- Discuss - Mailman 3

RE: [SURBL-Discuss] 20 hours of 6DOS
by Joseph Burford 08 Jul '04

08 Jul '04

> So please test the new lists and let us know the results. 06/07/2004 - 3,269 message 1,593 marked as spam (48.7percent) Description Total Ham % Spam % URL in ob.surbl.org 756 7 0.9 749 99.1 URL in sc.surbl.org 667 1 0.1 666 99.9 URL in ws.surbl.org 590 2 0.3 588 99.7 URL in ab.surbl.org 469 1 0.2 468 99.8 URL in ds.surbl.org 140 2 1.4 138 98.6 07/07/2004 - 3,556 messages 1,822 marked as spam (51.2 percent) Description Total Ham % Spam % URL in ws.surbl.org 906 10 1.1 896 98.9 URL in ob.surbl.org 830 3 0.4 827 99.6 URL in sc.surbl.org 698 7 1 691 99 URL in ab.surbl.org 499 7 1.4 492 98.6 URL in ds.surbl.org 145 5 3.4 140 96.6

1 0

RE: [SURBL-Discuss] Freakin spanish and portuguese!
by Chris Santerre 07 Jul '04

07 Jul '04

Thanks Mariano, contacting you was next on my list. I'm having a hard time figuring out these submissions. A lot of the sites won't come up for me to check, I'm not sure why. I'll gather my thoughts and email you. Also thanks Jose Marcio Martins da Cruz. I'll email you as well off list. And if you're portuguese, like my wife, then you have my condolances. Maybe we should add all of Greece's emails to the blacklist? ;) Benfica! --Chris (Yeah its not hockey, but its ok.) >-----Original Message----- >From: Mariano Absatz [mailto:surbl@lists.com.ar] >Sent: Tuesday, July 06, 2004 6:07 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Freakin spanish and portuguese! > > >El 6 Jul 2004 a las 16:37, Chris Santerre escribió: > >> Can anyone here read spanish or portuguese? I got loads of >surbl submisions >> that I can't understand for the life of me!! ARGH! > >Hi Chris... I read/speak Spanish (and can read Portuguese with >quite some >difficulty)... in fact, if you're referring to postings in >http://www.rulesemporium.com/cgi-bin/uribl.cgi I'm responsible >for quite a >few postings in Spanish (I put my real name and my personal >-and very abused- >e-mail address in the form). > >Since I do know lots of spam from Argentina are spreading >around the world >I'd very much like that to be detected. Feel free to contact >me off-list (to >this address or to baby(a)baby.com.ar) about any doubt you may >have... I don't >have spare cycles, but I'd be happy to help you with anything I can. > >Regards. > > > >-- >Mariano Absatz >El Baby >---------------------------------------------------------- >You've got the brain of a four-year-old boy, >and I'll bet he was glad to get rid of it. > -- Groucho Marx > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

3 2

Freakin spanish and portuguese!
by Chris Santerre 07 Jul '04

07 Jul '04

Can anyone here read spanish or portuguese? I got loads of surbl submisions that I can't understand for the life of me!! ARGH! Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 2

RE: [SURBL-Discuss] Help: kid pron.....help report
by Chris Santerre 06 Jul '04

06 Jul '04

>-----Original Message----- >From: Brian Ipsen [mailto:bipsen-sender-6b92e3@andebakken.dk] >Sent: Tuesday, July 06, 2004 3:21 PM >To: SURBL Discussion list >Subject: RE: [SURBL-Discuss] Help: kid pron.....help report > > >Hi there, > >> Good grief I have been going thru the domains submitted into >> SURBL and came >> up with a nasty kiddie pron site. Anyone here have contact >with Secret >> Service or anyone else for that matter? I don't want the site >> just shutdown, >> I want these guys caught. > >Couldn't agree more! > >> *Warning, very disturbing site!* > >[link removed] > >> Address: 61.128.xxx.xxx resolved to [removed] >> AS: 61.128.128.0/17 AS4134 [CN] Data Communications Bureau Beijing >> Net 61.128.128-255 CHINANET-CQ [CN] @ns.chinanet.cn.net > >I did a small search at google: >http://www.reportchildporn.com/modules.php?name=News&new_topic=13 > >"HONG KONG, China (CNN) -- Authorities in the U.S. and U.K. >say they are >closing the net on online pedophiles, but the crackdown stops >at China's >borders where a legal bind is making child porn permissible. > >Perpetrators are walking free since neither mainland China nor >Hong Kong >have laws against downloading child pornography." > >This is from September 29th, 2003 - I hope the attitude has >changed since >then.. > >I reported the page to a national organistation "Save the >children" - I hope >they are able to do something about it, at least contact the >authorities in >China. > Thanks Brian. I urge anyone who knows any authority to send them the info. I mentioned to someone off list that I didn't want to get the domain shutdown because I want to let the authorities see the site first. It is one of the few things on the internet that greatly disturb me. Thanks for forwarding the info again. --Chris

1 0

RE: [SURBL-Discuss] Pleaae beta test ds.surbl.org - 6dos data
by Chris Santerre 06 Jul '04

06 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, June 29, 2004 6:22 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Pleaae beta test ds.surbl.org - 6dos data > > >On Tuesday, June 29, 2004, 3:05:17 PM, Jeff Chan wrote: >>I've excluded those three files >> and the list is now about 87k entries. > >> The whitelist hits are now at 83: > >> http://spamcheck.freeapp.net/6dos.domains.whitelist-hits2 > >Folks, please test the revised ds.surbl.org list. > >It may have lower spam detection and false positive rates now. > >Jeff C. > I'm looking for more FP data on [ds]. ANyone got domains for me? --Chirs

1 0

RE: [SURBL-Discuss] Re: New SURBL additions
by Chris Santerre 06 Jul '04

06 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Saturday, July 03, 2004 4:55 AM >To: SURBL Discussion list; SpamAssassin Users List >Subject: Re: [SURBL-Discuss] Re: New SURBL additions > > >On Friday, July 2, 2004, 6:06:16 AM, Don Newcomer wrote: >> Here are my counts since 6:50 PM yesterday for all URI_RBL >rules sorted by >> spam and ham: > >> URI_RBL spam counts: > >> 3577 - AB_URI_RBL (5.0) - surbl.cf >> 2499 - DS_URI_RBL (0.33) - surbl.cf >> 7282 - OB_URI_RBL (4.0) - surbl.cf >> 4279 - SPAMCOP_URI_RBL (3.0) - surbl.cf >> 5458 - WS_URI_RBL (3.0) - surbl.cf > >> URI_RBL ham counts: > >> 231 - DS_URI_RBL (0.33) - surbl.cf >> 18 - OB_URI_RBL (4.0) - surbl.cf >> 1 - SPAMCOP_URI_RBL (3.0) - surbl.cf >> 29 - WS_URI_RBL (3.0) - surbl.cf > >> Interesting that AB_URI_RBL has no false positives yet... Still, we >> haven't released spam filtering to our users yet so my Bayes >training is >> based pretty much on all of the SA rulesets' interpretation >of spam (which >> isn't necessarily a bad thing). > >Thanks much for the data Don, particularly the false positive >hits. Does anyone else have any to share? If so please post >them here. > >ab.surbl.org is based on SpamCop data plus some manual reports, >as is sc.surbl.org, but ab has a different inclusion criteria >of taking the top 500 most often reported (less www. duplicates >and whitelists hits) over 7 days, whereas sc has an arbitrary >inclusion threshold of 10 reports over 4 days. 1 FP for sc >is pretty good, though zero is better. :-) > >ob is pretty impressive in terms of hit rate and relatively >low FP rate, at least as a percentage of hits. > >Note that ds.surbl.org (based on 6dos data) is now up on 5 name >servers so it may be ok to use on production servers for beta >testing. > >Please note that I probably won't be able to check email for >about a week so hopefully others will help answer SURBL >questions, etc. > Please email me ANY FPs found in the ds.surbl.org list. I realy real realy want to clean it up. I'm working with the source to get it better. Even though the % isn't high. 99.99 percent accuracy is better ;) --Chris

1 0

Counts for all external SA tests for 6-30-04
by Bill Landry 06 Jul '04

06 Jul '04

Here are my numbers from yesterday for all external tests I run through SA: 7356 RCVD_IN_INTRUDERS 6868 RCVD_IN_DNSBL-T1 6595 RCVD_IN_BLARS 4897 RCVD_IN_FIVETEN 4788 RCVD_IN_SPAMHAUS 4458 DNS_FROM_MAILPOLICE-BLOCK 4285 RCVD_IN_AHBL 4259 RCVD_IN_AHBL-SPAM 4172 DS_URI_RBL 4099 DCC_CHECK 4056 RCVD_IN_SPAMCOP 3958 WS_URI_RBL 3854 RCVD_IN_SPEWS 3816 PYZOR_CHECK 3344 RCVD_IN_FIVETEN-SPAM 3247 RCVD_IN_CSMA-SBL 3023 DNS_FROM_AHBL-RHSBL 2994 RAZOR2_CHECK 2846 RCVD_IN_KROPKA 2436 RCVD_IN_INTERSIL 2413 DNS_FROM_NOABUSE 2313 OB_URI_RBL 2027 RCVD_IN_SORBS 1990 RCVD_IN_IPWHOIS 1852 RCVD_IN_LEADMON 1639 RCVD_IN_SPAMCANNIBAL 1497 DNS_FROM_NOPOSTMASTER 1418 DNS_FROM_SECURITY-SAGE 1392 RCVD_IN_BLARS-SPAM 1355 RCVD_IN_ANTISPAM 1350 RCVD_IN_NOMOREFUNN 1223 SC_URI_RBL 1132 RCVD_IN_SORBS-SPAM 1092 RCVD_IN_NJABL 957 RCVD_IN_NJABL-SPAM 799 RCVD_IN_SPAMBAG 744 RCVD_IN_NETHER-SPAM 711 RCVD_IN_THEY 556 RCVD_IN_FIVETEN-OPTIN 496 DNS_FROM_ISOC-RHSBL 496 DNS_FROM_DEADBEEF-RHSBL 496 DNS_FROM_BOGUSMX 496 DNS_FROM_BADWHOIS 484 RCVD_IN_KROPKA-DUL 459 RCVD_IN_SNARK 382 RCVD_IN_NOMOREFUNN-BOGUS 351 AB_URI_RBL 281 RCVD_IN_WEB-O-TRUST 275 RCVD_IN_SNARK-SPAM 226 DNS_FROM_NODSN 175 RCVD_IN_BRAINERD 162 RCVD_IN_SNARK-HONEYPOT 158 RCVD_IN_DSBL-ALL 145 RCVD_IN_DNSRBL-SPAM 124 RCVD_IN_NOMOREFUNN-SPAM 102 RCVD_IN_NETHER-WL 90 RCVD_IN_NETHER-RELAY 78 RCVD_IN_REDHAWK 71 DNS_FROM_ZONEEDIT 67 RCVD_IN_CYBERLOGIC 59 RCVD_IN_ABUSEAT 47 RCVD_IN_SORBS-DYNA 46 RCVD_IN_BSP-TRUSTED 46 RCVD_IN_BLARS-DUL 45 RCVD_IN_ARGENTINA 41 RCVD_IN_ISOC-IP4R 38 RCVD_IN_SPAMRBL 37 RCVD_IN_TFWL-IP4R 30 RCVD_IN_AUPADS-DUL 28 RCVD_IN_DEADBEEF-IP4R 26 RCVD_IN_DNSBL-INFO 24 RCVD_IN_SPAMSOURCE 24 RCVD_IN_SORBS-SOCKS 23 RCVD_IN_COMPLETEWHOIS 23 RCVD_IN_AHBL-PROXY 22 RCVD_IN_SNARK-NORDNS 22 RCVD_IN_RUSSIA 22 RCVD_IN_NJABL-PROXY 21 RCVD_IN_NOMOREFUNN-DYNA 21 RCVD_IN_CHINA 21 DNS_FROM_MAILPOLICE-DYNA 19 DNS_FROM_MAILPOLICE-DYNAMIC 17 RCVD_IN_SORBS-WEB 17 RCVD_IN_SORBS-HTTP 16 RCVD_IN_UCEB 16 RCVD_IN_NOMOREFUNN-PROXY 15 RCVD_IN_BLARS-MULTI 14 RCVD_IN_GWEEP-SDE 13 RCVD_IN_TFWL-RHSBL 12 RCVD_IN_SORBS-ZOMBIE 12 RCVD_IN_SCHULTE 12 RCVD_IN_KOREA 11 RCVD_IN_ORDB 11 RCVD_IN_BLITZED 10 RCVD_IN_RRBL 10 RCVD_IN_NIGERIA 9 RCVD_IN_JAPAN 9 RCVD_IN_HABEAS-USER 8 RCVD_IN_HONGKONG 8 RCVD_IN_FABEL 8 RCVD_IN_DNSRBL-DUN 7 RCVD_IN_WSFF 7 RCVD_IN_NJABL-DIALUP 6 RCVD_IN_VISI-RELAY 6 RCVD_IN_SORBS-MISC 6 RCVD_IN_NJABL-RELAY 5 RCVD_IN_KEMPTBL 5 RCVD_IN_BLITZED-SOCKS 4 RCVD_IN_BRAZIL 3 RCVD_IN_SINGAPORE 3 RCVD_IN_MALAYSIA 2 RCVD_IN_TURKEY 2 RCVD_IN_OSPAM 2 RCVD_IN_MEXICO 2 RCVD_IN_FIVETEN-MULTI 2 RCVD_IN_BSP-OTHER 2 RCVD_IN_BLITZED-WINGATE 2 RCVD_IN_BLITZED-HTTP-POST 1 RCVD_IN_THAILAND 1 RCVD_IN_TAIWAN 1 RCVD_IN_FIVETEN-OTHER As you can see, the SURBL tests stack up very nicely. I've stopped tracking FPs from the SURBL tests as the overall results of these tests have been very good. I'd like to take the opportunity to thank Jeff and the list creators and maintainers, as well as the DNS hosting providers, for their time and efforts in making this very valuable spam prevention service available to anyone who wishes to use it, it's very much appreciated. Keep up the good work! Bill

3 4

Re: New SURBL additions
by Jeff Chan 03 Jul '04

03 Jul '04

On Thursday, July 1, 2004, 11:47:37 AM, Don Newcomer wrote: > Hat's off to the folks who brought out the new SURBL checks! Here's my top > 15 rule hits over the past 20 hours and look where my 4 URIBLs come in: > 18832 - HTML_MESSAGE (0.100) - 50_scores.cf > 10296 - BAYES_99 (5.400) - 50_scores.cf > 9810 - OB_URI_RBL (4.0) - surbl.cf > 9403 - MIME_HTML_ONLY (0.320) - 50_scores.cf > 8367 - WS_URI_RBL (3.0) - surbl.cf > 7922 - CLICK_BELOW (0.100) - 50_scores.cf > 5220 - HTML_LINK_CLICK_HERE (0.100) - 50_scores.cf > 5102 - SPAMCOP_URI_RBL (3.0) - surbl.cf > 4470 - MIME_MISSING_BOUNDARY (1.838) - 50_scores.cf > 4401 - MY_SHRT_IMG (0.848) - coding_html.cf > 4285 - MK_BAD_HTML_05 (0.3) - coding_html.cf > 4118 - NO_REAL_NAME (0.160) - 50_scores.cf > 4111 - AB_URI_RBL (5.0) - surbl.cf > 3887 - SARE_FROM_SPAM_WORD3 (0.100) - 70_sare_header.cf > 3678 - MIME_HTML_NO_CHARSET (0.561) - 50_scores.cf Thanks much for the data and the compliments Don! I'm forwarding your results to the SURBL discussion list. It's interesting to see how well ob is detecting spams. My hat is off in thanks to the OutBlaze folks for providing the data. Still looking for anyone's spam detection rates and false positive rates with all the lists: sc.surbl.org - SpamCop spamvertised sites ws.surbl.org - sa-blacklist, BigEvil and other data ob.surbl.org - OutBlaze spamvertised sites ab.surbl.org - AbuseButler spamvertised sites ds.surbl.org (beta, 6dos data) Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

4 5

RE: [SURBL-Discuss] uptilt.com and their customers probably not s pammers
by Chris Santerre 01 Jul '04

01 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, July 01, 2004 3:39 PM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] uptilt.com and their customers >probably not >s pammers > > >On Thursday, July 1, 2004, 6:51:32 AM, Chris Santerre wrote: >> -1 here > >> I think private is better. Public reports of FPs I am +1. > >OK To me FPs and whitelisting are the same thing, but it >sounds like if we did this you're saying it should be called >"FP reporting" and not "whitelist reporting". Am I interpreting >what you're saying correctly? > Yup. (I can be confusing sometimes.) Saying "Tell us who should be whitelisted." vs. "Did someone get marked incorrectly?" are different, yet the outcome is the same....sort of. If we never listed ebay, then no one will ever report ebay as an fp. CON: No proactive submissions. We may miss a popular domain. PRO: We don't get tons of whitelist submissions. Taking all our time checking them to see if they are legit instead of checking domains the should be added. --Chris

1 0

[SURBL-Discuss] uptilt.com and their customers probably not spammers
by Jeff Chan 01 Jul '04

01 Jul '04

I made a list of some of uptilt.com (emaillabs.com) customers': http://www.emaillabs.com/clientlist.html likely domains: http://spamcheck.freeapp.net/whitelists/uptilt and checked those domains against all existing SURBLs. The only matches were: uptilt.com on ws.surbl.org, due to Chris' earlier manual listing, and: digitalimpact.com uptilt.com wordbiz.com on ds.surbl.org (6dos) which is a pretty low hit rate for nearly a hundred domains against a fairly aggressive list *if uptilt.com were a spamhaus*. It's not totally conclusive, but the relative lack of inclusion across multiple SURBL data sources leads me to think that uptilt.com is probably not a spamhaus. Therefore I've used that list of uptilt.com domains and customer domains as a whitelist. That means they will not be included in SURBLs. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

5 7

RE: [SURBL-Discuss] uptilt.com and their customers probably not s pammers
by Chris Santerre 01 Jul '04

01 Jul '04

-1 here I think private is better. Public reports of FPs I am +1. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, July 01, 2004 7:51 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] uptilt.com and their customers >probably not >spammers > > >On Thursday, July 1, 2004, 4:40:54 AM, David Hooton wrote: >> On Thu, 1 Jul 2004 02:33:33 -0700, Jeff Chan <jeffc(a)surbl.org> wrote: >>> the relative lack of inclusion across multiple SURBL >>> data sources leads me to think that uptilt.com is probably >>> not a spamhaus. Therefore I've used that list of uptilt.com >>> domains and customer domains as a whitelist. That means they >>> will not be included in SURBLs. > >> Thanks for your super diligence, we all appreciate it, so do >our clients :) > >Thanks for your kind words David. As you can see I like to avoid >false positives. :-) > > >I'm strongly tempted to make a public form for submitting >whitelist entries, fully logged, rate-limited and reviewed, >of course. It could help with the FPs and add more public >visibility to the whitelisting process. > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

Fwd: Re: blacklist brings system to halt
by Jeff Chan 01 Jul '04

01 Jul '04

Here's some additional info on some of the recent sa-blacklist/ws.surbl.org/6dos goings on, copied from a message I sent to the SpamAssassin-users list: > 1477667 Jun 21 18:48 /etc/spamassassin/RulesDuJour/blacklist.cf.20040623-0106 > 421286 Jun 21 18:49 /etc/spamassassin/RulesDuJour/blacklist-uri.cf.20040623-0106 > 1459329 Jun 23 00:03 /etc/spamassassin/RulesDuJour/blacklist.cf.20040624-1602 > 415544 Jun 23 00:04 /etc/spamassassin/RulesDuJour/blacklist-uri.cf.20040624-1602 > 1484137 Jun 24 15:48 /etc/spamassassin/RulesDuJour/blacklist.cf.20040627-0301 > 422228 Jun 24 15:49 /etc/spamassassin/RulesDuJour/blacklist-uri.cf.20040627-0301 > 1559813 Jun 27 02:17 /etc/spamassassin/RulesDuJour/blacklist.cf.20040628-1544 > 443922 Jun 27 02:18 /etc/spamassassin/RulesDuJour/blacklist-uri.cf.20040628-1544 > 5432965 Jun 28 15:25 /etc/spamassassin/RulesDuJour/blacklist.cf.20040628-1558 > 1544207 Jun 28 15:28 /etc/spamassassin/blacklist-uri.cf > 7070231 Jun 28 15:54 /etc/spamassassin/blacklist.cf I think I can help explain why sa-blacklist went from 1.5 MB to 5.5 MB in size suddenly. Chris Santerre added a fairly large set of records from 6dos (6 degrees of spam) around that time in order to get the records into ws.surbl.org and sa-blacklist. Chris, Bill and I then discussed this and decided to take them back out of sa-blacklist and therefore ws.surbl.org, and put the 6dos entries into its own SURBL instead. However Bill's server experienced a hard disk problem around the same time so the entries have not come out of sa-blacklist yet. But they will come out once Chris gets access to Bill's server again. Until then, backing off to an earlier version of sa-blacklist makes perfect sense and it's what we've done for ws.surbl.org. When Chris gets in again, he will get the 6dos entries off sa-blacklist, it will come back down in size, and I'll restore live feeds of ws.surbl.org from the sa-blacklist data instead of freezing it at the older version, as it is now. Hopefully this makes some sense. If not I'll glady try to answer any questions or comments anyone has, though I'm not the original source of the changes. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

6 13

RE: [SURBL-Discuss] uptilt.com and their customers probably not s pammers
by Chris Santerre 01 Jul '04

01 Jul '04

They got on my list due to the tonyrobbins.com incedent. http://tinyurl.com/28xpc I that case I believe a "marketing company" was hired, who spammed for tonyrobbins.com. They are at least off-white in my mind. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, July 01, 2004 5:34 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] uptilt.com and their customers probably not >spammers > > >I made a list of some of uptilt.com (emaillabs.com) customers': > > http://www.emaillabs.com/clientlist.html > >likely domains: > > http://spamcheck.freeapp.net/whitelists/uptilt > >and checked those domains against all existing SURBLs. >The only matches were: > > uptilt.com > >on ws.surbl.org, due to Chris' earlier manual listing, and: > > digitalimpact.com > uptilt.com > wordbiz.com > >on ds.surbl.org (6dos) which is a pretty low hit rate for >nearly a hundred domains against a fairly aggressive list >*if uptilt.com were a spamhaus*. It's not totally conclusive, >but the relative lack of inclusion across multiple SURBL >data sources leads me to think that uptilt.com is probably >not a spamhaus. Therefore I've used that list of uptilt.com >domains and customer domains as a whitelist. That means they >will not be included in SURBLs. > >Jeff C. >-- >Jeff Chan >mailto:jeffc@surbl.org >http://www.surbl.org/ > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

20 hours of 6DOS
by Mariano Absatz 01 Jul '04

01 Jul '04

Yesterday I activated ds.surbl.org in our local server for very few domains, so far, I got 54 hits, NO false positives. Regards. -- Mariano Absatz El Baby ---------------------------------------------------------- Asking if computers can think is like asking if submarines can swim.

3 3

[SURBL-Discuss] Fwd: Re: Fwd: Re: procmail exited w/ EX_TEMPFAIL and stucked spamd processes
by Jeff Chan 30 Jun '04

30 Jun '04

This is a forwarded message From: Jeff Chan <jeffc(a)surbl.org> To: William Stearns <wstearns(a)pobox.com> Date: Wednesday, June 30, 2004, 8:45:52 AM Subject: : Re: procmail exited w/ EX_TEMPFAIL and stucked spamd processes ===8<==============Original message text=============== On Wednesday, June 30, 2004, 7:38:42 AM, William Stearns wrote: >> From: Damon McMahon <inst_karma(a)hotmail.com> >> Are you by chance using Bill Stearn's sa-blacklist? >> >> Same thing happened on my mail server yesterday - it almost ground to a >> halt, stalled procmail processes all over the place, sendmail errors >> identical to yours - very ugly. >> >> Eventually traced it down to the fact that the sa-blacklist.current had >> inadvertently quintupled (5x) in size overnight, from 1.5 to almost 7 MB in >> size. I use daily auto-updates of this list so hadn't noticed until the >> side-effects appeared. > Am I missing something? Please take a look at > http://www.stearns.org/sa-blacklist/sa-blacklist.current.domains > - 23,752 domains, just > before Chris started adding 6dos. I relinked the last good one when I > brought the server back up. For generating ws.surbl.org, that's perfect, and I've re-enabled my getting of sa-blacklist.current.domains from your server. When Chris can get the 6dos data disabled, and you link back to an un-6dosed but otherwise current version, I think we will be fully functional again in terms of the ws.surbl.org generation process. I suppose you could rename the 6dos blacklist to disable it also. > If you're using my list, what version are you using? 200406281446 > should be a safe one to use. I was mainly referring to the folks using sa-blacklist as a cf file, which one of the versions apparently did get several times larger than before, presumably due to the inclusion of the 6dos data. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/ ===8<===========End of original message text===========

1 0

RE: [SURBL-Discuss] Remove overlapping rules due to SURBL?
by Chris Santerre 30 Jun '04

30 Jun '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, June 30, 2004 4:40 AM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] Remove overlapping rules due to SURBL? > > >On Wednesday, June 30, 2004, 12:46:50 AM, Martin Lyberg wrote: >> This is the lists i use at the moment: > >> # sc.surbl.org - SpamCop message-body URI domains >> # ws.surbl.org - sa-blacklist domains as a SURBL >> # be.surbl.org - BigEvil and MidEvil domains >> # ob.surbl.org - OutBlaze spamvertised sites >> # ab.surbl.org - AbuseButler spamvertised sites > >> I wonder if any of my following rulesets is overlapping the >SURBL-lists and >> should be removed? > >> I have the following rulesets: > >> 70_sare_adult.cf >> 70_sare_random.cf >> 70_sare_specific.cf >> 72_sare_bml_post25x.cf >> antidrug.cf >> backhair.cf >> bigevil.cf >> chickenpox.cf >> evilnumbers.cf >> tripwire.cf >> weeds.cf > >Hi Martin, >On behalf of everyone contributing to the SURBL poject, thanks >for your kind words. Glad you're finding SURBLs useful. > >Chris or one of the SARE guys will know a lot more about >the specific SARE rules, but I know that the domains in >bigevil.cf are in be.surbl.org, so you may be able to >get rid of bigevil.cf. For that matter the records in >be.surbl.org are now in ws.surbl.org, so you can get rid >of be.surbl.org also. > >Chris & Co are probably creating a heavily wildcarded ruleset >that you may want to use in future in addition to SURBLs. > >1. Get rid of bigevil.cf, it's mostly in be.surbl.org >2. Get rid of be.surbl.org, it's in ws.surbl.org > Just a followup. Yup everything Jeff covered is spot on! However I see your not running any of the 70_SARE_HTML rulesets. You should look into those. They don't overlap either. And they are very good. -_Chris

1 0

RE: [SURBL-Discuss] Fwd: Re: blacklist brings system to halt
by Chris Santerre 30 Jun '04

30 Jun '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, June 30, 2004 2:06 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] Fwd: Re: blacklist brings system to halt > > >Here's some additional info on some of the recent >sa-blacklist/ws.surbl.org/6dos goings on, copied from a >message I sent to the SpamAssassin-users list: > *snip* > >I think I can help explain why sa-blacklist went from 1.5 MB >to 5.5 MB in size suddenly. Chris Santerre added a fairly large >set of records from 6dos (6 degrees of spam) around that time in >order to get the records into ws.surbl.org and sa-blacklist. >Chris, Bill and I then discussed this and decided to take them >back out of sa-blacklist and therefore ws.surbl.org, and put >the 6dos entries into its own SURBL instead. Yeah....ummm.....I made a little boo boo :) This is what happens with 3 weeks off of hockey and only 3 hours sleep the night before. I have been LART'd and it won't happen again. "Bad little monkey! Bad!" --Chris

1 0

RE: [SURBL-Discuss] Remove overlapping rules due to SURBL?
by Martin Lyberg 30 Jun '04

30 Jun '04

: From: Jeff Chan [mailto:jeffc@surbl.org] : Hi Martin, : On behalf of everyone contributing to the SURBL poject, : thanks for your kind words. Glad you're finding SURBLs useful. Hi! We can't thank you guys enough. What should we do without SA and these services? :) : 1. Get rid of bigevil.cf, it's mostly in be.surbl.org 2. Get : rid of be.surbl.org, it's in ws.surbl.org Bigevil.cf and be.surbl.org removed. Thanks for your help! / Martin

1 0

[SARE] Bigevil IMPORTANT update/test.
by Chris Santerre 30 Jun '04

30 Jun '04

Ok guys, sorry there have been little updates to BE for a while. I have been working closely with SURBL project. We have got to the point where BE is now generated from ws.surbl.org which is what I have been contributing domains to instead of BE. Awaiting for this day. :) So we now have BE auto generated from WS.surbl.org...however this is a LOT more data! HUGE increase. There are now 2369 rules! TOP reports SIZE going from 22 megs to now 36 megs for spamd, however RSS only went from 21 megs to 22 megs. I have no idea how this will effect systems under heavy load. Those systems should definitely stay with SURBL as this is just a local regex copy of it. But for those systems that can't/won't use SURBL and want a local copy of this larger bigevil here is the link: (~600k) www.rulesemporium.com/rules/bigevil2.cf PLEASE report any findings to this list. It lints fine and I'm running it today. Part of me is wondering if this is even worthwhile when SA 3.0 will support SURBL direct. So these tests may be just to see the effect of such a ruleset on SA right now. We may just do away with it and have everyone use SURBL. The only updates I've been doing to the regular BE is removing a few FPs. I will not officially make this new large file the regular Bigevil for at least a week. Again, please give feedback. Thanks! Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 2

Remove overlapping rules due to SURBL?
by Martin Lyberg 30 Jun '04

30 Jun '04

Hi! I'm been using the SURBL-lists for some month now, and i'm very satisfied with the results. This is the lists i use at the moment: # sc.surbl.org - SpamCop message-body URI domains # ws.surbl.org - sa-blacklist domains as a SURBL # be.surbl.org - BigEvil and MidEvil domains # ob.surbl.org - OutBlaze spamvertised sites # ab.surbl.org - AbuseButler spamvertised sites I wonder if any of my following rulesets is overlapping the SURBL-lists and should be removed? I have the following rulesets: 70_sare_adult.cf 70_sare_random.cf 70_sare_specific.cf 72_sare_bml_post25x.cf antidrug.cf backhair.cf bigevil.cf chickenpox.cf evilnumbers.cf tripwire.cf weeds.cf Thanks alot for this great service, and keep up the good work guys! / Martin

2 1

RE: [SURBL-Discuss] Pleaae beta test ds.surbl.org - 6dos data
by Chris Santerre 30 Jun '04

30 Jun '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, June 28, 2004 10:41 PM >To: SURBL Discuss >Subject: [SURBL-Discuss] Pleaae beta test ds.surbl.org - 6dos data > > >Please beta test ds.surbl.org which is the 6dos data turned into >a SURBL. In particular, please check the false positive rate and >let us know what you find. > >Please do not use ds.surbl.org for production mail servers as it >is hosted only on my name server. > >(Chris, the list has about 120,000 entries. Were there some .c >files which we should exclude?) "So, drop: Misc.c Registrars.c Mainsleaze.c and that oughta put a pretty big dent in complaints." - A friend. ;) --Chris

2 2

sa-blacklist/spamgate limping at the moment
by William Stearns 29 Jun '04

29 Jun '04

Good day, all, The physical host that hosts www.stearns.org, spamgate, and around 25 other virtual machines has experienced some massive drive problems over the last 36 exhausing hours. I have the systems mostly up, but there's a lot of cleanup work that needs to be done. I don't expect to be able to restore the automatic update functionality until this weekend. To the best of my knowledge, ws.surbl.org (hosted on another physical system) is working just fine. It'll keep providing the latest list until I can get the automatic updates working again. Cheers, - Bill --------------------------------------------------------------------------- "Absence is to love what wind is to fire. It extinguishes the small, it enkindles the great." (Courtesy of Arnaud Installe <ainstalle(a)filepool.com>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

1 0

RE: [SURBL-Discuss] Whitelist entry needed
by Chris Santerre 29 Jun '04

29 Jun '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, June 29, 2004 10:24 AM >To: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] Whitelist entry needed > > >On Tuesday, June 29, 2004, 7:18:15 AM, Chris Santerre wrote: >> I can't get to Stearns site just yet to fix this. (server is >up, but not >> back to where we can change things yet.) We need to >whitelist search.com > >I've whitelisted it in SURBLs. > Many thanks. --chris

1 0

RE: [SURBL-Discuss] Pleaae beta test ds.surbl.org - 6dos data
by Chris Santerre 29 Jun '04

29 Jun '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, June 29, 2004 10:23 AM >To: Chris Santerre >Cc: 'Jeff Chan'; 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] Pleaae beta test ds.surbl.org - 6dos data > > >On Tuesday, June 29, 2004, 7:12:38 AM, Chris Santerre wrote: > >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>As a data point, 6dos hit 300 whitelist entries out of 120,000 >>>records, which is about a ten times greater whitelist hit *rate* >>>than ob.surbl.org. >>> > >> 0.25% fp rate, so it has an S/O rating of 99.75 :) > >No, that's not an FP rate since my whitelist does not include >every possible FP. In fact, it's rather limited. More like >the 1000 most common web domains plus many more obscure >geographic tlds that will probably never be used in spams. LOL, you missed the joke there! ;) > >The whitelist hits might give a hint at relative FP rates between >lists, but only actual testing against real messages will give >meaningful FP rates. Believe me, I know! > >> Actually that is great info. Can we get the whitelist hits? >This might be a >> great way to tweak the 6dos list. I'm also very interested >in who hit the >> whitelist. I'd like to see the xref in 6dos to see who these >people are >> dealing with. I think RSK would be interested as well. > >I've saved a copy of the 6dos hits against my whitelist at: > > http://spamcheck.freeapp.net/6dos.domains.whitelist-hits > Sweeeeet! >The entire whitelist, including many geographic domains is at: > > http://spamcheck.freeapp.net/whitelist-domains.sort > >> Even if we have to clean up 1-2% of these listed, look how >many evil domains >> we get. But I fully understand your philosophy on this Jeff. >Some of these >> evil domains may not have spammed.....yet. ;) > >I don't mind pre-emptively listing every domain of every known >spam operation. What we don't want are FPs on legitimate domains. > 10-4 good buddy. --Chris

1 0

Whitelist entry needed
by Chris Santerre 29 Jun '04

29 Jun '04

I can't get to Stearns site just yet to fix this. (server is up, but not back to where we can change things yet.) We need to whitelist search.com Anyway you can fix that Jeff? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss