- Discuss - Mailman 3

edu.tw whitelist?
by Chris Santerre 13 Jul '04

13 Jul '04

As discussed on a nother list. These edu.tw are notorious for not being secure and open proxies. However that isn't what we list. SO I'm suggesting edu.tw domains get added to whitelist. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 2

msu.edu hell yeah!
by Chris Santerre 13 Jul '04

13 Jul '04

Just wanted to let you guys know that MSU is using surbl.org. We rock ;) Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

4 3

RE: [SURBL-Discuss] Re: Using (SU)RBL with a browser, any way to do it? (was <snip> )
by Chris Santerre 13 Jul '04

13 Jul '04

>-----Original Message----- >From: Nicolas Riendeau [mailto:knightr@istop.com] >Sent: Sunday, July 11, 2004 8:10 PM >To: William Stearns; SURBL Discussion list >Subject: [SURBL-Discuss] Re: Using (SU)RBL with a browser, any >way to do >it? (was <snip> ) > > >> Good morning, Nicolas, > >Hi William! > >> What's the problem with using a proxy? I have instructions at >> http://www.stearns.org/sa-blacklist/ on how to use the >sa-blacklist (the >> data underlying ws.surbl.org) in both squid and privoxy, using those >> proxies to block web access to the spammer web sites. >> Squid, at least, is available on both unix and windows (see >> http://www.cygwin.com). > >Thanks, I didn't know that... > >The fact that it works on Windows would take care of one of >the problems as the >number of *nix admins where I work is somewhat limited >compared to the number of >Windows admins... > >Only problem left now would be to convince them to invest in >the necessary hardware... > >> If you use a different proxy, I'd be glad to work with you to >> provide the sa-blacklist in a form suitable for that proxy. >> Cheers, >> - Bill > >Thanks! > >Nick > Or one could take the sa-blacklist file and turn it into a quick hosts file. I have a host file on the server that is copied to everyones machine everytime they log in. Full of spyware domains that simply point to 127.0.0.1 and It is easy for me to change. However squid also rocks. I have had a test server running for 1.5 years. I haven't had time to tweak it yet to go production yet. --Chris

2 1

Help: kid pron.....help report
by Chris Santerre 13 Jul '04

13 Jul '04

Good grief I have been going thru the domains submitted into SURBL and came up with a nasty kiddie pron site. Anyone here have contact with Secret Service or anyone else for that matter? I don't want the site just shutdown, I want these guys caught. *Warning, very disturbing site!* haydn.e-pid.org Address: 61.128.198.123 resolved to haydn.e-pid.org AS: 61.128.128.0/17 AS4134 [CN] Data Communications Bureau Beijing Net 61.128.128-255 CHINANET-CQ [CN] @ns.chinanet.cn.net --Chris

6 6

RE: [SURBL-Discuss] msu.edu hell yeah!
by Chris Santerre 12 Jul '04

12 Jul '04

>-----Original Message----- >From: William Stearns [mailto:wstearns@pobox.com] >Sent: Monday, July 12, 2004 11:18 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] msu.edu hell yeah! > > >Good morning, Chris, > >On Mon, 12 Jul 2004, Chris Santerre wrote: > >> Just wanted to let you guys know that MSU is using surbl.org. > > With Spamassassin, or with some other MTA/software combination? > >> We rock ;) > > I personally pebble, on a good day. :-) > Cheers, > - Bill :) With SA. --Chris

1 0

RE: First submission questions
by Chris Santerre 12 Jul '04

12 Jul '04

Hi Ryan, thanks for the submissions. I'm about to give them a quick going thru. The best place to ask these questions is right on the SURBL list discuss(a)lists.surbl.org I'm cc'ing this to the list. The more eyes on it the better. Redirects are handled differently. Post them to discussion list and they get added to a redirect list. The rule of thumb is like cooking: "When in doubt, throw it out." We would much rather not list a spammer, then list a shammer. Unless we decide together that the shammer is 95% spam with 1 legit customer. Then we might list them and inform the legit customer. Sometimes we don't all agree. Like political spam. Thats were we have some real fun ;) --Chris >-----Original Message----- >From: Ryan Thompson [mailto:ryan@sasknow.com] >Sent: Saturday, July 10, 2004 4:41 PM >To: Chris Santerre >Subject: First submission questions > > > >Hi Chris, > >I just submitted a "short list" of 87 domains to >chris+rthompson(a)moglobal.com, as kind of a proof-of-concept. I did take >quite a bit of care in the classification of these domains, so *I'm* >confident about them, but there are a few grey areas that I wasn't sure >if you'd agree with. Can you offer a bit of advice? > >Some I wasn't sure about are below. Also, if there's a person or list >that would be better equipped to advise on this kind of thing, please >let me know. I want to quickly become more help than burden, obviously. >:-) I'll be quieter once I better understand your inclusion system. > >Spam username hosts, but possibly also legit sites? I can't read >Taiwanese, nor do I really want to. In any case, these are >probably safe >for inclusion in English block lists. >twfc.org.tw Hosts spammers >club.net.tw Random hostname spammers >f2m.idv.tw Seems to process email forms for spammers >apol.com.tw mail.apol.com.tw seems to host /~spammers/ >pchome.com.tw Multiple NANAS mentions >netking.com.tw Multiple NANAS mentions > >Image hosts: >vendio.com eBay spammers image host; multiple NANAS >hinet.net has been mentioned before; they are rather notorious > >Obfuscated/invalid/mistyped URIs that get_uri_list picked up on: >interfun_lacing.jpg Local image URL >internet.e-mail Fake URL seen in spam >dnatzweirq2.ru Obfu for dazer2.ru >new_page_2.files Weird fake URL >wwwacronmedia.biz Mistyped spammer URL > >Iffy redirects: >tadpole.com Funny redirect destination in software spam? >61.218.32.78 Redirector; down now? >tadpolecomputer.com Funny redirect destination in software spam? > >- Ryan > >-- > Ryan Thompson <ryan(a)sasknow.com> > > SaskNow Technologies - http://www.sasknow.com > 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 > > Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon > Toll-Free: 877-727-5669 (877-SASKNOW) North America >

3 2

j-chkmail and SURBL
by Jose-Marcio.Martins＠ensmp.fr 12 Jul '04

12 Jul '04

Hello, j-chkmail is the filter I developed. It's completely written in C language. It's intended to use very few ressources and be very fast. Version 1.7 experimental has an interface for SURBL. I'm using it for two months now. There are two interfaces to SURBL : DNS and local database. DNS based queries are much easier to administrate, but local databases are faster. For the moment, only queries on local databases are validated. DNS queries is implemented but not yet validated. j-chkmail is free software, but with downloading is limited to registered users. To become a registered user, you shall accept to identify yourself : name, domain, ..., and have some responsibility on the domain you'll be using it (don't ask a license to hotmail.com, unless you're the hotmail.com system administrator... 8-). You can check it at : http://j-chkmail.ensmp.fr Best, Jose-Marcio -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

1 0

RE: [SURBL-Discuss] Hand classification / Scripted submission
by Chris Santerre 09 Jul '04

09 Jul '04

>> >3) Is there any advantage to submitting the same URI more than once >> > (i.e., from different spam messages?) It seems like the answer is >> > probably "no", but I'll gladly accept enlightenment. >> >> See my answer to #1. ;) > >:-) So noted, for WS. I've already had responses from other SURBLs that >are actually ranking by frequency of submissions, and encouraging >multiple submissions of the same URI if it appears in multiple spams. > Just a note on this for why I don't want multiples. I want multiples, but from different sources. The same person sending the same domain 5 times tells me nothing. But 5 different people submitting means a lot! > >> SURBL is the sexiest thing since.....well....me! :P > >Uhh... I'm not going to comment on that. For many reasons. :-) That's right, nothing to see here. Keep moving... :) > >> >Now I want to give something back. >> >> I keep getting this and I use the standard reply of: "I'll take 1 >> Dodge Hennessy Venom 800TT." >> >> Still no takers :) > >Well, I had one last week, but it was silver and had little plastic >ninjas stuck all over it, and a personalized plate of "SPAMD", so I >put it on an auction on Monday. If I would have known sooner... > Doh! You guys from saskachuan! If it can't mount a moose on it, you sell it! ;) --Chris

1 0

RE: [SURBL-Discuss] Hand classification / Scripted submission
by Chris Santerre 09 Jul '04

09 Jul '04

> >Questions: >1) Is this approach reasonable (i.e., am I going to hear screams from > someone if I script this, assuming I take precautions, >rate-limit the > submissions, and check the results before turning it loose?) I will shoot you! :) >2) Is there already a more efficient way to submit URIs? (Besides > running my own list, which, I guess, isn't too unreasonable :-) Yes. I'm going to email you off list. >3) Is there any advantage to submitting the same URI more than once > (i.e., from different spam messages?) It seems like the answer is > probably "no", but I'll gladly accept enlightenment. See my answer to #1. ;) >4) Should I be submitting to multiple SURBLs, or just stick with > ws.surbl.org? > most people are running [SC] and [WS] so [WS] is fine. >Since implementing SURBLs in SA2.63 about a week ago, we've had amazing >success. So much that we're having occasional word-wrap issues with the >X-Spam-Level: (stars) header. :-) > SURBL is the sexiest thing since.....well....me! :P >Now I want to give something back. I keep getting this and I use the standard reply of: "I'll take 1 Dodge Hennessy Venom 800TT." Still no takers :) I'm thinking of aiming smaller with an Nvidia 6800 video card. --Chris

2 1

RE: [SURBL-Discuss] Yahoo.net FP in ws.
by Chris Santerre 09 Jul '04

09 Jul '04

Actually I think I already beat you on that Bill ;) Muahahahah behold the speed of the big ape on caffene and techno music! --Chris >-----Original Message----- >From: William Stearns [mailto:wstearns@pobox.com] >Sent: Friday, July 09, 2004 10:53 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Yahoo.net FP in ws. > > >Good morning, Patrick, > >On Fri, 9 Jul 2004, Patrik Nilsson wrote: > >> This one needs to whitelisted... >> >> Domain yahoo.net, listed in: >> ws.surbl.org > > Thanks for the report! That'll be removed in the 11:00 update. > Cheers, > - Bill > >--------------------------------------------------------------- >------------ > "cc:Mail is a wonderful application, as long as you don't want >to read or send mail." >(Courtesy of Nix <nix(a)esperi.demon.co.uk>) >--------------------------------------------------------------- >----------- >William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, >freedups, p0f, >rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org -------------------------------------------------------------------------- _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

Yahoo.net FP in ws.
by Patrik Nilsson 09 Jul '04

09 Jul '04

This one needs to whitelisted... Domain yahoo.net, listed in: ws.surbl.org Thanks, Patrik

2 1

RE: [RD] BIGEVIL the big one, just went live!
by Chris Santerre 09 Jul '04

09 Jul '04

I'm cc'ing this to the SURBL list. But I think the answer may just be.... SA 3.0 :) --Chris >-----Original Message----- >From: Chr. von Stuckrad [mailto:stucki@mi.fu-berlin.de] >Sent: Friday, July 09, 2004 9:55 AM >To: Spamassassin-Talk (E-mail) >Subject: Re: [RD] BIGEVIL the big one, just went live! > > >... >> >Is *such* a large increase 'correct'? >> >Or do I have to seach for other trouble than *BIG*_evil? >... >> No that is correct. Bigevil got 10x bigger. I am worried abuot larger >... >> surbl.org is the way to go. If you can't do net tests, rsync >it and do it >> locally. > >OK, in my 'normal' system, using a self-compiled Version >I can (and did) do that, but > > DEBIAN 'original' Packages do not contain the > SURBL-Patch, so can NOT go that way > >Does somebody know, how to 'splice' those patches >into an otherwise completely unchanged way of using >debian packages? > >Stucki > >-- >Christoph von Stuckrad * * |nickname |<stucki(a)math.fu-berlin.de>\ >Freie Universitaet Berlin |/_*|'stucki' |Tel(days):+49 30 838-75 459| >Fachbereich Mathematik, EDV|\ *|if online|Tel(else):+49 30 77 39 6600| >Arnimallee 2-6/14195 Berlin* * |on IRCnet|Fax(alle):+49 30 838-75454/ >

1 0

Hand classification / Scripted submission
by Ryan Thompson 09 Jul '04

09 Jul '04

Hi All, 'Tis my first post to this list... so I'll try to make it a good one. I have a heap (and will continue to have future heaps) of spam with URIs that don't hit any of the SURBLs. We'll hand-classify the URIs, of course, but are there any objections to scripting the submission against http://www.rulesemporium.com/cgi-bin/uribl.cgi?report=1 ? The basic idea would be to run one automatic pass to analyze our SA headers to see if *_URI_BL rules already matched; if they don't, add the message to a processing queue. Then, for each URI in the each message of that queue, do the lookup again with Net::DNS, since the URI might have been added in the last 24 hours or so since the spam was received. This should hopefully produce a comparatively short list of URIs (and spams) that don't appear in the SURBL. From here, we can hand-classify this bunch (i.e., delete any that aren't spammer sites), and have our second-pass script strip the SA markup (if present) from the spam, and automatically submit the hand-picked URIs and their spams via the web interface. Questions: 1) Is this approach reasonable (i.e., am I going to hear screams from someone if I script this, assuming I take precautions, rate-limit the submissions, and check the results before turning it loose?) 2) Is there already a more efficient way to submit URIs? (Besides running my own list, which, I guess, isn't too unreasonable :-) 3) Is there any advantage to submitting the same URI more than once (i.e., from different spam messages?) It seems like the answer is probably "no", but I'll gladly accept enlightenment. 4) Should I be submitting to multiple SURBLs, or just stick with ws.surbl.org? Since implementing SURBLs in SA2.63 about a week ago, we've had amazing success. So much that we're having occasional word-wrap issues with the X-Spam-Level: (stars) header. :-) Now I want to give something back. - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

1 0

RE: {Spam?} Re: [SURBL-Discuss] {Spam?} Perfect example of URL Po ison
by Chris Santerre 09 Jul '04

09 Jul '04

>-----Original Message----- >From: Mariano Absatz [mailto:el.baby@gmail.com] >Sent: Thursday, July 08, 2004 4:32 PM >To: SURBL Discussion list >Subject: {Spam?} Re: [SURBL-Discuss] {Spam?} Perfect example of URL >Poison > > >I always 'LOOK' at the actually displayed message within my mailer and >THEN analyze the source... but looking at this, I'd tend to report >opoloves.com and netuetion.com (supposing the faxd.gif has something >visible in it). > >Please, people... by far the BEST thing about SURBL is its really, >really, really low FP rate so you can be very comfortable scoring it >high. > >I have them scored at 3.5 (except for 6dos) in a VERY conservative ISP >and it's doing wonderfully. > >I can't offer right now 'cause I have no time at all, but I'd very >much like that the SURBL lists keep being managed manually. > >It'd be great if we could, at some point, form a small group of >volunteers with VERY good skills at spotting guilty URIs within spam >and keep the lists much like clamav maintains its virus database... > Oh that has been discussed. And started. But then that guy got abducted by aliens or something. If you ever meet a guy named Paul on the street, ask him how he is doing, and if the mother ship has returned. :) --Chris

3 2

RE: [SURBL-Discuss] Submissions to SURBL list thru SARE website.
by Chris Santerre 08 Jul '04

08 Jul '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Thursday, July 08, 2004 3:27 PM >To: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] Submissions to SURBL list thru SARE >website. > > >on Thu, Jul 08, 2004 at 03:17:52PM -0400, Chris Santerre wrote: >> Good grief. Let me say this slowly.... >> >> SURBL is for domains in LINKS, URLS, websites, images, >things you click on, >> images hosted in the email. >> >> SURBL is NOT, will never be used, doesn't care, /dev/null's, >any domain or >> IP the email came from. > >Well, I for one won't be sending any more domains along if I >have to also >distinguish between the domains I happened to find in email bodies from >those I happened to find in message headers. Sorry. The >overlap is far too >great, as for example in a recent message I got (summarized): > No you misunderstand. Steve, what you do with me is fine ;) These are people who keep reporting the same dang domain but all the IP addresses it comes from. Which are mostly zombied broadband machines!! So I get 20 submissions of the SAME spam, with the same one line URL in it, only they report each IP it came from!!! ARGH!!! And please, when using the SURBL submission page on SARE, try to include a copy of the spam, it helps get it added MUCH faster. Remember these are hand checked!! For those of you submitting them thru other methods to me, continue what your are doing. That is working fine. --Chris

2 1

Submissions to SURBL list thru SARE website.
by Chris Santerre 08 Jul '04

08 Jul '04

Good grief. Let me say this slowly.... SURBL is for domains in LINKS, URLS, websites, images, things you click on, images hosted in the email. SURBL is NOT, will never be used, doesn't care, /dev/null's, any domain or IP the email came from. Thanks, I feel better now. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

4 3

Re: blacklist for notlong.com
by William Stearns 08 Jul '04

08 Jul '04

Good afternoon, Eric, On Thu, 8 Jul 2004, Eric Hammond wrote: > William Stearns wrote: > > I have a sense we could help _you_. When a user requests a > > notlong url, would you consider checking the target URL against the > > sa-blacklist, by [...] (Just for reference, surbl list, I suggested checking against either the static domain list or with dns lookups against surbl) > This sounds like a great idea. In fact, I heard about your service > by noticing that another URL shortening service run by a friend > (metamark.net) does check with SURBL. I'm sincerely glad to hear that! Please check back with us if we can help with the implementation. Cheers, - Bill --------------------------------------------------------------------------- Too many packets Syn. Ack. Fin. I. C. M. P. I am so tired -- Dennis McGrath -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

1 0

RE: [SURBL-Discuss] Help with SpamCopURI-0.18
by Mitch Planck 08 Jul '04

08 Jul '04

> I've been trying to get SpamCopURI-0.18 working on my system and > I've run into many problems. First I had to install > LWP::UserAgent, which > kept failing until I got everything it needed installed; > after everything > was installed I re-did the SpamCopURI-0.18 install. > > All tests were "ok" but when I copy over the spamcopuri.cf > file I get this > from spam assassin: > > Failed to parse line in SpamAssassin configuration, skipping: > open_redirect_list_spamcop_uri xurl.us > Failed to compile URI SpamAssassin tests, skipping: > (syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule > SPAMCOP_URI_RBL, line 1, near "eval:" > > I tried searching the archive for support on this, but I only > found one > person posted this problem with no replies. > > Can anyone shed some light onto this? I'm guessing I'm missing a PERL > Module somewhere but I don't know which one. > > Thanks, > Steve > Hi Steve, Can you let us know what flavor Linux you are running, what version of perl & SA, and how you are trying to install? For example, I use FreeBSD, then use the ports collection for everything in that, but since it doesn't have SpamCopURI, I could either use the CPAN install or the standard download, make, make install, etc. I use the wrapper program amavisd-new as well with a postfix mail server, so I have to integrate my SA/SpamCop install into amavis and that gave me some headaches, but maybe an uninstall & reinstall of the latest version of SA, make sure other things are up to date too. >From the source, here are the needed modules in perl: use URI; use URI::QueryParam; use URI::Escape use Text::Wrap (); use Mail::SpamAssassin::EvalTests; use Mail::SpamAssassin::SpamCopURI; use Mail::SpamAssassin::AutoWhitelist; use Mail::SpamAssassin::HTML; use Mail::SpamAssassin::Conf; use Mail::SpamAssassin::Received; use Mail::SpamAssassin::Util; use Mail::SpamAssassin::NetSet; There may be others needed, but these are obviously needed. Best regards, Mitch Planck ias.net

2 1

RE: [SURBL-Discuss] Help with SpamCopURI-0.18
by Steve Dimoff 08 Jul '04

08 Jul '04

>Hi Steve, >Can you let us know what flavor Linux you are running, what version of perl >& SA, and how you are trying to install? Mitch, I'm running Gentoo Linux sparc (2.4.24-sparc-r2), This is perl, v5.8.2 built for sparc-linux, SA 2.63. I tried both CPAN install and source install. Neither of them run. I installed the SpamCopURI on a Linux Redhat box with SA 2.63 and it works just fine. So I was thinking it was a perl module problem. Thanks, Steve >From the source, here are the needed modules in perl: Hmmm I'll check to make sure those are all install.

1 0

Help with SpamCopURI-0.18
by Steve Dimoff 08 Jul '04

08 Jul '04

Hello, I've been trying to get SpamCopURI-0.18 working on my system and I've run into many problems. First I had to install LWP::UserAgent, which kept failing until I got everything it needed installed; after everything was installed I re-did the SpamCopURI-0.18 install. All tests were "ok" but when I copy over the spamcopuri.cf file I get this from spam assassin: Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri snurl.com *.snurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri snipurl.com *.snipurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri tinyclick.com *.tinyclick.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri babyurl.com *.babyurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri lin.kz *.lin.kz Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri *.v3.net Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri shorl.com *.shorl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri tinyurl.com *.tinyurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri xurl.us Failed to compile URI SpamAssassin tests, skipping: (syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 1, near "eval:" I tried searching the archive for support on this, but I only found one person posted this problem with no replies. Can anyone shed some light onto this? I'm guessing I'm missing a PERL Module somewhere but I don't know which one. Thanks, Steve

1 0

RE: [SURBL-Discuss] Help: kid pron.....help report
by Chris Santerre 08 Jul '04

08 Jul '04

Roger, you wern't the only one. Page got less then halfway and I stopped it. Being a father of 2 it made me sick and angry. I reported it using www.missingkids.com 'cybertip line' . THis is where the trail ends. (FBI says call customs, customs says to call this number, number says to go here and this report gets sent out to all agencies. Whew! I hope they nail them to a wall. (Or let me in a room with them for 5 minutes!) --Chris >-----Original Message----- >From: Roger WJ Alterskjær [mailto:roger.alterskjaer@vm.ntnu.no] >Sent: Wednesday, July 07, 2004 9:24 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Help: kid pron.....help report > > >Wow! >I couldn't stomach letting the entire page load. I've reported >this site >to the Norwegian computer crime division. With regards to >child-pornography, they have investigative units that co-operate >internationally with other such law-enforcement organizations. >(That way >they can synchronize raids on child-porno rings on an large >geographical >basis!) > >Let's hope they get them! > >--- >Regards, >Roger WJ Alterskjær >IT Consultant >Museum of Natural History and Archaeology, NTNU >(+47) 73 59 79 78 > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

RE: [SURBL-Discuss] Another list to test: ab.surbl.org
by Joseph Burford 08 Jul '04

08 Jul '04

Hi Chris, > Joseph, I'm running sa-stats which only pulls out the > numbers, what do you use to parse out the info you posted? On my test box I'm running MailScanner + SpamAssassin and a utility for MailScanner called MailWatch. Essentially this throws all the data from each message into a MySQL database and provides a php frontend. I've just made up a few php scripts to create summaries by pulling relevant log details from the MySQL db. Looking at the SURBL stats, the messages that are in the end marked HAM are borderline. Some of them are postmaster bounces or postmaster messages from other servers I maintain, others are questionable mailing lists or even spam sent via yahoo groups. >From my look into the "false positives" of the SURBL lists there's hardly a message that wouldn't be missed if it hit the bit bucket. Regards, Joseph

1 0

RE: [SURBL-Discuss] 20 hours of 6DOS
by Joseph Burford 08 Jul '04

08 Jul '04

> So please test the new lists and let us know the results. 06/07/2004 - 3,269 message 1,593 marked as spam (48.7percent) Description Total Ham % Spam % URL in ob.surbl.org 756 7 0.9 749 99.1 URL in sc.surbl.org 667 1 0.1 666 99.9 URL in ws.surbl.org 590 2 0.3 588 99.7 URL in ab.surbl.org 469 1 0.2 468 99.8 URL in ds.surbl.org 140 2 1.4 138 98.6 07/07/2004 - 3,556 messages 1,822 marked as spam (51.2 percent) Description Total Ham % Spam % URL in ws.surbl.org 906 10 1.1 896 98.9 URL in ob.surbl.org 830 3 0.4 827 99.6 URL in sc.surbl.org 698 7 1 691 99 URL in ab.surbl.org 499 7 1.4 492 98.6 URL in ds.surbl.org 145 5 3.4 140 96.6

1 0

RE: [SURBL-Discuss] Freakin spanish and portuguese!
by Chris Santerre 07 Jul '04

07 Jul '04

Thanks Mariano, contacting you was next on my list. I'm having a hard time figuring out these submissions. A lot of the sites won't come up for me to check, I'm not sure why. I'll gather my thoughts and email you. Also thanks Jose Marcio Martins da Cruz. I'll email you as well off list. And if you're portuguese, like my wife, then you have my condolances. Maybe we should add all of Greece's emails to the blacklist? ;) Benfica! --Chris (Yeah its not hockey, but its ok.) >-----Original Message----- >From: Mariano Absatz [mailto:surbl@lists.com.ar] >Sent: Tuesday, July 06, 2004 6:07 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Freakin spanish and portuguese! > > >El 6 Jul 2004 a las 16:37, Chris Santerre escribió: > >> Can anyone here read spanish or portuguese? I got loads of >surbl submisions >> that I can't understand for the life of me!! ARGH! > >Hi Chris... I read/speak Spanish (and can read Portuguese with >quite some >difficulty)... in fact, if you're referring to postings in >http://www.rulesemporium.com/cgi-bin/uribl.cgi I'm responsible >for quite a >few postings in Spanish (I put my real name and my personal >-and very abused- >e-mail address in the form). > >Since I do know lots of spam from Argentina are spreading >around the world >I'd very much like that to be detected. Feel free to contact >me off-list (to >this address or to baby(a)baby.com.ar) about any doubt you may >have... I don't >have spare cycles, but I'd be happy to help you with anything I can. > >Regards. > > > >-- >Mariano Absatz >El Baby >---------------------------------------------------------- >You've got the brain of a four-year-old boy, >and I'll bet he was glad to get rid of it. > -- Groucho Marx > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

3 2

Freakin spanish and portuguese!
by Chris Santerre 07 Jul '04

07 Jul '04

Can anyone here read spanish or portuguese? I got loads of surbl submisions that I can't understand for the life of me!! ARGH! Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss