Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

Praise for SURBL
by David Groce 29 Jul '04

29 Jul '04

After just one day of getting SURBL's to work in my SA 2.63 install, I can't say enough good things about it. I haven't been able to keep up with updating rules and spam was becoming a big problem again, more getting through then getting filtered. Until yesterday. To the people who thought this up, Thank you very much, you have made me and my ~1000 users very happy. David Groce CCNA Network Server Analyst/Coordinator North Kitsap School District

2 1

RE: [RD] Bigevil future looks bleak.
by Chris Santerre 29 Jul '04

29 Jul '04

>-----Original Message----- >From: Fred [mailto:spamassassin@freddyt.com] >Sent: Wednesday, July 28, 2004 11:32 AM >To: Chris Santerre; Spamassassin-Talk (E-mail) >Subject: Re: [RD] Bigevil future looks bleak. > > >Chris Santerre wrote: >> OK, BigEvil is out of control. My own mail server went into "Now >> everyone just hang on a minute!" mode :) >> >> There are just toooo many dang domains to use it anymore. Daemons >> spin out of control, queues fill, and babies cry! > > >I have an idea for it's rebirth. Use the same type of setup I >have going >for sc_top200.cf, take the top 200 hitters or maybe the previous 200+ >domains (that were added) and keep bigevil updated with those. > >I wrote a script for the sc_top200.cf updates, I just run it >once a day or >more when I update my rules. Having some type of interface >like this will >allow bigevil to live on, in a fully automated way (we love >not working). >Worth an idea, I always like to code things up, keep it in mind! > Hmmm.....but how would we know which would be the top 200? Get reports from the top DNS lookups from the surbl servers? Possibly use bigevil in the eval file format we talked about before? WIll have to test the speed of that later. --Chris

2 1

URGENT --- com listed at sc and multi
by Jose Marcio Martins da Cruz 28 Jul '04

28 Jul '04

Hello, "com" is listed at sc and multi.... Big error.... Many people are complaining here.... 8-( -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

5 12

[SURBL-Discuss] RE: ANNOUNCE: How to report false positives in ph anti-phishing l ist to MailSecurity
by Chris Santerre 28 Jul '04

28 Jul '04

In general the only way to report one for Blacklisting for WS is to go to http://www.rulesemporium.com/cgi-bin/uribl.cgi do a lookup, if not in WS there is a report button that shows up. Placing a copy of the spam will get it listed MUCH faster, then if you don't. These are always hand checked. As for MailSecurity reporting, nothing yet. --Chris >-----Original Message----- >From: Rakesh [mailto:rakesh@netcore.co.in] >Sent: Wednesday, July 28, 2004 2:45 AM >To: Jeff Chan >Cc: SURBL Announce; SpamAssassin Users >Subject: Re: ANNOUNCE: How to report false positives in ph >anti-phishing >list to MailSecurity > > >And where to report domains to be blacklisted ? > >Jeff Chan wrote: > >>We've updated the SURBL Lists document to add information about >>how to contact MailSecurity with reports about false positives in >>ph, the anti-phishing list included (only) in multi.surbl.org: >> >> http://www.surbl.org/lists.html#ph >> >>"Please report false positives on the ph list to: postmaster >> at corp.mailsecurity.net.au. Be sure to include supporting >> reasons explaining why the domain should not be listed." >> >>Jeff C. >> >> > >

1 0

Re: RE: [SURBL-Discuss] Phone Number Spam
by Rob McEwen 28 Jul '04

28 Jul '04

Matt, I'll gather a list over the next week or so and I'll send them to you. Then, I'll try to send them as I get them. You are correct in that these types of spam are rare. But they do expose a weakness in the system and they are more noticeable now that so much else is blocked. On the other hand, it has to take guts for a spammer to expose something so traceable as a phone number within an obvious spam message. You'd think that fear of prosecution from authorities and/or harassment from vigilantes would be enough of a deterrent. Thanks, Rob McEwen

1 0

Re: RE: [SURBL-Discuss] Phone Number Spam
by Rob McEwen 28 Jul '04

28 Jul '04

Bret: That is exactly what I'm talking about. Only, that list seems small and I wonder if there is a good system in place to submit phone numbers and to get these spam phone #s listed within hours instead of days. Also, is there another similar list somewhere else? Rob McEwen PowerView Systems rob(a)pvsys.com (478) 475-9032

2 1

Phone Number Spam
by Rob McEwen 28 Jul '04

28 Jul '04

RE: Phone Number Spam Have ya'll see the phone number spam which makes it through SURBL because they don't have an offending URL? I was wondering, is there a clearinghouse for this? It would be great if these phone numbers could also be reported and a list of recent hits could be downloaded for inclusion into heuristic filtering scripts or rules (etc). Rob McEwen

2 1

RE: [SURBL-Discuss] FPs - cooler email dot com and icebase dot co m
by Chris Santerre 28 Jul '04

28 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, July 27, 2004 5:35 PM >To: SURBL Discussion List >Subject: Re: [SURBL-Discuss] FPs - cooler email dot com and icebase dot >com > > >On Tuesday, July 27, 2004, 7:53:50 AM, Steven Champeon wrote: >> Both of these are associated with Strong Week, a legit >"what's going on" >> newsletter received by one of my users here. > >I see cooleremail dot com and icebase dot com on ws.surbl.org and >have whitelisted them in SURBLs. We should ask Chris or Bill to >see why they are getting onto ws and try to correct that. > >Jeff C. > I reported these on the 23rd. But.....what the....? How come everytime I go back and look at these I say to myself, this shouldn't have been added? I checked these buy hand, but there doesn't apear to be sufficient data to support being listed for either. It appears that these were submissions from the web report. And the actuall emails Looked VERY spammy. Which is why they got listed. And it could have been a spam run that they dump the customer. Could....but maybe not. I say remove them both for now, and watch them. NANAS would have me think they are not spammers. But they *may* get fooled byt heir own customers every now and then. I will remove from submisions. --Chris

1 0

Re: [SURBL-Discuss] Death By DNS
by Rob McEwen 28 Jul '04

28 Jul '04

sm said: > If the DNS server is slow, it will cause problems. If you are going to use > DNS based blacklists, you should have a reliable DNS server. While I generally agree with this statement, I would add that that reliability and speed are not always a "yes/no", or "good/bad" thing. There are some grey areas or varying degrees of responsiveness and speed and, definitely, using blacklists in the way that SURBL does puts a new level of burden or stress on DNS servers. For example, if a DNS server is generally good, but does have a 12 millisecond response time (using an arbitrary number) due to being shared among dozens (or hundreds) of other servers, this 12 milliseconds gets multiplied out when a dozen SURBL lookups hit at practically the same instant. In this case, the message is dependent on ALL of these requests being answered before the message can continue. This can also cause the mail server to have to work more threads at any one given time... which can lead to additional scalability and performance issues. Therefore, many DNS server situations which are more than adequate for regular situations may not be adequte for SURBL lookups. Rob McEwen

4 4

I figured it out!!!!
by David Groce 28 Jul '04

28 Jul '04

Man do I feel dumb. The day before I decided to tackle the CPAN install of Spamassassin, I had downloaded a rule from exit0.us (BodyRules.cf) it was an odd download since the page that displays it was a PHP page, so I went through and cleaned out all the extra html, but apparently didn't do a very good job. So I added the rules I had been using one by one and running spamassassin --lint to find out what was breaking it, and sure enough the error: > Scalar found where operator expected at (eval 17) line 686, near "} $self" > (Missing operator before $self?) > Failed to run header SpamAssassin tests, skipping some: syntax error at > (eval 17) line 686, near "} $self" was coming from the BodyRules.cf file. I have also updated my LWP through cpan and I get no errors, so I'm off to test my maildroprc file to see if I can get this mail server back into shape. I appreciate all the help. David Groce CCNA Network Server Analyst/Coordinator North Kitsap School District (360) 394-2621 dgroce(a)nksd.wednet.edu

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss