Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

RE: [SURBL-Discuss] RFC: Public false positve reporting form
by Chris Santerre 31 Aug '04

31 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, August 30, 2004 7:33 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] RFC: Public false positve reporting form > > >How does anyone feel about a public false positive reporting >form? Such a form would include the reporting party, the >domain(s) or IPs, reasons why it's a false positive, etc. > I think the public needs a way to report FP, to be listed, and greylist domains. However, only if more then one person can work on these. ;) >It could be processed publically or privately in a bug >tracking system. It would be hand checked by some of our >experienced spam fighters. The results could be published >or simply aggregated without public announcement into the >overall whitelist. > >Is this a good or bad idea? good >What level of publication should there be? Answers to none. They give, we take info. Too time consuming to answer all. > >What forms of proof (if any) does anyone like? spam with headers. The rest is up to us. > >Other comments? Who was the first nut ever to think up pole vaulting? "Hey Jim, see that there bush? I bet if I run fast enough with this here flagpole......." --Chris

2 1

FP on WS
by Bill Landry 31 Aug '04

31 Aug '04

Okay, here we go again... ;-) ===== Domain, proflowers.MUNGEDcom is listed on WS. ===== ===== Sending IP listed on two aggressive RBLs, otherwise looks clean: http://www.dnsstuff.com/tools/ip4r.ch?ip=198.31.62.30 ===== ===== Domain, proflowers.com, registered through Network Solutions and domain registered in early 1998: Record created on 04-Feb-1998 ===== ===== Address space owned by Level 3: [whois.arin.net] Level 3 Communications, Inc. LVLT-ORG-198-31 (NET-198-31-0-0-1) 198.31.0.0 - 198.31.255.255 Subnet delegated to: Double Click DOUBLECLICK7-62-28 (NET-198-31-62-0-1) 198.31.62.0 - 198.31.63.255 RegDate: 2003-03-28 ===== ===== No NANAS listings: References: [ Proflowers: 0 ] ===== Anything else needed for this one? :-\ Bill

5 7

Re: [SURBL-Discuss] FP on WS
by Rob McEwen 30 Aug '04

30 Aug '04

> Domain, proflowers.MUNGEDcom is listed on WS. Thanks Bill for your good work. I hope this gets removed fast. I've heard Jeff ask in the past, "hey, what caused this to get on in the first place?" ...well, even though I often lean towards the aggressive side of the arguments, it seems like FPs like this one really are getting on SURBL too often. Therefore, I hope that Jeff or someone can find and correct the source of these particularly egregious types of FPs soon. Rob McEwen

1 0

FP on OB list
by Bill Landry 30 Aug '04

30 Aug '04

Found the link below in a Ziff Davis "Baseline Magazine" renewal notification e-mail, and it was tagged by OB: omessage.MUNGEcom The URI was used in an unsubscribe link. Bill

5 13

SURBL WS test scores in SA 3.0
by Fred 29 Aug '04

29 Aug '04

Hello Group, This is my first post here, let me introduce myself. I've been very active in fighting spam for the past 3-4 years, I just recently became a submitter to the WS surbl list and I am hoping to start some action to help get a few things improved for all of us. I've created a number of rulesets for SARE (tripwire, OEM, Spoof) and released my own rules to the public, now I am focusing on SURBL_WS and doing what I can to improve all aspects of it. First off I am looking for people who use SpamAssassin and have access to a corpus of ham e-mail. The score for the WS SURBL test in 3.0 is very low, I am really focused on improving this and hope to get the score to 2 or 3 by the release of SA 3.1 I want to track down False Positives and get these whitelisted. The statistics-set1.txt file shows: The first number is % of e-mails hit (spam and ham), the next is % of spam, followed by % of ham. 51.999 78.4712 0.4756 URIBL_WS_SURBL With detection at 78.5% this rule is only outperformed by RAZOR2 and this shows our potential. If we could reduce those FPs it would greatly increase or scores and improve everyones perception of how good we are. Even the most basic rule of HTML_MESSAGE only hit on 75% of spam, we are doing more than great so far! Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400 mailto:info@i-is.com

5 12

WL. klm-email.com
by Alex Broens 27 Aug '04

27 Aug '04

Jeff Could you pls get this whitelisted? klm-email.com * 5.0 OB_URI_RBL URI's domain appears in ws database at ob.surbl.org * [klm-email.com is blacklisted in URI RBL at] Domain Name: KLM-EMAIL.COM Registrar: SAFENAMES LTD Whois Server: whois.safenames.net Referral URL: http://www.safenames.net Name Server: A.NS.KLM-EMAIL.COM Name Server: B.NS.KLM-EMAIL.COM Name Server: C.NS.KLM-EMAIL.COM Name Server: D.NS.KLM-EMAIL.COM Name Server: E.NS.KLM-EMAIL.COM Name Server: F.NS.KLM-EMAIL.COM Status: REGISTRAR-LOCK Updated Date: 24-may-2004 Creation Date: 17-may-2004 Expiration Date: 17-may-2006 ---------------------- From: KLM Belgium [SMTP:klm_belgium@klm-email.com] Sent: 27 August 2004 14:23 To: xxxxxxxxxxxx Subject: 10 Crazy Days of Internet USA from 321 euro Fasten your seatbelts as KLM's 10 days of internet will be in the air again from August 31st until September 9th. For 10 days in a row you can book your flights to 76 destinations at extra special prices via www.klm.be (http://klm-email.com/a/MUNGED / www.klm.lu (http://klm-email.com/a/MUNGED/link5. The offer being limited, be sure to book in time! Check the complete list of destinations and prices on www.klm.be (http://klm-email.com/a/MUNGED/link4) / www.klm.lu (http://klm-email.com/a/MUNGED/link4) as of August 31st. Visit www.airfrance.be (http://klm-email.com/a/MUNGED/link6) for other attractive offers. KLM The Reliable Airline --------------------------------

2 1

RE: [SURBL-Discuss] another new TLD?
by Chris Santerre 27 Aug '04

27 Aug '04

getin.to file.to surf.to all reported spams the past few days. >-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Thursday, August 26, 2004 4:47 PM >To: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] another new TLD? > > >on Thu, Aug 26, 2004 at 04:39:21PM -0400, Chris Santerre wrote: >> File.to >> >> from >> http://File.to/ooo >> >> OK to add as well? Looks like spammers are trying to get >around the standard >> com, net, info , biz. > >Not new at all. That's Togo, who sold rights to their NIC and which TLD >we often saw in redirection services (e.g., 'http://surf.to') >back in the >mid-nineties. > >Didn't someone post a complete list of TLDs here just recently? > >-- >hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/ _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

3 3

another new TLD?
by Chris Santerre 26 Aug '04

26 Aug '04

File.to from http://File.to/ooo OK to add as well? Looks like spammers are trying to get around the standard com, net, info , biz. --Chris

3 2

SpamCop URI Compilation
by Robin, Rob 26 Aug '04

26 Aug '04

All, My company has the policy of not throwing away default build from the OS install. Therefore, all my perl libs have been compiled under /usr/local/blah/blah without doing UNINST=1. After downloading all the necessary modules, etc, I am close to getting Spamcop URI compile. Details: Perl 5.005_03, SpamAssassin 2.63. perl ./Makefile.PL went through fine. Problem w/ it is extract_url.t test script. PERL5LIB="/usr/local/spamassassin/2.63/lib: /usr/local/perl5lib/HTML/Parser/3.26/lib: /usr/local/perl5lib/File/Spec/0.82/lib:/usr/local/perl5lib/URI/1.31/lib /usr/local/perl5lib/Test/Simple/0.47/lib /usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker /usr/local/perl5lib/podlators/1.27/lib /usr/local/perl5lib/Pod/Parser/1.28/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22" Export PERL5LIB The reason why I called the test script directly is because "make test" put my PERL5LIB directories as a less preferred lib and thus loaded older version of other libs that failed. I needed to circumvent by calling the test script directly. All the test scripts passed, except extract_urls.t. I defined "/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib" as part of PERL5LIB, since I know that SpamCopURI.pm is located at /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin/SpamCopURI.pm. Perl -V confirms that everything is defined properly. From the error message, could it be my perl version is too old ? Please note that all other test scripts went through just fine. bash-2.02# perl ./t/extract_urls.t 1..23 Undefined subroutine &Mail::SpamAssassin::SpamCopURI::_extract_urls called at ./t/extract_urls.t line 46. # Looks like your test died before it could output anything. Any input will be appreciated. #Perl -V (output). I verify that all the dir for my PERL5LIB existed just fine. Characteristics of this binary (from libperl): Built under bsdos Compiled at Oct 8 2000 21:58:54 %ENV: PERL5LIB="/usr/local/spamassassin/current/lib:/usr/local/perl5lib/HTML/Parser/current/lib:/usr/local/perl5lib/File/Spec/current/lib:/usr/local/perl5lib/URI/current/lib:/usr/local/perl5lib/Test/Simple/current/lib:/usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker:/usr/local/perl5lib/podlators/current/lib:/usr/local/perl5lib/Pod/Parser/current/lib:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22" @INC: /usr/local/spamassassin/current/lib /usr/local/perl5lib/HTML/Parser/current/lib /usr/local/perl5lib/File/Spec/current/lib /usr/local/perl5lib/URI/current/lib /usr/local/perl5lib/Test/Simple/current/lib /usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker /usr/local/perl5lib/podlators/current/lib /usr/local/perl5lib/Pod/Parser/current/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22 /usr/libdata/perl5/5.00503/i386-bsdos /usr/libdata/perl5/5.00503 /usr/libdata/perl5/site_perl/i386-bsdos /usr/libdata/perl5/site_perl /usr/libdata/perl5/site_perl/i386-bsdos/include . Thanks, ------------------------ Rob Robin Network Analyst Green Apple, Inc. 740-653-9890 rrobin(a)greenapple.com www.greenapple.com Internet access, hosting and development solutions since 1995.

2 1

RE: [SURBL-Discuss] Strange happenings...
by Chris Santerre 26 Aug '04

26 Aug '04

Older Steve submission. Yup same file. And I can see why these guys would have been added. Looks like spammers were using a spacer.gif image from them in theis spams. Hence lots of NANAS hits. This was before we looked for posion like this. Removed. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, August 18, 2004 9:52 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Strange happenings... > > >On Wednesday, August 18, 2004, 6:17:26 PM, Bill Landry wrote: > >> Replying to my own post. I see now that the URI above gets >redirected to: > >> >http://qspace.iplace.MUNGEDcom/cobrands/41/?sc=1452NLCRamp;&CM= MHHNewsletterServices&CE=TextArea3 > >> and "iplace.com" is listed in WS. So my next questions is, should >> "iplace.com" be listed in WS? > >Probably not. Anyone know if these guys are spammers or why it's >on WS? > >Name: icreditreport.com >Address: 205.180.159.210 >Aliases: qspace.iplace.com > >If this appeared in a legitimate message, then we probably should >whitelist. Was it in a ham? > >Comments? > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss