Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

RE: Bug in Spamcop's surbl add-on module
by Chris Santerre 05 May '04

05 May '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, May 05, 2004 8:26 AM >To: spamassassin-users(a)incubator.apache.org >Cc: SURBL Discuss >Subject: Re: Bug in Spamcop's surbl add-on module > > >On Wednesday, May 5, 2004, 5:18:04 AM, Keith Hackworth wrote: >> I was installing >> a new mail server and testing the surbl lookups, but my test kept >> getting through not being marked as spam. The test I was using was >> http://e.1asphost.com - this is on the be.surbl.org list. ... >> My logs show that the >> system is looking up 1asphost.com, which is NOT on the list. > For some >> reason, it stripped off the "e." > >> It seems that spamcop's surbl doesn't handle subdomains at >all. Anyone >> else seeing this? > >Hmm, it is indeed in BigEvil with the e. : > >bigevil.cf:uri BigEvilList_181 >/\b(?:extreme-rapes\.com|excaliburproducts\.c >om|evansezmoney\.estarnetwork\.com|enjoyadvanced097\.org|emedor >ders\.com|email\. >homemadesimple\.com|ehostzzz\.net|e-g\.com|efreedomweb\.net|ecr >edibledeals\.com| >echofrompeople\.com|e\.1asphost\.com)\b/i > >and it's therefore making it into be.surbl.org with the e. : > >bigevil.domains:e.1asphost.com > >However we should be taking off the subdomain before it goes into >the SURBL form. I'll need to check with Chris on how we can >handle that. > >BTW, SURBL is not a SpamCop project, although we are using >SpamCop URI domains as a data source in the sc.surbl.org list. > >Jeff C. It's not a bug, its a feature! Actually, no its a bug :) I have been going thru cleaning these sort of things up. However I started at the begining of the B.E. list. This is at rule 181, I haven't even got to 100 yet! This is left over from my alpha phase of B.E. I've had a lot more coffee since then. So I will fix that one, But I'm sure there are others ;) --Chris

2 1

[SURBL-Discuss] Re: Proposal to add some anti-phishing data to SURBL
by Jeff Chan 05 May '04

05 May '04

On Wednesday, May 5, 2004, 7:02:45 AM, Smart,Dan Smart,Dan wrote: > Would love to have this made available. I'm surprised this list isn't more > focused on the Phishing issues. Spam is a nuisance, while Phishing can > bring *REAL* damage and loss of privacy. > I, for one, would love such an anti-phishing SURBL. Thanks for the feedback Dan. I agree phishing is probably more potentially damaging that other spams. We should be getting the data into a SURBL, either as part of ws.surbl.org and/or perhaps a future combined list. Jeff C. __ > <<Dan>> > | How do people feel about adding this data to a public SURBL? > | Does this kind of division of free and commercial uses seem > | ok? Would any of the SURBL public name servers have any > | issues with an arrangement like this?

1 0

RE: [SURBL-Discuss] Stupid SPAM
by Chris Santerre 05 May '04

05 May '04

>-----Original Message----- >From: Jose-Marcio.Martins(a)ensmp.fr >[mailto:jose-marcio.martins@ensmp.fr] >Sent: Wednesday, May 05, 2004 3:47 PM >To: SURBL Discussion list >Subject: [SURBL-Discuss] Stupid SPAM > > > > >Hello, > >Take a look at this SPAM : > > http://www.ensmp.fr/~martins/Prozac > >Mainly, check the source. > >The problem is that it comes with many, many URLs. At the beginning, >there are URLs needed by the SPAM itself. After, it puts many >URLs with >font size equals to 1. Most of these last domains aren't spam... 8-) > >Jose-Marcio > Ah it feels like I'm wraped in a warm URL blanket :) Yeah I've been seeing these for a long time when they tried to get around bigevil. This is one of the reasons I got rid of using scripts to pull out URLs. I believe SA 3.0 will handle these correctly. SURBL is touched by a human. So these things get picked up quick. But common users trying to submit these other URLs is where the time consumption will be. :( Show that we kind of have the spammers by the booboo now :P --Chris

1 0

Re: Bug in Spamcop's surbl add-on module
by Jeff Chan 05 May '04

05 May '04

On Wednesday, May 5, 2004, 5:18:04 AM, Keith Hackworth wrote: > I was installing > a new mail server and testing the surbl lookups, but my test kept > getting through not being marked as spam. The test I was using was > http://e.1asphost.com - this is on the be.surbl.org list. ... > My logs show that the > system is looking up 1asphost.com, which is NOT on the list. For some > reason, it stripped off the "e." > It seems that spamcop's surbl doesn't handle subdomains at all. Anyone > else seeing this? Hmm, it is indeed in BigEvil with the e. : bigevil.cf:uri BigEvilList_181 /\b(?:extreme-rapes\.com|excaliburproducts\.c om|evansezmoney\.estarnetwork\.com|enjoyadvanced097\.org|emedorders\.com|email\. homemadesimple\.com|ehostzzz\.net|e-g\.com|efreedomweb\.net|ecredibledeals\.com| echofrompeople\.com|e\.1asphost\.com)\b/i and it's therefore making it into be.surbl.org with the e. : bigevil.domains:e.1asphost.com However we should be taking off the subdomain before it goes into the SURBL form. I'll need to check with Chris on how we can handle that. BTW, SURBL is not a SpamCop project, although we are using SpamCop URI domains as a data source in the sc.surbl.org list. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

[SURBL-Discuss] Fwd: Re[2]: Proposal to add some anti-phishing data to SURBL
by Jeff Chan 05 May '04

05 May '04

This is a forwarded message From: Robert Menschel To: SpamAssassin Developers <spamassassin-dev(a)incubator.apache.org> Date: Tuesday, May 4, 2004, 7:06:25 PM Subject: Proposal to add some anti-phishing data to SURBL Tuesday, May 4, 2004, 9:42:14 AM, Marc wrote: MP> For what it is worth - I support it. I definitely want to block MP> exposure to fraud of my users. Agreed. The Phishing SURBL sounds like a good idea to me. I see no conflict with a company doing commercial work also offering a public service. Bob Menschel MP> Jeff Chan wrote: >>David Hooton of Platform Networks has been converting the >>proprietary SpamAssassin message content filtering rules of >>MailSecurity.net.au into SURBLs. The data's being organized into >>separate SURBLs, for example pharma, phishing, and other spams. >>In order to give something back to the SURBL/SA community and the >>Internet in general, he is proposing to make the phishing data >>freely available for potential inclusion by Bill Stearns in >>ws.surbl.org. ...

1 0

[SURBL-Discuss] Fwd: Re: Proposal to add some anti-phishing data to SURBL
by Jeff Chan 04 May '04

04 May '04

This is a forwarded message From: Marc Perkel Date: Tuesday, May 4, 2004, 9:42:14 AM Subject: Proposal to add some anti-phishing data to SURBL For what it is worth - I support it. I definitely want to block exposure to fraud of my users. Jeff Chan wrote: >David Hooton of Platform Networks has been converting the >proprietary SpamAssassin message content filtering rules of >MailSecurity.net.au into SURBLs. The data's being organized into >separate SURBLs, for example pharma, phishing, and other spams. >In order to give something back to the SURBL/SA community and the >Internet in general, he is proposing to make the phishing data >freely available

1 0

Proposal to add some anti-phishing data to SURBL
by Jeff Chan 04 May '04

04 May '04

David Hooton of Platform Networks has been converting the proprietary SpamAssassin message content filtering rules of MailSecurity.net.au into SURBLs. The data's being organized into separate SURBLs, for example pharma, phishing, and other spams. In order to give something back to the SURBL/SA community and the Internet in general, he is proposing to make the phishing data freely available for potential inclusion by Bill Stearns in ws.surbl.org. Access to the other lists would be sold commercially, but the phishing data would be a potentially useful spam/fraud/crime fighting tool to make available to everyone, while hopefully creating some recognition for their other lists. A preliminary web page describing the phishing list is at: http://www.mailsecurity.net.au/phish/ Dave describes the status of the phishing list as public in that: "We're going to release our phishing attack list publicly and it will remain that way for the duration of it's life. The only attachment to my business will be that we use it as well & that it will be maintained by my staff." The site will get a phishing spam form added for public submissions before it goes live. Their phishing data sources include spamtraps and feeds from other organizations. Dave asked me to bring up this idea for some discussion and feedback, and he's on these lists so feel free to reply here. How do people feel about adding this data to a public SURBL? Does this kind of division of free and commercial uses seem ok? Would any of the SURBL public name servers have any issues with an arrangement like this? Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

4 11

Re: [SURBL-Discuss] Proposal to add some anti-phishing data to SURBL
by Doc Schneider 04 May '04

04 May '04

Jeff Chan <jeffc(a)surbl.org> wrote .. > On Tuesday, May 4, 2004, 2:03:11 AM, Raymond Dijkxhoorn wrote: > >> I think the intention was for our data to be integrated directly into > >> William's prior to arriving at nameservers, however Jeff is more likely > to > >> be able to confirm this :) > > > That would be perfect, saves the trouble of making a seperate list. > > > Would only be nice for example to give a specific code back, so people > see > > what the hit triggered... But thats possible, we only need to reserve > a > > code in that case. > > It's pretty certain we will want to do a combined list of at > least ws and sc. As an alternative to Bill merging a phishing > list into ws, we could add it to a combined list and *not* have > it as a small, separate list. (In other words it would obly > be available in a combined list.) If we do the latter we could > probably give it a unique result value. > > Either way is possible (i.e. merge into ws, or merge into a > combined list.): > > 1. Merge into ws: probably no specific code for phishing > 2. Merge into combined list: could have a separate code > 2a. (With no separate list for phishing if it's small.) > Jeff, I vote we make a new one called GonePhising.surbl.org 8*) I mean with all these Sasser and various M$ worms on the loose only makes send eh? -Doc (Da-Joker-Ninja) ps. Of course I wasn't being serious!!!!

1 0

[SURBL-Discuss] RE: NEWS: Metamark.net URI shortening and redirection service usi ng SURBL data to deny spammers
by Chris Santerre 03 May '04

03 May '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Saturday, May 01, 2004 12:58 AM >To: SURBL Announce >Cc: SpamAssassin Users; SpamAssassin Developers >Subject: NEWS: Metamark.net URI shortening and redirection >service using >SURBL data to deny spammers > http://www.surbl.org/news.html > >Ask Bjørn Hansen of develooper.com is using SURBL data to block >spammer domains in the Metamark Shorten(tm) Service URI shortening >and redirection service. This is the first use of SURBL data to >prevent abuse of a redirection site that we've heard of! Great >going! CONGRATS!! Forward progress always feels good! --Chris

1 0

RE: [SURBL-Discuss] This ROCKS!
by Chris Santerre 03 May '04

03 May '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Friday, April 30, 2004 9:13 PM >To: Chris Santerre >Cc: 'SURBL Discussion list'; SpamAssassin-dev(a)incubator.apache.org >Subject: Re: [SURBL-Discuss] This ROCKS! > > >Chris Santerre <csanterre(a)MerchantsOverseas.com> writes: > >> Hey there guys! This was the crazy idea I was discussing >with Doc. I wished >> for a realtime form of DB or flat file to be updated >continuously on rule >> hits. No grepping thru logs or anything. Simply when an >email is sent thru >> SA, whatever rules hit, increase a counter in a db or flat >file for that >> rule. Seperate db or flat file for ham and spam. This gives >live stats on a >> system. No grep'n going on. Just a counter per rule. > >That might give you a good hit rate, but it won't give you an accurate >S/O number. Well if it counts spam and ham hits, then an S/O is but a division away ;) > >> This is to be used on some advanced rule writing we want to >work on. It also >> alows an admin to see what might not be worth keeping >around. Allowing them >> to remove poor performers and increase system speed. > >Sort of like http://www.pathname.com/~corpus/DETAILS.new ? Sort of. I didn't know you guys did that nightly. Very nice. I'm looking for a more localized process that doesn't require a run of anything. Having counters generated means just checking totals. And even if one didn't use the exact same rules as another, they could easily combine totals for the ones they do. However your method is more accurate. > >The corpora have to be sorted by humans to be accurate and runs need to >be synchronized so everyone tests the same rules so runs only happen >once a day, which is fast enough. > >We've been doing this for well over a year and it works great. If only >we had more active developers working on rules... I'm not quite sure how to take that last line. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin Charles Darwin

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss