id=79968…"><img src="http://static.progressingaspconfirm3.com/content_unindexed/member/edit_prof…" alt="edit profile" title="edit profile" style="border: 0px none; vertical-align: middle;"/></a> <img id="button_devider" style="vertical-align: middle; margin-left: 5px; margin-right: 5px; padding: 0px; width:3px; height:34px;" src="http://static.progressingaspconfirm3.com/content_unindexed/member/member_ve…"/> <a style="font-family:cursive,arial,helvetica,sans-serif; font-size:11pt; text-indent:1px; text-transform:capitalize; color: rgb(0, 0, 255);" href="http://www.progressingaspconfirm3.com/scripts/unsub.php?email_md5=c24d3fa43… "><img src="http://static.progressingaspconfirm3.com/content_unindexed/member/remove_me…" alt="remove me" title="remove me" style="border: 0px none; vertical-align: middle;"/></a> </span> <div id="sms_text_and_links" style="float: left; margin-top:10px;"> Having trouble viewing this email? <a style="font-family:cursive,arial,helvetica,sans-serif;" href="http://www.progressingaspconfirm3.com/scripts/view_email.php?o=1982&c=79968…"><img src="http://static.progressingaspconfirm3.com/content_unindexed/member/click_her…" alt="Click Here" title="Click Here" style="border: 0px none;"/></a>. </div> </div> </td> </div> <div id="message_body" style="width:970px; clear: both; "> <div id="confirmation_one" style="clear:left; float:left; padding-left:100px; margin-right:50px; margin-top:12px; margin-bottom:20px; width:300px; text-align:right; "> <h2 style="font-size:18px; font-weight:normal; text-indent:28px; "> Thank you for signing up for the Nike vs Adidas Survey at Brand Survey Panel. </h2> <p style="text-indent: 28px; margin-bottom: 30px;">Click confirm to get access to one special offer per day.</p> <p id="confirm_txt" style="font-family: cursive,arial,helvetica,sans-serif; margin-top: 20px;"> <ul style="line-height: 40px; list-style-type: none; list-style-image: none; list-style-position: outside;"> <li style="font-size:20pt;"><a style="font-family:cursive,arial,helvetica,sans-serif;" href="http://www.progressingaspconfirm3.com/scripts/asp/universal/confirmation.ph…"><img src="http://static.progressingaspconfirm3.com/content_unindexed/member/confirm_b…" alt="Confirm" title="Confirm" style="border: 0px none;"/></a></li> <li style="font-size:11pt;"><a style="font-family:cursive,arial,helvetica,sans-serif;" href="http://www.progressingaspconfirm3.com/scripts/unsub.php?email_md5=c24d3fa43… "><img src="http://static.progressingaspconfirm3.com/content_unindexed/member/i_do_not_…" alt="I donâ€™t want to confirm" title="I donâ€™t want to confirm" style="border: 0px none;"/></a></li> </ul> </p> </div> <div id="left_side" style="float:left; font-size:14px; line-height:20px; width:372px; "> <p style="vertical-align:middle; margin: 0px; padding: 0px; font-size: 21pt;"> <a style="font-family:cursive,arial,helvetica,sans-serif;" href="http://www.progressingaspconfirm3.com/scripts/asp/universal/confirmation.ph…"><img alt="Click Here to Confirm" title="Click Here to Confirm" src="http://static.progressingaspconfirm3.com/content_unindexed/member/arrow_01.…" style="border: 0px none; margin: 0px; padding: 0px; position: relative; top: 0px;" /></a> </p> </div> </div> <div id="message_footer" style="color: #999999; float:left; clear: both; width: 970px; text-align: center; "> <img src="http://static.progressingaspconfirm3.com/content_unindexed/member/member_ho…" style="margin: 0px; padding: 0px; position: relative; top: 20px; width:822px; height:3px;" /> <div style="margin: 50px; text-align: left; font-size:12px;"> This message was sent by ADRevolution.<br /> <br /> ADRevolution delivers emails for clients with the purpose of helping them enrich their consumer relationships. <br /> <br /> ADRevolution is not the company with which you originally registered. We are an outsourced email solution employed by a variety of different companies. To the extent your information has been shared with ADRevolution, it is subject to our strict <a href="http://static.progressingaspconfirm3.com/content_unindexed/privacy_policy.h…">Privacy Policy</a>. This Privacy Policy includes a commitment that ADRevolution will never sell or share your email address with anyone for any marketing purpose. The Privacy Policy of the site where you initially registered may be materially different.<br /> <br /> ADRevolution will not send you advertisements unless you confirm your membership with us.<br /> <br /> If you would no longer like to receive emails from us at any time, please click the "Remove Me Immediately" link below.<br /> <br /> <a href="http://www.progressingaspconfirm3.com/scripts/unsub.php?email_md5=c24d3fa43… ">Remove Me Immediately</a><br /> <br /> ADRevolution, LLC<br /> 106 E. 6th St, Ste 900<br /> Austin, TX 78701<br /> <br /> ADRevolution, LLC was formerly known as Progressing Markets, LLC.<br/> <br/> <img src="http://www.progressingaspconfirm3.com/scripts/open.php?email_md5=c24d3fa431…" border=0> <p> </p> <p style="font-family:Arial,Helvetica,sans-serif; text-align: right; font-size:6pt;">va 1.4.0</p> </div> </div> </body> </html> --0-1128263733-1231174810=:64192-- Thanks in Advance, John Zulim Linux Systems Administrator ADRevolution Office Mobile: 512.963.6030 Home Mobile: 512.905.3274 Fax: 512.473.8578

1 0

False Positive - seonetworker.com
by Ferny Ceballos 26 Dec '08

26 Dec '08

Hi, I just wanted to report a false positive with the domain, seonetworker.com. This domain is owned by my company, Attraction Marketing Formula, LLC. ( attractionmarketingformula.com) It's a new domain, which is why it may have raised a redflag. A request for removal was sent, (ST #2452779). seonetworker.com is a training site for the home business industry and the owner information is public, which can be found with a 'whois' search. I've sent multiple request via the recommended channels with no response, and found this list and read that part of it's function is to report false positives. I look forward to contributing further. Regards, Fernando Ceballos & Raymond Fong

4 8

Recourse for legitimate users
by Lena＠lena.kiev.ua 25 Nov '08

25 Nov '08

http://www.surbl.org/faq.html : > To request removal from a SURBL list, please start with the the SURBL > Lookup page and follow the instructions on the removal form. The removal form in case of the "jino-net-MUNGED.ru" domain (listed in PH and SC) asks for "Sending IP addresses", "Typical message advertising the web site". Sending, advertising what? I run a discussion mailing list like this one. A list member posted an on-topic message to the list mentioning the member's website http://swallow.jino-net-MUNGED.ru - on-topic for the list, not phishing/spam/malware/etc. jino-net-MUNGED.ru is a free web-hosting like geocities.com. What recourse honest, legitimate users of that webhosting have? Now the message with blacklisted URL is in the list's archive, new members request a part of archive (few hundred messages in the body of a letter from an autoresponder), a free mail service (ngs.ru) the list member uses rejects the letter, I (who run the autoresponder) get the bounce. What recourse I, the member and the subdomain's honest owner have? I don't understand what to fill in the IP, header and body fields of the form. I tried to send the form not filling some fields and got an error message with "Please contact us by email at whitelist at our domain if you have any questions". I wrote to that email address with details and got: > <Chris_Barton()mcafee.com> (expanded from <whitelist()surbl.org>): host > sncwsrelay1.nai.com[67.97.80.204] said: 550 Denied - Spam Detection (in > reply to end of DATA command) So, Chris is protected from complaints of false positives. http://www.surbl.org/faq.html : > It's a good practice to use little or no filtering on your security > mailing list messages and abuse contact addresses, or to bypss them > around filtering. Yeah. At the same time the list member requested other parts of the list archive, and I got other bounces: > SMTP error from remote mail server after end of data: > host imx5.ngs.ru [195.93.186.194]: 550 5.7.1 URL http://sexmagnet-MUNGED.com > in your message is blacklisted, see http://www.surbl.org/lists.html The letters don't contain that URL, I checked. They contain (in the body) email address of another member @sexmagnet-MUNGED.com You can check the website: it's one of seven domains of a free mail service hotpop.com (like hotmail.com or gmail.com). Listed in PH. Huh? Using that logic, lets block the gmail.com domain: I don't know about hotpop, but I have evidence that gmail accepts (with an autoreply), but then completely ignores spam complaints. Does SURBL care of false positives at all? I run a MTA too, I for sure shall never use SURBL because I do care of false positives. But plenty mailadmins who use SpamAssassin and directly SURBL never suspect what disservce they make for their users. http://www.surbl.org/faq.html : > most SC users probably make an effort to uncheck > legitimate domains to prevent false reporting. Are you serious? Elena Shevchenko

1 0

regarding SURBL Blacklist Removal Request
by sheirling 20 Nov '08

20 Nov '08

Hi, We've submitted a removal request for our domain skyquestcom.com using LOOKUP page in surbl.com (filled in the complete form and the response page show "your request has been received") Yet our domain is still in the blacklist. May I know usually how long will it take for our domain to be removed from the list? Will there be any email notification? Thank you for your help. Regards, sheirling. "Program for Success" ---------------------------------- Tel : +603-89961719 Fax: +603-89961720 <http://www.inspirationjuntion.com/> www.InspirationJuntion.com Be inspired Everyday SkyQuestCom ranked 7th in Deloitte Technology Fast 500 Asia Pacific 2005. The first Singapore company ever came in Top 10 fastest growing technology company in Asia Pacific.

3 2

Re: [SURBL-Discuss] [SURBL-Announce] SURBL Usage Policy change
by Chris Santerre 07 Nov '08

07 Nov '08

> -----Original Message----- > From: Joseph Brennan [mailto:brennan@columbia.edu] > Sent: 2008-11-06 16:21 > To: discuss(a)lists.surbl.org; SURBL Zones > Subject: Re: [SURBL-Discuss] [SURBL-Announce] SURBL Usage > Policy change > > > > At-- SURBL usage policy: http://www.surbl.org/usage-policy.html > > I get very different pricing depending whether I input 80,000 users > or 80000 users (same number, no comma). > > Number of messages does not affect it. > > At the price for 80,000 (sic) I have no objection at all. At the > other price I'll really have to analyze how much we block with it. > I'm not sure what conclusion I will reach. I do not speak for SURBL in any way. I would say anyone who is thinking of not using it due to policy changes should discuss this with them OFFLIST. I believe this is not ment to hinder people using it, or even become filthy rich. Just to keep the darn thing running :) But thats just my opinion. Jeff is good people ;) --Chris

4 3

Re: [SURBL-Discuss] [SURBL-Announce] SURBL Usage Policy change
by Jeff Chan 07 Nov '08

07 Nov '08

On Thursday, November 6, 2008, 9:55:40 AM, Alex Marinkovic wrote: > How does this effect current rsync subscribers? How long will current > rsync access remain available? > Thanks, > Alex Hi Alex, Thanks for bringing up another point I didn't address in the announcement but probably should have. All large rsync users would be asked to pay, but there would be a 90 day grace period. Arnie can probably provide more details: Arnie Bjorklund MXTools http://www.mxtools.com/ 1-866-931-9228 His email address is arnieb at his domain above, and he's also seeing this since he's on the list. Jeff C.

2 2

Re: [SURBL-Discuss] [SURBL-Announce] SURBL Usage Policy change
by Joseph Brennan 07 Nov '08

07 Nov '08

At-- SURBL usage policy: http://www.surbl.org/usage-policy.html I get very different pricing depending whether I input 80,000 users or 80000 users (same number, no comma). Number of messages does not affect it. At the price for 80,000 (sic) I have no objection at all. At the other price I'll really have to analyze how much we block with it. I'm not sure what conclusion I will reach. Joseph Brennan Lead Email Systems Engineer Columbia University Information Technology

2 1

Removal Request: leavewhitefolksalone.com
by WRICHARDSON 01 Nov '08

01 Nov '08

Second request -----Original Message----- From: WRICHARDSON [mailto:wrichardson@cushcity.com] Sent: Friday, October 31, 2008 12:31 PM To: 'mailman(a)lists.surbl.org' Subject: Removal Request: leavewhitefolksalone.com Removal Request: leavewhitefolksalone.com Why is the response so slow? The form is long and difficult to fill out. We do not know where we are in the process. Your contact information is from different groups. We have removed your client from our database and you still have us in your database. Could you please remove us from your blacklist? Thanks Willie Willie A. Richardson wrichardson(a)cushcity.com 1-800-340-5454 No virus found in this outgoing message. Checked by AVG - http://www.avg.com Version: 8.0.175 / Virus Database: 270.8.3/1748 - Release Date: 10/31/2008 4:10 PM

2 1

Stats wanted
by Jeff Chan 20 Oct '08

20 Oct '08

Hi All, SURBL is looking for statistics about what portion of unsolicited our lists are detecting (ideally in large mail flows). An overall number would be ideal, as in what fraction of total unsolicited messages are caught by any SURBL list. One possible way to measure this from SpamAssassin-processed messages would be to count the messages marked as spam that had 'SURBL' in their scores versus the ones that didn't have a SURBL rule hit. The ratio would be the spams with SURBL hits divided by total number of spams. Another way would be to count the SURBL hits from an MTA milter, but to have the meaningful denominator, one would need a count of the total spams, which a simple SURBL-only milter would not be able to provide. Something else, or a more sophisticated milter would need to count the total spams in order to get the denominator. Ideally the results would be after MTA blocking with a major sender blacklist like zen.spamhaus.org. Please let us know whether a sender blacklist is used in the MTA or not. Any results would be greatly appreciated. Cheers, Jeff C.

10 9

Re: [SURBL-Discuss] Stats wanted
by Jeff Chan 18 Oct '08

18 Oct '08

On Saturday, October 18, 2008, 12:29:17 AM, Jeff Chan wrote: > SURBL is looking for statistics about what portion of unsolicited our > lists are detecting (ideally in large mail flows). An overall number > would be ideal, as in what fraction of total unsolicited messages are > caught by any SURBL list. One possible way to measure this from > SpamAssassin-processed messages would be to count the messages marked > as spam that had 'SURBL' in their scores versus the ones that didn't > have a SURBL rule hit. The ratio would be the spams with SURBL hits > divided by total number of spams. I should have added, here is a SpamAssassin meta rule that may show how many messages hit any surbl rule: meta URIBL_META_SURBL_ANY (URIBL_AB_SURBL || \ URIBL_JP_SURBL || URIBL_OB_SURBL || URIBL_PH_SURBL || \ URIBL_SC_SURBL || URIBL_WS_SURBL) score URIBL_META_SURBL_ANY 0.01 (For however the line wraps should be handled.) Jeff C.

1 0

URI BL responses, always loopback network?
by Ron Guerin 06 Aug '08

06 Aug '08

Hello again, I posted here once before I believe on the subject of URL shorteners. I am the operator author of the GPL software known as TightURL, and operator of the .com of the same name where there is a public installation of this software. I was supposed to come back with some kind of response about checking URL submissions at submission time vs. re-checking later, but various things in life intervened, and I have yet to implement anything to track how many URLs I reject at submission time, but I am pleased to report that re-checking previously accepted URLs has clearly been a success. I am presently rechecking all my URLs every 6 hours *if* they meet the following conditions: * Is not already blocked in my database * Was added within a window period (7 days) -or- * Has recent activity and more than a threshold of hits recorded Using this formula, I've been blocking URLs that were submitted over a year prior to blocking them, along with many recent submissions. I have not added the capability to unblock them later, largely because visual inspection of the blocked URLs gives me a pretty good feeling they'll be blocked again sooner or later. I may have to do something about that, but I'm not seeing the need right now. Anyway,... today's question pertains to people who are mucking around in their DNS resolution, or have DNS providers that are falsifying DNS responses in order to generate ad income from typing errors in people's browsers. I recently concluded some support for a new user whose every URL submission appeared to be listed in both SURBL and URIBL, which my code checks to see if the URL should be rejected. This user was somehow getting his own IP address returned to him any time the true response was really NXDOMAIN. This was some local thing on his end, but I presume the same problem exists if your DNS provider is tampering with the responses, except in that case you'd get some IP address from the public IP space that misdirects you to some "helpful" site if you happen to be using a web browser. My workaround for this problem was to check to see if the first 4 characters of the response are "127." Every BL or URI BL I know about returns a response somewhere in the range of 127.0.0.0 - 127.0.0.255, unless I'm mistaken. While I guess this still leaves open the possibility for false-positives on my users end if they make use of both loopback network hosts and their DNS responses have been tampered with, what I wanted to know was if anyone knows of a BL or URI BL that returns or plans on returning something other than a loopback address as a positive response to a lookup? - Ron

3 5

Joe Jobbed by a scammer and AbuseButler
by Ron Guerin 06 Aug '08

06 Aug '08

I ironically now find tighturl.com listed in SURBL as the result effectively being joe-jobbed by some sleazeball promoting a work from home scam and using a tighturl link to a fake removal page, which was blocked by me within the 45th access (and is now probably around 10,000 hits which redirect to a page explaining the inadvisibility of clicking on links in spam or putting your email address into a spammer's removal box). AbuseButler has yet to respond to mail sent late Saturday night to abuse(a)abusebutler.com about the matter, and they clearly are not resolving URLs to their destination as I would have expected from a data source used by SURBL. Just what is the SURBL policy about listing URLs that have not been resolved to their destination, and about the quality of the data accepted into SURBL? I find the lack of a response from AbuseButler to its abuse address an indication that they're not running a responsible or reliable service over there. - Ron

3 4

Re: [SURBL-Discuss] RFC: significantly reducing FPs on OB
by Jeff Chan 21 Jul '08

21 Jul '08

On Sunday, July 13, 2008, 9:12:25 AM, Joseph Brennan wrote: > Jeff Chan <jeffc(a)surbl.org> wrote: >> I think we >> probably can't reveal the exact listing criteria in case they're >> useful for the bad guys. I know it's somewhat inappropriate to >> ask for comments without revealing details. I suppose I'm asking >> for general responses then. :) > So you'll keep ob, but take some undisclosed action to improve its > accuracy. Sounds worthwhile to me. Thanks! Yes, we would not get rid of OB entirely ever. It does have some good data, but with too many FPs. The goal would be to keep as much of the good data as possible while eliminating most of the bad. Unfortunately some of the good data may be thrown out with the bad; baby with the bathwater, so to speak. IMO FPs are much worse than FNs, so some increase in FNs balances out a decrease in FPs. Trying to decide if it's worth doing.... Jeff C.

5 7

Re: [SURBL-Discuss] RFC: significantly reducing FPs on OB
by Jeff Chan 13 Jul '08

13 Jul '08

On Saturday, July 12, 2008, 7:00:29 PM, Joseph Brennan wrote: > --On Saturday, July 12, 2008 1:41 AM -0700 Jeff Chan <jeffc(a)surbl.org> > wrote: >> We can probably significantly reduce the false positives on >> ob.surbl.org, the SURBL list based on Outblaze's URI blacklist: >> >> http://www.surbl.org/lists.html#ob >> >> at the cost of some possibly minor false negatives. [...] >> Should we make that change? > This agrees with our experience using SURBL for a few years. We've > seen the occasional fp with the ob listings, and none I am aware of > with the rest of SURBL. > What's the change? Thanks much for the feedback Daryl and Joseph! I think we probably can't reveal the exact listing criteria in case they're useful for the bad guys. I know it's somewhat inappropriate to ask for comments without revealing details. I suppose I'm asking for general responses then. :) Jeff C.

2 1

RFC: significantly reducing FPs on OB
by Jeff Chan 13 Jul '08

13 Jul '08

We can probably significantly reduce the false positives on ob.surbl.org, the SURBL list based on Outblaze's URI blacklist: http://www.surbl.org/lists.html#ob at the cost of some possibly minor false negatives. SpamAssassin has live (weekly?) statistics about the performance of their rules, including all SURBL lists, against their ham and spam corpora at their Rule QA site: http://ruleqa.spamassassin.org/ As you can see OB ranks significantly below the other SURBL lists, with much higher FP rates around 0.1% compared to 0.01% to 0.025% or so. (Note that the Rule QA site seems to have occasional glitches, so if the numbers seem out of range one week, check again later.) Should we make that change? Jeff C.

3 2

Re: [SURBL-Discuss] What does it take to be blacklisted?
by Jeff Chan 25 Jun '08

25 Jun '08

On Wednesday, June 25, 2008, 5:37:30 AM, Ben Spencer wrote: > Ok...the subject is a bit misleading. Let me clarify a little bit... > What does it take for a domain to end up on the multi.surbl.org list? > Realizing that multi is made up of several different lists, it might not > be > clear cut as each might have their own rules and in some cases it is > more > complicated then just end user reports. > Background: someone complained that they couldn't email us and it turns > out > they were blocked because of the multi.surbl.org list. In a response we > received from them, they stated: One person has a software program that > erroneously flagged <the domain> as spam. > What I am trying to confirm is that none of the multi.surbl.org lists > actually will block on a single incident report. Reading over the > surbl.org > site (haven't dig into the rules for each list just yet), the lists seem > to > sway towards safer (no listing) then sorry end of things. None of the lists will blacklist based solely on a user report. Each list is pretty different. Please report false positives to whitelist at our domain. Jeff C.

2 1

What does it take to be blacklisted?
by Ben Spencer 25 Jun '08

25 Jun '08

Ok...the subject is a bit misleading. Let me clarify a little bit... What does it take for a domain to end up on the multi.surbl.org list? Realizing that multi is made up of several different lists, it might not be clear cut as each might have their own rules and in some cases it is more complicated then just end user reports. Background: someone complained that they couldn't email us and it turns out they were blocked because of the multi.surbl.org list. In a response we received from them, they stated: One person has a software program that erroneously flagged <the domain> as spam. What I am trying to confirm is that none of the multi.surbl.org lists actually will block on a single incident report. Reading over the surbl.org site (haven't dig into the rules for each list just yet), the lists seem to sway towards safer (no listing) then sorry end of things. Thanks Benji Spencer System Administrator Moody Bible Institute Phone: 312-329-2288 Fax: 312-329-8961

1 0

SignInAndWIN.ca - In Hotmail Signature
by Darrell 03 Apr '08

03 Apr '08

FYI - I seen a couple false positives today on mail from hotmail that include this domain in the auto generated signature. SignInAndWIN . ca Example Signature: Sign in to Windows Live Messenger, and enter for your chance to win $1000 a day-today until May 12th. Visit SignInAndWIN . ca <http://g.msn.ca/ca55/210> Darrell

2 1

are the lists working
by Peter Garcia 24 Mar '08

24 Mar '08

Hello I have joined this discussion forum today to ask if there is anything wrong with the multi.surbl.org list? We had been using this list successfully for almost 3 years now. Beginning about 3/15/08, we are no longer getting the same number of hits as we had before. Before 3/15 we routinely saw 6000 - 8000 SuRBL hits per day. Between 3/15 and today we were seeing less then 500 hits per day. This morning I switched our GWAVA to use black.uribl.com and am now seeing thousands of SuRBL hits. For test purposes I switched back to the multi.surbl.org but in 5 minutes didn't have any hits. Does anyone else have this problem? Thank you for any information. Peter Garcia

2 1

familiar with xml?
by kieran mullen 13 Feb '08

13 Feb '08

SURBL was great when it was running. It made me wonder if I should even run any other RBL's at all? This is off topic already but what is generally thought to have less overhead? It would seem to be that RBLs would but their effectiveness have really dropped with the use of massive botnets. Anyhow regarding my topic... something has changed in the usage of the lists and so my false positives has jumped. This is doug swallows plugin for Icewarp MerakMail. (the author has long since dropped support for this project) http://clip.drlinky.com/149606 I have altered the scope to not include the header (from the surblg list I was told to) and also to not scan the ip addresses but to no avail. I was getting false positives for test invites I was sending myself from linked in. I believe it is the way counting is performed that is messing things up a bit. From the looks of it a count of 1 is rejected, but 1 is added to everything anyway surbl_multi_count += 1 Appreciate any information Thank you KieranMullen

2 2

plans to move to a forum
by kieran mullen 12 Feb '08

12 Feb '08

Are there any plans in the future to move the email based discussion list to a forum based system with e-mail subscription per topics? Thank you KieranMullen

7 11

Verizon DNS corruption
by Jeff Chan 30 Jan '08

30 Jan '08

Judging by recent spamassassin-users mailing list messages, Verizon is hijacking DNS responses that seem to be invalid and replacing them with their own responses (in oder to drive traffic to their search sites). Naturally this breaks SURBL lookups. If you are using Verizon's nameservers and are getting false positives, you may want to check into this. Here's one reference: http://www.freedom-to-tinker.com/?p=1227 Jeff C.

1 0

RFC: Adding malwaredomains.com data to phishing list?
by Jeff Chan 28 Nov '07

28 Nov '07

Does anyone have any comments on adding the malware domains at: http://www.malwaredomains.com/ to the SURBL phising list, with significant filtering to exclude possible false positives? The actual list would be the third field of: http://www.malwaredomains.com/files/domains.txt The data includes malware and phishing sites. Cheers, Jeff C.

6 12

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss