Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

FP Pattern for sbl-xbl.spamhaus.org
by Rob McEwen 15 Aug '04

15 Aug '04

RE: FP Pattern for sbl-xbl.spamhaus.org For a while now, my philosophy has been to use sbl-xbl.spamhaus.org to block at the connection level and not even allow these messages onto my server. Much of the remaining spam filtering is then done by SURBL-checking. However, more recently, I been testing samples of sbl-xbl.spamhaus.org blocked messages and I've noticed two things. (1) more false positives than I would want to see (though still a very tiny, tiny percentage overall) get blocked by sbl-xbl.spamhaus.org ...and... (2) those that ARE legitimate tend to be cases where a mistake was made and, by the next day (or later that same day), the offending IP is removed from sbl-xbl.spamhaus.org However, I must admit, I'm drawing sweeping conclusions from very little sampling of data. Therefore, don't take my word for it... Rather, is this consistent with anyone else's experience with sbl-xbl.spamhaus.org? The reason I mention this is that, if my initial conclusions are true, there would then be a strong argument for "holding" sbl-xbl.spamhaus.org blocked mail and giving it a "second try" some hours later. Also, if this is true, does anyone have a "feel" for exactly how long "bad" data stays on sbl-xbl.spamhaus.org before it gets removed? (Recognizing, of course, that SpamHaus is probably the most reliable and respected free RBL in existence and they rarely make mistakes in the first place). Any thoughts or suggestions? Has anyone examined their sbl-xbl.spamhaus.org blocked messages lately? Rob McEwen

4 7

China revokes Viagra patent so it can make locally
by Jeff Chan 14 Aug '04

14 Aug '04

Of possibly major significance to phramaspam, the Chinese government apparently has revoked Pfizer's Viagra patent so their own companies can make it locally: <http://news.yahoo.com/news?tmpl=story&u=/afp/20040805/hl_afp/china_health_v…> > Thu Aug 5, 7:17 AM ET > BEIJING (AFP) - Chinese pharmaceutical makers are planning to > jointly produce a local variant of Viagra after Pfizer Inc of > the US lost its patent protection in China for the popular drug. > Without citing a source, state media reported Wednesday the 17 > pharmaceutical companies, headed by Tonghua Hongtaomao > Pharmaceutical Co Ltd. from northeastern China, are hoping to > set up a joint-stock company to make an erectile dysfunction > drug that would cost only half the price of Viagra. This may create new incentives for and types of pill spams. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

partstrain.com potential FP on OB.
by Patrik Nilsson 14 Aug '04

14 Aug '04

partstrain.com is listed on OB. They show up in sponsor links on a discussion list for Amnesty International members (a list hosted by mainsleaze spammers Topica...). They seem to be a legit autoparts company. I can't find any abuse reports on NANAS that mention partstrain.com, but one news group post indicating they might be a bit shady. Not sure about this one. I'll whitelist it locally if there is a reason for it being on OB. Patrik

2 1

Re: SpamAssassin Logo Update
by Jeff Chan 14 Aug '04

14 Aug '04

FWIW I agree with most of your own comments. The arrow is much more meaningful in cross-cultural symbolism than the shuriken. (Even many Japanese people would probably more readily recognize the arrow than the Shuriken, which is an obscure and impractical weapon at best.) The tie in with Apache is an added plus. I like the top (closest to original?) logo the best. I find your logo clean, professional, meaningful and, frankly, pretty. Those are hard to come by. Congratulations on nice work. Jeff C.

1 0

fp: straight dope dot com
by Steven Champeon 13 Aug '04

13 Aug '04

Why is this domain listed? I know the jokeaday folks are scum, but heck, I subscribe to the straight dope list. -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/

3 4

URL spam using google search
by Yusuf Goolamabbas 13 Aug '04

13 Aug '04

Not sure if this was ever discussed on this list. >Ksd DSCg RAZIfdY pi pzwoKCB > > >Smokers Club... > > >Check links bellow and you will find the sites offering fresh cigarettes: >MARLBORO 12,40 per carton >CAMEL 11,80 per carton >WINSTON 10,45 per carton >and much more, with guaranteed US delivery! > >Avoid wasting money! Just use one of the following >links (WHICHEVER YOUR PREFER) > > ><http://www.google.com/search?q=unbelievably+cheap+cigarettes+incomparable+s…>Unbelievably >cheap cigarettes OR >http://www.google.com/search?q=unbelievably+cheap+cigarettes+incomparable+s… >OR >Smokers Club, Shtefani Lopedius, Ñhairman HH UWEjf DeyHdM QDEY AVYTbGCZs >OW gekyJ klS yA UVU ----- End forwarded message ----- -- Yusuf Goolamabbas yusufg(a)outblaze.com

3 3

Possible fps
by Jeff Chan 13 Aug '04

13 Aug '04

Here is a list of 130 domains that come from messages have been manually marked as "not spam" at a large but deliberately unnamed mail provider. We may want to consider whitelisting these. Here's a summary of matches against the lists, with some overlap: list count: 130 ws: 77 ob: 54 ab: 2 ph: 4 sc: 0 activismispatriotism.org anwod.com anyxhost.com appleseedsacks.com aramova.com asexstoryforyou.com asianangels.com autumntiger.com b33r.us barnstablepatriot.com bigbigsavings.com bl4h.net cashspiders.info casinovendors.com challengerone.com cherryinc.com chinese960.com cllgeprgamsonlne.biz cmaya.com cn4e.com conception766pi11.us condominiums.tk coolerfix.com courrielleur.com dakotacom.net easysitelaunch.com eletricjoy-bz.com eletricjoy-hm.com emailministry.org findbrooke.com fivecentclicks.com freepornofreeporn.com gaingreenbacks.com gayartworks.org geileheissemaus.com getuni.com golady.com goldnow.st grmushkinsexxx.com healthinsurancesavings.com heightmax.com hottigotti.com humaniststudies.org hunt4stuff.com iasurvey.org indiapakistanpeace.org kehuidao.com kimberlygordon.biz lavahelp.net lenovo2008.com letnaderdebate.org livingmath.net lowratesource.com lvalite.com magicpages.biz manchuriangame.com marketingdealtime.com marketmysite.com maybeyes.biz megacockcravers.com mellamed.com memri.org.il messagizer.de micropoint.biz misshaped982twisty.com monarchhs.com mtnonline.com mxincome.com myebay-secure.net mypharmanex.com nameauditors.com newsenterpriseonline.com nexuswebs.net niceshemale.net numbersusa.com onlneductnprgms.biz onlywantsex.net ourpictures.com outplan.com.br ownsthis.com paidbymouse.com pcdepot.co.il pdgexchanger.com pdginventory.com peoplejudgebush.org peterforflorida.com philosc.com pksnetwork.com plainfunxe.com politicalbrew.com qerhj.com recyclemycell.com rxmedaid.com sandicarismasport.com santosdiablos.com savedarfur.org scotclayton.org scottrader.com securybanks.net smileycons.com soroacaba.us spaceports.com spamusement.com stayandorplay.com tastingsjournal.com thundercloud.net topvaluenow.com totallyamateurs.com trickortranny.com ultraqualityforyou.com unitedemailsystems.com usabusiness1.com utadaexodus.com utopiafootball.com vetomail.com vherb.idv.tw webmasterlose.de webmldlz.com widomaker.com worldjobs.us wz-bbs.com xfhotel.net xfjob.net xfsale.net xfte.net xuevsdes.net yourdomainhere.com youthbuy.net ysmtrucker.com zdrux.com Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

6 14

Zone data
by Ryan Thompson 12 Aug '04

12 Aug '04

Hi all, I decided it was finally high time to fill out the rsync access form, so I did that yesterday. (By the way, Jeff, I think I forgot to click the "If we may publish..." checkbox. You can pretend I did. ;-) Until I get the access information, is there a perhaps less current source I could do a one-time download from to better test my rbldnsd installation? My Googling was hopeless. - Ryan, the Occasionally Impatient -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

2 3

RE: [SURBL-Discuss] RE: (1) Another Possible FP, and (2) header p arsing issues
by Chris Santerre 12 Aug '04

12 Aug '04

>-----Original Message----- >From: Rob McEwen [mailto:rob@pvsys.com] >Sent: Thursday, August 12, 2004 12:17 PM >To: 'Chris Santerre'; 'SURBL Discussion list' >Subject: RE: [SURBL-Discuss] RE: (1) Another Possible FP, and >(2) header >parsing issues >Importance: High > > >Chris said: > >>I'm confused. (Theres a first!) SURBL only >>check the body for URLs. How did the message-ID get hit? > >Its simply an issue where someone's implementation of SURBL >provided the >option of extracting domains out of either (1) the header, >and/or (2) the >client's IP address, and/or (3) the body of the e-mail. Any >combination was >possible/configurable. The "default" setting was to use all three. > >The following is the software package that I am using for >SURBL filtering: > >http://www.2150.com/regexfilter/ > >I chose this because it works well with my Merak IceWarp >webmail software I >have running on Windows 2000 server. > >The guy who wrote this is very smart. Because he uses the >filter for himself >and didn't have to worry about "clients", he was very >aggressive with his >default settings both for SURBL and for other linguistic aspects of his >filter. Just about everyone using it has had to contend with having to >"loosen" it in a number of ways to prevent false positives for their >clients... but this was a small price to pay for a well >designed and FREE >software package. > Ah now I see. I would strongly say to NOT use SURBL on headers. Too many faked headers. --Chris (Beer me!)

2 1

[SURBL-Discuss] RE: (1) Another Possible FP, and (2) header parsing issues
by Rob McEwen 12 Aug '04

12 Aug '04

I have a two-part question: (1) header parsing issues... I was reading a web site discussing an implementation of SURBL on the IceWarp web server (using a third party add-on). One person complained that there are too many false positives when submitting IPs and domains found in the header of the e-mail. They felt like ONLY the body of the message should be examined. I see good arguments both ways. For example, parsing the header can catch spam which was originally sent to one place, but then forwarded to another. On the other hand, actual affiliate URLs would only normally occur in the body of the message. Any thoughts or suggestions? (2) Another Possible FP... This person was asked to give an example of a message which shouldn't have been blocked and which would have gone through if the header wasn't parsed. They provided an example which had the following line in the header: Message-ID: <000b01c47f1a$e02f73e0$0200a8c0(a)MUNGED-callatg.com> The offending domain was MUNGED-callatg.com Therefore, I must ask, could MUNGED-callatg.com be a FP? The reason I suspect so is because they mentioned that this company is a division of GE. Please check on this. Rob McEwen

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss