- Discuss - Mailman 3

FW: False positive on Big Evil
by Chris Santerre 23 Jul '04

23 Jul '04

I agree with Jonathan, these guys should be whitelisted. --Chris >-----Original Message----- >From: Hall J D (ISeLS) [mailto:jdhall@glam.ac.uk] >Sent: Friday, July 23, 2004 7:41 AM >To: csanterre(a)merchantsoverseas.com >Subject: False positive on Big Evil > > >Hello Chris, > >I seem to be getting a false positive in the current >BigEvil.cf for http://emailuniverse.com > >They are an e-mail list hints and tips site. They're lists >seem to require a confirmation e-mail to subscribe to their >lists. My user who reported the false positive has confirmed >that she did sign up for the list so it's not unsolicited. > >Thanks, > >Jonathan >

2 1

Re: [SURBL-Discuss] ETA on New Version
by Jeff Chan 22 Jul '04

22 Jul '04

On Thursday, July 22, 2004, 1:43:58 PM, Rob McEwen wrote: > What is the TTL for the ob.surbl.org list? The TTL on ob is 6 hours. Maybe we should lower that. > Also, is the TTL for the multi.surbl.org list still > 6 hours? Could/will that ever be improved? Good question. RFCing lowering the TTL on multi was one of the things on my list of things to do... I'll ask now.... Jeff C.

1 0

Bitmasks on multi.surbl.org
by Mark 22 Jul '04

22 Jul '04

Hello, I just read about the new multi.surbl.org, and was wondering about its bitmask properties. Can you call multi.surbl.org with a multi-bitmask? Like 00111110? (127.0.0.62). To mean "Any of 2,4,8,16,32"? Probably not; but that would be real useful. Thanks, - Mark

2 1

Re: [SURBL-Discuss] ETA on New Version
by Rob McEwen 22 Jul '04

22 Jul '04

Jeff C. wrote: > Outblaze in particular seems to get domains quickly and > have a relatively low FP rate.... Great! What is the TTL for the ob.surbl.org list? Also, is the TTL for the multi.surbl.org list still 6 hours? Could/will that ever be improved? I'm still finding some spam getting through which shows up on the MULTI list the next day. Therefore, I'm thinking about checking BOTH multi.surbl.org AND ob.surbl.org. The idea is that, even though they overlap, I could catch everything but the newest stuff with multi.surbl.org and then possibly catch some newer stuff on ob.surbl.org that hasn't yet made it into the multi-surbl.org list. Follow?

1 0

ETA on New Version
by Rob McEwen 22 Jul '04

22 Jul '04

I read on an earlier post something about a newer SURBL version which more quickly matches a new domain submission with that particular spammer's past data so as to lower the threshhold (of # of reports) it takes for a known spammer hiding behind a new domain name to get blacklisted. Does anyone have an estimate about when this new system will be put into production. Rob M.

2 1

[SURBL-Discuss] Help! Who should a send email to regarding SA not checking against localhost rbldns?
by Joe Young 22 Jul '04

22 Jul '04

Spamassassin is not checking against my rbldns server. It will query multi.surbl.org but not localhost Here is my configs /etc/sysconfig/rbldnsd RBLDNSD="njabl -udnsbl -r/var/lib/rbldns -t21600 -c60 \ -lquerylog -blocalhost/53 \ localhost:dnset:ws.surbl.org.rbldnsd \ " /etc/mail/spamassassin/spamcop_uri.cf uri SPAMCOP3_URI_RBL eval:check_spamcop_uri_rbl('localhost','127.0.0.2') describe SPAMCOP3_URI_RBL URI's domain appears in spamcop database at ws.surbl.org tflags SPAMCOP3_URI_RBL net score SPAMCOP3_URI_RBL 3.0 The debug of spamassassin shows debug: querying for amazingbuyz.net.localhost debug: Query failed for amazingbuyz.net.localhost debug: querying for amazingbuyz.net.ws.surbl.org debug: found A records for: amazingbuyz.net.ws.surbl.org Dig @localhost amazingbuyz.net.localhost shows ; <<>> DiG 9.2.2-P3 <<>> @localhost amazingbuyz.net.localhost ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24488 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 20, ADDITIONAL: 0 ;; QUESTION SECTION: ;amazingbuyz.net.localhost. IN A ;; ANSWER SECTION: amazingbuyz.net.localhost. 21600 IN A 127.0.0.2 ;; AUTHORITY SECTION: localhost. 5400 IN NS ns1.surbl.org. localhost. 5400 IN NS ns2.surbl.org. localhost. 5400 IN NS ns3.surbl.org. localhost. 5400 IN NS ns4.surbl.org. localhost. 5400 IN NS ns5.surbl.org. localhost. 5400 IN NS ns6.surbl.org. localhost. 5400 IN NS ns7.surbl.org. localhost. 5400 IN NS ns8.surbl.org. localhost. 5400 IN NS ns9.surbl.org. localhost. 5400 IN NS ns10.surbl.org. localhost. 5400 IN NS ns11.surbl.org. localhost. 5400 IN NS ns12.surbl.org. localhost. 5400 IN NS ns13.surbl.org. localhost. 5400 IN NS ns14.surbl.org. localhost. 5400 IN NS ns15.surbl.org. localhost. 5400 IN NS ns16.surbl.org. localhost. 5400 IN NS ns17.surbl.org. localhost. 5400 IN NS ns18.surbl.org. localhost. 5400 IN NS ns19.surbl.org. localhost. 5400 IN NS ns20.surbl.org. ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(localhost) ;; WHEN: Thu Jul 22 11:30:29 2004 ;; MSG SIZE rcvd: 439

2 1

RE: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh
by Chris Santerre 22 Jul '04

22 Jul '04

>70_sc_top200.cf You could remove. >antidrug.cf remove this when you upgrade to SA 3.0 >backhair.cf remove this when you upgrade to SA 3.0 >bigevil.cf REMOVE! >chickenpox.cf remove this when you upgrade to SA 3.0 >evilrules.cf REMOVE very old! --Chris

1 0

RE: [SURBL-Discuss] New slogan
by Chris Santerre 22 Jul '04

22 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, July 20, 2004 1:28 AM >To: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] New slogan > > >On Monday, July 19, 2004, 9:40:30 PM, Ryan Thompson wrote: >> Save a parse tree. Get SURBL. > >> ;-) > >Or, Let us do the parsing for you. > >(at least part of it) :-) > >Jeff C. > Wouldn't that be: "Relax, and leave the parsing to us!" :) --Chris

2 1

RE: [SURBL-Discuss] ph.surbl.org
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Thanks Jeff And thanks for not "flaming" my dumb questions. Regards Tom > -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: 22 July 2004 10:44 > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] ph.surbl.org > > On Thursday, July 22, 2004, 1:38:06 AM, Thomas Kinghorn wrote: > > I have noticed that the plugin for SA 2.63 has sc, ws, ob & ab BUT the > > plugin for SA 3 has ph.surbl.org. > > > What is ph.surbl.org and can it be used with 2.63 as a stand-alone rule > like > > the others. > > ph is a list with some phishing data. It only exists in > multi.surbl.org which is currently supported in SA 3.0. > It does not exist as a standalone list. > > You can find it described in the Lists document: > > http://www.surbl.org/lists.html#ph > > Jeff C. > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss

1 0

ph.surbl.org
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Hi All. Just reading the docs. I have noticed that the plugin for SA 2.63 has sc, ws, ob & ab BUT the plugin for SA 3 has ph.surbl.org. What is ph.surbl.org and can it be used with 2.63 as a stand-alone rule like the others. Regards, Tom Kinghorn

2 1

RE: [SURBL-Discuss] SA2.63 make problems
by Thomas Kinghorn 22 Jul '04

22 Jul '04

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: 22 July 2004 08:46 > To: discuss(a)lists.surbl.org > Subject: Re: [SURBL-Discuss] SA2.63 make problems > > --- > > t/open_redirect.t 3 768 5 3 60.00% 1-3 > > Failed 1/7 test scripts, 85.71% okay. 3/57 subtests failed, 94.74% okay. > > make: *** [test_dynamic] Error 29 > > Welcome to the SURBL community Thomas, > These errors should be gone in SpamCopURI version 0.19. > > Jeff C. > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss Many Thanks Jeff. Is there a work Around in the meantime? Thanks

2 1

Thanks Jeff, 0.019 works on Rh
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Hi Jeff. Thanks for the pointer. 0.019 worked, it just skipped the rd.yahoo.com test. <snip> t/open_redirect....ok 5/5 skipped: Need reliable open redirect to test against - rd.yahoo.com is closed t/spamcopuri.......ok t/whitelist........ok All tests successful, 5 subtests skipped. <snip> I have a bunch of cf files installed. They were downloaded from SARE. Which ones would you advise that I remove? Here is the list: 70_sare_adult.cf 70_sare_bayes_poison_nxm.cf 70_sare_header_abuse.cf 70_sare_oem.cf 70_sare_random.cf 70_sare_specific.cf 70_sare_spoof.cf 70_sc_top200.cf 71_sare_redirect_pre3.0.0.cf 99_FVGT_Tripwire.cf 99_sare_fraud_post25x.cf antidrug.cf backhair.cf bigevil.cf bogus-virus-warnings.cf chickenpox.cf DomainDigits1.cf evilnumbers.cf evilrules.cf Obfu1.cf ratware.cf weeds.cf It is killing the CPU :o$ Regards, Tom Kinghorn

3 2

RE: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh
by Thomas Kinghorn 22 Jul '04

22 Jul '04

> -----Original Message----- > From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] > Sent: 22 July 2004 09:32 > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh > > Hi! > > > bigevil.cf > > Thats one that is doing a lot if think. CPU wise, its included in > ws.surbl.org, so remove that one... > Do I just add ws in spamcop_uri.cf? The standard 1 from the installation source is # vi spamcop_uri.cf uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2') describe SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org tflags SPAMCOP_URI_RBL net score SPAMCOP_URI_RBL 3.0 Sorry for the lame question. Thanks Tom

2 1

FW: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh: GOT IT
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Sorry all. It would help if I read further down in the page :o$ <snip> More SURBL lists ws.surbl.org - sa-blacklist in SURBL form In addition to the original SpamCop URI-derived SURBL sc.surbl.org, we are pleased to have another SURBL compatible with the above plugins, or any other software that can check message body domains against a name-based RBL. <snip> Sorry for wasting your time Regards Tom -----Original Message----- From: Thomas Kinghorn Sent: 22 July 2004 09:59 To: 'SURBL Discussion list' Subject: RE: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh > -----Original Message----- > From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] > Sent: 22 July 2004 09:32 > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh > > Hi! > > > bigevil.cf > > Thats one that is doing a lot if think. CPU wise, its included in > ws.surbl.org, so remove that one... > Do I just add ws in spamcop_uri.cf? The standard 1 from the installation source is # vi spamcop_uri.cf uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2') describe SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org tflags SPAMCOP_URI_RBL net score SPAMCOP_URI_RBL 3.0 Sorry for the lame question. Thanks Tom

1 0

SA2.63 make problems
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Hi List. I am new to SURBL and am trying to install On a RH8 platform running sa-exim and SA-2.63 Make is fine Make test fails with the following error. <snip> ]# perl Makefile.PL # SAPATH /usr/lib/perl5/site_perl/5.8.0 # installsitelib /usr/lib/perl5/site_perl/5.8.0 # INSTALLDIRS site Checking if your kit is complete... Looks good Writing Makefile for Mail::SpamAssassin::SpamCopURI # make cp lib/Mail/SpamAssassin/PerMsgStatus.pm blib/lib/Mail/SpamAssassin/PerMsgStatus.pm cp lib/Mail/SpamAssassin/Conf.pm blib/lib/Mail/SpamAssassin/Conf.pm cp lib/Mail/SpamAssassin/SpamCopURI.pm blib/lib/Mail/SpamAssassin/SpamCopURI.pm Manifying blib/man3/Mail::SpamAssassin::Conf.3pm Manifying blib/man3/Mail::SpamAssassin::PerMsgStatus.3pm Manifying blib/man3/Mail::SpamAssassin::SpamCopURI.3pm # make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/blacklist........ok t/dnsrbl...........ok t/extract_urls.....ok t/mailto...........ok t/open_redirect....NOK 1# Failed test (t/open_redirect.t at line 37) # Failed test (t/open_redirect.t at line 44) t/open_redirect....NOK 2# Failed test (t/open_redirect.t at line 52) t/open_redirect....ok 4/5# Looks like you failed 3 tests of 5. t/open_redirect....dubious Test returned status 3 (wstat 768, 0x300) DIED. FAILED tests 1-3 Failed 3/5 tests, 40.00% okay t/spamcopuri.......ok t/whitelist........ok Failed Test Stat Wstat Total Fail Failed List of Failed ---------------------------------------------------------------------------- --- t/open_redirect.t 3 768 5 3 60.00% 1-3 Failed 1/7 test scripts, 85.71% okay. 3/57 subtests failed, 94.74% okay. make: *** [test_dynamic] Error 29 A shove in the right direction would be appreciated. Many thanks Regards, Tom Kinghorn

2 1

RE: [SURBL-Discuss] RE: 6dos data into ds.surbl.org
by Joseph Burford 21 Jul '04

21 Jul '04

Jeff, > Yikes! I'd say 4 to 5 percent FPs is unworkable for a SURBL.... I should have clarified that. The 4 to 5 percent on close examination is always email that is borderline IMHO. It just didn't end up being tagged as spam in the end. Compared with a .1 to .5 percent FP on the other surbl lists it still isn't that great. As for being unworkable it depends on your setup. I was tagging DS with a low score, one of the great things with SpamAssassin is that you have things like Bayes to combat FPs and the end result is the ham gets through :) Regards, Joseph

3 3

Re: RE: [SURBL-Discuss] Re: sex.surbl.org
by Rob McEwen 20 Jul '04

20 Jul '04

I still vote YES on adding the sex sites (in a separate DNS feed). (1) It seems like all the technology and know-how is in place to do this... maybe with a little tweaking, but nothing different than what has already been done elsewhere. (2) It would be a separate list and its use would be completely voluntary. Therefore, this seems to me to be MORE a question of "are there sufficient YET votes to make it worthwhile"... and NOT so much a question of comparing the "yes" vs. "no" votes because the "no" votes can simply choose to not participate... which is easy.... simply don't do anything different from what you are already doing. (3) Its purpose and scope could easily be explained on the SURBL.org site in its own page. It could even be omitted from being mentioned on any other pages to avoid confusion. Rob McEwen

2 1

RE: [SURBL-Discuss] WS FP? yourdomain-MUNGED.com
by Chris Santerre 20 Jul '04

20 Jul '04

>-----Original Message----- >From: Ryan Thompson [mailto:surbl@sasknow.com] >Sent: Tuesday, July 20, 2004 11:49 AM >To: SURBL Discussion list >Subject: [SURBL-Discuss] WS FP? yourdomain-MUNGED.com > > > >So, I'm a filthy spammer, I guess. I just sent out a mass >email like so: > >> 2. At the opening page, enter either your email address (for >> example, info(a)yourdomain-MUNGED.com), or your username (for >> example, yd-info). > >I was a little surprised to see yourdomain.com come back with hits on >WS. Maybe I'll have to start using >"info(a)yourdomainthatnobodywilleverlistinsurbl.org", but that's a bugger >to word-wrap. :-) > >Seriously, what's the deal? Is yourdomain.com really a spamvertized >site, or is it just an innocent victim? A quick grep of >~10,000s/10,000h >had this hit on 0s/6h. (And only one of them was me :-) > >- Ryan > Quite curious. These show up in the 6dos misc.c file: yourdomain.biz yourdomain.com But no tmuch other then munged listings in NANAS. I think these should be whitelisted!!!! --Chris

2 1

RE: [SURBL-Discuss] exacttarget-MUNGED.com
by Chris Santerre 20 Jul '04

20 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, July 19, 2004 5:15 PM >To: Chris Santerre >Cc: 'SURBL Discussion list'; rob(a)pvsys.com >Subject: Re: [SURBL-Discuss] exacttarget-MUNGED.com > > >On Monday, July 19, 2004, 9:42:29 AM, Chris Santerre wrote: >>>On Mon, 19 Jul 2004, Rob McEwen wrote: > >>>> The offending domain found in this newsletter is the following: >>>> >>>> exacttarget-MUNGED.com > >> These guys apear to be shammers (Spam and ham). NANAS has a >bunch of posts. >> I believe they were added due to a Home Depot spam run to a bunch of >> harvested addresses. They are NOT white. > >Somewhat in their defense, they appear to be a commercial mailing >company with quasi-reasonable (not 100% confirmed opt-in?) >anti-spam policies: > > http://website.exacttarget.com/exacttarget_company_antispam.asp > > http://website.exacttarget.com/exacttarget_bestpractices_permission.asp >Perhaps Home Depot was an isolated incident with a bad data source. Agreed. They may have hired a shady marketer that did the run without them knowing. However if any of you have a Keep-An-Eye-On file, I would put these guys in it. --Chris

1 0

[SURBL-Discuss] RE: sex.surbl.org (was: Re: include IP lookups in SURBL lists)
by Chris Santerre 20 Jul '04

20 Jul '04

*snip* >At nearly 500k record we'd definitely want to do this >with rbldnsd. BIND is already getting pretty slow with lists >approaching 100k records. For comparison, sbl.spamhaus.org >has about 5k records, xbl has about 1.7 million records, >list.dsbl.org has nearly 4 million records. multi.surbl.org, >our largest production list has about 45k records. It keeps growning fast! > >How does anyone else feel about turning this list of sex sites >into a SURBL? > >Jeff C. +1 for me. Keeping it a seperate list is a great idea. Gives admins the choice. Especially ISPs who may only wish to tag spam, but allow customers to look at the occasional naughty boom boom kissy kissy :) --Chris

4 3

lindowsinc.com FP in OB.
by Patrik Nilsson 20 Jul '04

20 Jul '04

lindowsinc.com is currently listed in OB. Can't see any reason why it should be listed. Not mentioned in any NANAS reports. Patrik

2 1

WS FP? yourdomain-MUNGED.com
by Ryan Thompson 20 Jul '04

20 Jul '04

So, I'm a filthy spammer, I guess. I just sent out a mass email like so: > 2. At the opening page, enter either your email address (for > example, info(a)yourdomain-MUNGED.com), or your username (for > example, yd-info). I was a little surprised to see yourdomain.com come back with hits on WS. Maybe I'll have to start using "info(a)yourdomainthatnobodywilleverlistinsurbl.org", but that's a bugger to word-wrap. :-) Seriously, what's the deal? Is yourdomain.com really a spamvertized site, or is it just an innocent victim? A quick grep of ~10,000s/10,000h had this hit on 0s/6h. (And only one of them was me :-) - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

1 0

RE: RFC: sex site domain SURBL
by Chris Santerre 20 Jul '04

20 Jul '04

Now that I've seen the data and I've thought about it longer, maybe it isn't right for us to use. If they haven't spam'd, then why should we block it. IF a company wants to block these sites, they should use a proxy. And if someone gets a UCE/UBE from them, we will list. Otherwise they have subscribed and that would be the individual companies policy problem. So I would like to change my vote to a -1. With a clearer view of the picture, it doesn't seem right. --Chris

1 0

RE: [SURBL-Discuss] RE: 6dos data into ds.surbl.org
by Joseph Burford 20 Jul '04

20 Jul '04

Jeff, > I'd like to hear what anyone else has to say before we pull > the plug on ds though. For every 1000 spam hits on SC/WS/OB.surbl.org DS only gets 100. I haven't yet seen a real world spam hit in DS that wasn't in one of the other lists. Over the last few weeks I have had it in our systems it's running between 4 and 5 percent FP. Personally I'm inclined to think it is a waste of resources. The dynamic data on SC, and the ability to submit to WS make those lists a lot more attractive and worthwhile. Regards, Joseph

4 3

New slogan
by Ryan Thompson 20 Jul '04

20 Jul '04

Save a parse tree. Get SURBL. ;-) - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss