- Discuss - Mailman 3

rDNS entries
by Dave Navarro 25 Jun '04

25 Jun '04

One thing I notice is that the IP addresses of blacklisted domains are not always listed in the BL as well. For example, when I look up: ghcclccc.biz.multi.surbl.org It's listed. However, when I look up: 72.2.139.221.multi.surbl.org it's not listed. Might I suggest that all domains listed in the BL also include corresponding IP addresses? --Dave

2 1

A question on policy
by Chris Santerre 24 Jun '04

24 Jun '04

I was doing some browsing of NANAE and came across something interesting. http://tinyurl.com/2xkyw But the thread basically says that uptilt.com (a known spam sender) was hired by tonyrobbins.com to advertise. So they sent out spam. Now my question is, do we list them? Do we list somewhat legit domains that hire these people without (or maybe with) the knowledge that they will spam? I'm leaning towards yes, in the hopes they will learn to choose their advertisers more carefully. Thoughts? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

5 5

RE: [SURBL-Discuss] A question on policy
by Chris Santerre 24 Jun '04

24 Jun '04

The thread I had found this in didn't contain the full body. However I searched and found a copy and sure enough, there is an uptilt.com link. It's on it's way to SURBL now :) As always J, Thanks! --Chris >-----Original Message----- >From: jm(a)jmason.org [mailto:jm@jmason.org] >Sent: Thursday, June 24, 2004 4:16 PM >To: Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] A question on policy > > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >In terms of the message, does uptilt.com have any links in it? often >in this situation they'd have added an "unsubscribe" link of their >own which SURBL would then catch. > >- --j. > >Jeff Chan writes: >> On Thursday, June 24, 2004, 9:16:51 AM, Chris Santerre wrote: >> > But the thread basically says that uptilt.com (a known >spam sender) was >> > hired by tonyrobbins.com to advertise. So they sent out >spam. Now my >> > question is, do we list them? >> >> > Do we list somewhat legit domains that hire these people >without (or maybe >> > with) the knowledge that they will spam? I'm leaning >towards yes, in the >> > hopes they will learn to choose their advertisers more carefully. >> > Thoughts? >> >> The answer I would prefer is to *not* list a mostly legitimate >> domain like tonyrobbins.com, but to let conventional RBLs list >> uptilt.com and their IPs as a spam sender. In other words, >> let spamhaus list uptilt's addresses and block on them, but >> don't list tonyrobbins.com in SURBLs since it could potentially >> be mentioned in legitimate messages. Of course it would not hurt >> to let the possibly legitimate company's lawyers know they should >> not use spammers, and cite the law being broken. >> >> This one seems like a relatively clear division of responsibility >> to me. Others may be more or less clear. >> >> Jeff C. >> >> _______________________________________________ >> Discuss mailing list >> Discuss(a)lists.surbl.org >> http://lists.surbl.org/mailman/listinfo/discuss >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.2.4 (GNU/Linux) >Comment: Exmh CVS > >iD8DBQFA2zaIQTcbUG5Y7woRAihcAJ9XmPkWKiSLJGE/0h6BuTyaWIdPLwCg8IFH >cKGFM1GM09i10Wpwx092Z6Q= >=n+Cc >-----END PGP SIGNATURE----- > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] redirect site....sort of
by Chris Santerre 23 Jun '04

23 Jun '04

Correct it is legit. >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, June 21, 2004 7:49 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] redirect site....sort of > > >On Friday, June 18, 2004, 11:30:16 AM, Chris Santerre wrote: >> place.cc > >> looks like spammers are using this site. > >It is otherwise legitimate? If so, we should whitelist >and let the redirection resolution techniques catch the >actual spam sites. > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

two-level-tlds
by Mariano Absatz 23 Jun '04

23 Jun '04

Hi, I don't know who's maintaing http://spamcheck.freeapp.net/two-level-tlds but I'd think a couple of domains could be added for .ar (Argentina). I only see: com.ar (commercial) org.ar (non-commercial) net.ar (isp's and the like) Argentina also uses: gov.ar (government) mil.ar (armed forces) edu.ar (universities and university-related research groups) esc.edu.ar (elementary schools, high schools and other (non-universitary educational institutions). Regards.

3 5

Mail-SpamAssassin-SpamCopURI-0.18
by Warren Robinson 23 Jun '04

23 Jun '04

Could you help me ? Have install sapmassassin 2.63 - appears working OK Have installed Mail-SpamAssassin-SpamCopURI-0.18 Using perl, v5.6.1 built for i386-linux Now getting the following errors ============================================================================ debug: uri tests: Done uriRE Failed to compile URI SpamAssassin tests, skipping: (syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 1, near "eval:" syntax error at /usr/share/spamassassin/20_uri_tests.cf, rule E_MAILPROMO_URL, line 178, near "; }" ) debug: Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri snurl.com *.snurl.com debug: Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri snipurl.com *.snipurl.com debug: Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri tinyclick.com *.tinyclick.com debug: Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri babyurl.com *.babyurl.com debug: Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri lin.kz *.lin.kz debug: Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri *.v3.net debug: Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri shorl.com *.shorl.com debug: Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri tinyurl.com *.tinyurl.com debug: Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri xurl.us ============================================================================ Any help would be appreciated Regards Warren Robinson warren_ro(a)compuserve.com

1 0

RE: [SURBL-Discuss] Another list to test: ab.surbl.org
by Joseph Burford 23 Jun '04

23 Jun '04

Hi Jeff, > again this one is only hosted on a few name servers now so > please don't use it for production yet. We'd like your feedback > about performance, false positives, etc. Here are some stats from one of my test servers, gives you an idea of what success rate I am seeing from the various SURBL lists. Hope the format doesn't munge too much :) 19/06/2004 2,439 messages 1,572 marked as spam Description Total Ham % Spam % URL in ws.surbl.org 748 4 0.5 744 99.5 URL in ob.surbl.org 722 4 0.6 718 99.4 URL in sc.surbl.org 647 0 0 647 100 URL in ab.surbl.org 416 14 3.4 402 96.6 URL in be.surbl.org 48 1 2.1 47 97.9 20/06/2004 2,093 messages 1,352 marked as spam Description Total Ham % Spam % URL in ob.surbl.org 777 31 4 746 96 URL in ws.surbl.org 731 5 0.7 726 99.3 URL in sc.surbl.org 528 0 0 528 100 URL in ab.surbl.org 404 2 0.5 402 99.5 URL in be.surbl.org 36 0 0 36 100 Regards, Joseph

2 1

Another list to test: ab.surbl.org
by Jeff Chan 23 Jun '04

23 Jun '04

We have turned the top 425 or so domains from Andy Warner's AbuseButler - Spamvertised Sites list: http://spamvertised.abusebutler.com/ into a beta SURBL for testing: ab.surbl.org again this one is only hosted on a few name servers now so please don't use it for production yet. We'd like your feedback about performance, false positives, etc. Andy's data is quite similar in principle to my SpamCop data in sc.surbl.org. His list is ranked by number of batched reports in a 7 day window, and he has various data sources. I'm inviting Andy to discuss this further here. Jeff C.

2 2

redirect site....sort of
by Chris Santerre 22 Jun '04

22 Jun '04

place.cc looks like spammers are using this site. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

SF Download Broken?
by Larry Rosenman 18 Jun '04

18 Jun '04

I've tried like 5-6 mirrors to pick up the 2.63 Plug-In, and none of them can read the file. Is there someplace I can FTP the tarball from? Thanks! LER -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 972-414-9812 E-Mail: ler(a)lerctr.org US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749

2 2

squid?
by Robert Brooks 18 Jun '04

18 Jun '04

I couldn't find any way of using a dns blacklist such as sc.surbl.org as a squid acl, has anyone done this? -- Robert Brooks, Network Manager, Cable & Wireless UK <robb(a)hyperlink-interactive.co.uk> http://hyperlink-interactive.co.uk/ Tel: +44 (0)20 7339 8600 Fax: +44 (0)20 7339 8601 - Help Microsoft stamp out piracy. Give Linux to a friend today! -

3 2

proxypots
by jm＠jmason.org 17 Jun '04

17 Jun '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jeff Chan writes: >We are also looking into some other potential spam >URI data sources such as proxypots, etc.: > > http://proxypot.org/ Jeff -- a quick note on this; it has to be done very carefully. Many spammers are using "link poisoning" stuff like this: Get ov<A href="http://www.gimbel.org"></A>er 300 medicatlons online shlpp<A href="http://www.omniscient.com"></A>ed over<A href="http://www.proton.net"></A>nig<A href="http://www.cravet.org"></A>ht to your fr<A href="http://www.aristotelean.org"></A>ont do<A href="http://www.barnacle.com"></A>or with no pr<A href="http://www.lordosis.net"></A>escrlption. All of those are "www.{RANDOMWORD}.{com|net|org}". Eventually there's one real link, which *is* SURBL-listed. These are chaff. Now, SORBS for one seems to be listing some of these sites; presumably because they have a spamtrap-driven feed without enough human moderation. That's the danger here. (btw, there's arguments to be made that a better selection mechanism can "weed those out", but that needs to be careful too. - - Ignore .org/.net/.com? spammer will use .biz, .info, and ccTLDs. - - Ignore 0-length links (<a href=...></a>)? spammer will change to use <a href=...>{RANDOMWORD}</a>. - - Ignore "dictionary words" somehow? spammer will use random URLs from google, so "real" sites. so I don't think those approaches have much merit alone.) - --j. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Exmh CVS iD8DBQFA0JPeQTcbUG5Y7woRAnYYAJ9/fZaT3WLmU+gT8aAnT2rcduDo7QCg6BE1 dF1r9ciWtFpEdC4OBHdRSKE= =mnKX -----END PGP SIGNATURE-----

6 6

Local RBL list?
by Jeff Taylor 17 Jun '04

17 Jun '04

I haven't been able to find this covered anywhere, but I would like to use both the spamcop list (which has been working pretty well) and a local URI blacklist in which to put my own domains that I have problems with. Since I find it hard to believe I am the only one wanting to do this, I can only assume I must have missed the how-to somewhere along the way. Can anyone lend a hand, or provide some links on how I can add in my own list?

5 5

Somewhat away from email for a while
by Jeff Chan 17 Jun '04

17 Jun '04

I will be somewhat away from email for a few days. May be able to check in on and off. My hosting company knows how to reach me at support at supranet.net if there are any emergencies. Jeff C.

1 0

Re: Where do I read about surbl/SA v3.x?
by Jeff Chan 16 Jun '04

16 Jun '04

On Wednesday, June 16, 2004, 11:51:45 AM, Lucas Albers wrote: > Bill Landry said: >> We receives about 200,000 e-mail messages per day, split between two > mail >> gateways, and have had no resource issues with using the additional > redirect >> options with spamcop_uri. You can find info on how to setup and support > the >> redirect options in the "rules/spamcop_uri.cf" file of the spamcopuri > tarball. > Jeff, > How bout changing the default surbl in 2.63 in the next release, > so redirector support is enabled. > It appears to not have any signifigant effect on performance, as per this > email. This is a suggestion for Erik Kolve, who is the author of SpamCopURI. SURBLs themselves are only the data side of things. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

double checking
by Chris Santerre 16 Jun '04

16 Jun '04

If I add this emailfactory.co.uk it will add the whole thing right? Not co.uk Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

[SURBL-Discuss] multi.surbl.org combined list available for development
by Jeff Chan 16 Jun '04

16 Jun '04

I've set up a bitmasked, combined SURBL list with sc, ws, and ph data: multi.surbl.org as described earlier, except that the TXT message is customized to each entry in the list rather than generic, for example: areyoureallysatisfied.biz 600 IN A 127.0.0.6 600 IN TXT "Blocked, areyoureallysatisfied.biz on sc, ws lists, See: http://www.surbl.org/lists.html" aridanti.com 21600 IN A 127.0.0.4 21600 IN TXT "Blocked, aridanti.com on ws lists, See: http://www.surbl.org/lists.html" citi-protection.info 600 IN A 127.0.0.14 600 IN TXT "Blocked, citi-protection.info on sc, ws, ph lists, See: http://www.surbl.org/lists.html" cmbcag.biz 600 IN A 127.0.0.2 600 IN TXT "Blocked, cmbcag.biz on sc lists, See: http://www.surbl.org/lists.html" The description of multi on the Lists page has been updated to reflect this beta version of the list: http://www.surbl.org/lists.html#multi Currently this zone is served only on my name server. There is no need for any name servers to carry this zone yet since there probably won't be code to use it for a while. Hopefully it can be useful to the developers though. Once the code is written to use the combined list, we will need to get the zone out to all the name servers. I have not finished modifying my rbldnsd zone file creation script, so there is only a BIND version currently. I hope there's still some time to get support for this into the SA 3.0.0 release. The data is live, and inclusion in the combined list and other parameters are all governed from control files, so they're easy to change, for example to add future lists. Please send me any feedback, including about the proposed wording of the TXT message. Cheers, Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

4 8

Re: Anti-phishing on SURBL
by Jeff Chan 16 Jun '04

16 Jun '04

On Tuesday, June 15, 2004, 8:51:40 AM, Smart,Dan Smart,Dan wrote: > What ever happened to the Anti-phishing rules on surbl. Never saw any > domain come forward on this. Hi Dan, The anti-phishing data is in the combined list multi.surbl.org. Because this is bitmasked data, as described on our lists page: http://www.surbl.org/lists.html#multi ... some code needs to be written to decode the results. Hopefully the SA coders will perhaps get a chance to get support for this into the 3.0.0 release. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 2

SURBL works well on envelope sender
by Daniel Quinlan 16 Jun '04

16 Jun '04

Here's a test on my last 4 days of ham and spam. The T_DNS_FROM* rules are using the envelope sender (that is, the MAIL FROM added by my MTA to the message headers). They have a reasonably good hit rate (6.43% of spam hit one of tested SURBL zones) and a 0% FP rate in this test. Only 7 out of 103 of those did not hit one of the URIBL rules, but they did do it with zero FPs (I get FPs mostly because people discuss spam domains in some of the ham tested here. That's another issue, though.) Maybe it would be worthwhile factoring this into future development. That is, also list known spammer envelope senders domains, maybe get SpamCop to provide lists for that too, I suspect there's some overlap in the other direction as well. OVERALL% SPAM% HAM% S/O RANK SCORE NAME 2598 1602 996 0.617 0.00 0.00 (all messages) 100.000 61.6628 38.3372 0.617 0.00 0.00 (all messages as %) 3.580 5.8052 0.0000 1.000 1.00 0.01 T_DNS_FROM_SURBL_WS 0.885 1.4357 0.0000 1.000 0.67 0.01 T_DNS_FROM_SURBL_SC 9.161 14.5443 0.5020 0.967 0.56 1.00 URIBL_BE_SURBL 36.066 57.5531 1.5060 0.974 0.44 1.00 URIBL_WS_SURBL 0.423 0.6866 0.0000 1.000 0.33 0.01 T_DNS_FROM_SURBL_BE 29.908 47.5655 1.5060 0.969 0.11 1.00 URIBL_SC_SURBL How's the multi roll-out going? It would definitely be handy for this test (the code to support it already exists). Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

2 1

Where do I read about surbl/SA v3.x?
by Chuck Campbell 16 Jun '04

16 Jun '04

I've seen tons of email on this list about surbl and uribl, but I haven't really made sense of it yet. Is ther a FAQ on this stuff for SA users? Does it deal with performance issues? thanks, -chuck

3 4

RE: [SURBL-Discuss] Re: Which rules are replaces by *.surbl.org?
by Chris Santerre 15 Jun '04

15 Jun '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, June 14, 2004 7:13 PM >To: SpamAssassin Developers; SURBL Discuss >Subject: [SURBL-Discuss] Re: Which rules are replaces by *.surbl.org? > > >On Monday, June 14, 2004, 2:03:11 PM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>Ideally if folks want every function, they should: >>> >>>0. Use sc.surbl.org >>> >>>1. Use ws.surbl.org (which now has the be.surbl.org domains) >>> >>>2. *Not* use be.surbl.org (which is now redundant) >>> >>>3. Use BigEvil.cf (and perhaps MidEvil.cf also, depending >>>on how Chris and Paul work things out.) > >> Yes, but I want to add that there _WILL_ be a "BigEvil >style" cf version of >> ws.surbl.org for those people who won't/can't use the SURBL >net lookups for >> some strange reason. This is still being worked on. One of >the main reasons >> I haven't updates BE in a while is because I've been working >on the new WS >> submission stuff. (Thanks to everyone who is involved in that!) > >Thanks, I forgot about that other direction of rules style >entries moving from sa-blacklist back into bigevil.cf. Sounds >like the best of both worlds in a nice mirror of both types: > >A. ws.surbl.org gets all the "static" domains from BigEvil, >sa-blacklist, etc. in the form of a SURBL. > >B. BigEvil.cf gets all the domains, including those from >sa-blacklist, heavily wildcarded ones, etc. in the form of a >ruleset. > >I didn't think of it earlier, but that will increase the >overlapped coverage for folks using both of the above however. > >Please be sure to let me know when you start feeding the larger >lists into BigEvil.cf so I can know when to stop feeding them >into be. Don't want a feedback loop of those going into ws. >Accordingly I will also stop feeding be into ws at that time. > >(Bill Stearns, please note the above. My feed of be to you >should freeze at some point. Chris we should definitely >coordinate when I should freeze the be I send Bill. Please >let me know.) Well I haven't even been updating BE. My update today removed some FP and regex goofs. Nothing added. I have been adding to [ws] because it is MUCH easier :D You can pretty much stop feeding [be] into [ws] right now. > >Also: *when should we announce that be domains are now in ws, and >that people should stop using be?* Is everyone comfortable that >the combined ws is now working as expected, including the be >domains being folded in? You could do that now. Stating that [be] will not change until the [ws] to bigevil.cf script work is complete. Once that is done I will add the dynamic stuff to BE. But from now on, I only update static domains to [ws]. >> Things should also pickup in the addition of new domains. >More _trusted_ >> sources are being worked on now. We are being really picky, >and making >> people walk the Gauntlet of Fire! :D > >More data sources sound good. I'm glad we're being very careful >that false positives don't get in. When we get a clearinghouse >set up to double check them, that will help. *cough* Paul you still alive? *cough* --Chris

2 1

RE: Which rules are replaces by *.surbl.org?
by Chris Santerre 15 Jun '04

15 Jun '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Sunday, June 13, 2004 12:28 AM >To: SpamAssassin Users; SURBL Discuss >Subject: Re: Which rules are replaces by *.surbl.org? > > >On Saturday, June 12, 2004, 7:56:15 PM, ian list) wrote: >> On Sat, 12 Jun 2004, Jeff Chan wrote: > >>> In other words the domains from BigEvil and MidEvil that can be >>> listed without many wildcards go into ws.surbl.org and the >>> domains that need more wildcards (too many to be practically >>> enumerated) will end up in BigEvil.cf . >>> >>> Chris may not be ready to do the latter yet, but the former is >>> already in place as of a few days ago. We're watching it all >>> run for a while before announcing officially. > >> Thanks for info Jeff, one question, for us who rsync the >zones off your >> servers, will the be.surbl.org.bind/be.surbl.org.rbldsnd >files disappear ? >> Does this mean we need to reconfigure our bind/rbldnsd if BE >disappears >> and transforms back into a .cf ? > >We had lots of difficulty reaching people and getting them >to stop using sa.surbl.org when we simply wanted to rename that >list to ws.surbl.org, and that was early on, so I suspect >be.surbl.org may live on but with essentially no content. be's >been around longer so it would be harder to get it out of configs >out there. But the useable content from be is now in ws. > >Ideally if folks want every function, they should: > >0. Use sc.surbl.org > >1. Use ws.surbl.org (which now has the be.surbl.org domains) > >2. *Not* use be.surbl.org (which is now redundant) > >3. Use BigEvil.cf (and perhaps MidEvil.cf also, depending >on how Chris and Paul work things out.) Yes, but I want to add that there _WILL_ be a "BigEvil style" cf version of ws.surbl.org for those people who won't/can't use the SURBL net lookups for some strange reason. This is still being worked on. One of the main reasons I haven't updates BE in a while is because I've been working on the new WS submission stuff. (Thanks to everyone who is involved in that!) Things should also pickup in the addition of new domains. More _trusted_ sources are being worked on now. We are being really picky, and making people walk the Gauntlet of Fire! :D > >That said, not every one chooses to use every component. >The choice is up to them. > >To summarize the changes, the relatively fixed domains from >be are now in ws, and the heavily wildcarded domains will >end up only in BigEvil.cf. So to get the original BigEvil >functionality one would continue to use BigEvil.cf and add >ws.surbl.org. (That would also add the sa-blacklist domains >for someone who was only using BigEvil before.) Yeah I will be working on the more dynamic Bigevil.cf soon. I'm trying to work on another ruleset now that has nothing to do with URLs :) My eyes have been getting cross-eyed! Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 4

Re: Which rules are replaces by *.surbl.org?
by Jeff Chan 15 Jun '04

15 Jun '04

On Saturday, June 12, 2004, 4:10:30 PM, Matt Kettler wrote: > At 08:26 PM 6/12/04 +0200, Matthias Keller wrote: >>I just upgraded to 2.63 and installed the patch to use surbls >>But I'm now not quite sure which .cf-rules I may remove now....? >>sc.surbl.org -> replaces spamcop_top200.cf ? > No.. spamcop_top200 is NOT URI based, it's Received: headers.. > The normal spamcop DNSBL (RCVD_IN_BL_SPAMCOP_NET) overlaps with > spamcop_top200.cf not SURBL. >>ws.surbl.org -> replaces blacklist-uri.cf, right? > Yes. >> -- but also blacklist.cf ? > No. surbl ONLY does uri's.. WS's blacklist.cf is a sender-domain blacklist. >>be.surbl.org -> that one I'm sure, it replaces bigevil (and midevil) ..... > Somewhat, although be.surbl.org is going away and even right now it doesn't > (and cannot) contain all of bigevil. Thanks for a good response Matt! You hit all the points excellently. Key is that SURBLs contain message body URI domains. This is a very different approach from most RBLs which as you note list sender domains or sending IP addresses. SURBLs don't go after the sources of the messages, they go after the URIs in the message bodies. More information about the lists can be found at: http://www.surbl.org/lists.html > Eventualy JC, WS, And CS are going to get together and merge all the > static-text stuff in bigevil over to WS's stuff, and bigevil will focus > only on wide-range regex stuff, at which point it can't be surbl hosted and > must be a .cf file. (DNS can't do regexes, just exact text match) The enumerable domains in be.surbl.org are now being merged into ws.surbl.org, so be.surbl.org is just about ready to go away, with the heavily-wildcarded, widely-varying domains ending up exclusively in BigEvil.cf. In other words the domains from BigEvil and MidEvil that can be listed without many wildcards go into ws.surbl.org and the domains that need more wildcards (too many to be practically enumerated) will end up in BigEvil.cf . Chris may not be ready to do the latter yet, but the former is already in place as of a few days ago. We're watching it all run for a while before announcing officially. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

3 3

{Spam?} Another redirection site: www.clubiran.com
by Jeff Chan 14 Jun '04

14 Jun '04

Here's another open redirection site to handle: http://www.clubiran.com/url/click.php?url=http://www.loan-america.com/index… I've whitelisted it in SURBLs. Anything special that happens in URI parsing code or the programs that call it may want to take this one into account. I've also written the owners of the redirection site. Jeff C.

1 0

ob.surbl.org ?
by ian sison (mailing list) 11 Jun '04

11 Jun '04

In the latest rsync of the dns zones i got the file ob.surbl.org.bind as well. it's a biggie, at 3884780 bytes. Anyone know the source of this data? - Ian

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss