Discuss

discuss@lists.surbl.org

1 participants
1864 discussions

OB FPs
by Alex Broens 30 Sep '04

30 Sep '04

While I always read how reliable OB should be, of the few WL requests I've triggered, all except 1 were from OB. These were pretty ugly ones indeed, an Adobe child site, a Genuine abused Webmail site, etc, etc. juts wondering.... Alex

5 9

Please test: PailPolice fraud list, jp.surbl.org
by Jeff Chan 30 Sep '04

30 Sep '04

This is a request for folks to please test the MailPolice fraud list and jp.surbl.org: MailPolice Fraud list with SpamCopURI: uri MP_URI_RBL eval:check_spamcop_uri_rbl('fraud.rhs.mailpolice.com','127.0.0.2') describe MP_URI_RBL URI's domain appears in MailPolice fraud list tflags MP_URI_RBL net score MP_URI_RBL 3.0 And for SA 3.0 with the URIDNSBL plug-in: urirhsbl URIBL_MP fraud.rhs.mailpolice.com. A header URIBL_MP eval:check_uridnsbl('URIBL_MP') describe URIBL_MP URI's domain appears in MailPolice fraud list tflags URIBL_MP net score URIBL_MP 3.0 (Note that the above is a separate, external list, so it can't be used like multi.) JP SA 2.63 and 2.64 rule and score using SpamCopURI 0.22 or later: uri JP_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0+64') describe JP_URI_RBL URI's domain appears in JP at http://www.surbl.org/lists.html tflags JP_URI_RBL net score JP_URI_RBL 4.0 JP SA 3.0 rule and score using URIBL's urirhssub: urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 header URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') describe URIBL_JP_SURBL Contains a URL listed in JP at http://www.surbl.org/lists.html tflags URIBL_JP_SURBL net score URIBL_JP_SURBL 4.0 In particular we'd like to hear about any false positives on either list. If the MailPolice fraud data looks good, we'll add it to PH, but we need your help in testing it. You can test these on hand selected test corpora or live mail, but please try not to melt the MailPolice name servers. ;-) Please give these a try and let us know what you find. Note that you'll probably want to remove the MailPolice fraud list after testing as a separate list if we add it to PH. Jeff C. -- "If it appears in hams, then don't list it."

2 3

RE: [SURBL-Discuss] FP in OB g4techtv .com
by Chris Santerre 30 Sep '04

30 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, September 29, 2004 12:32 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] FP in OB g4techtv .com > > >On Wednesday, September 29, 2004, 9:15:56 AM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>On Wednesday, September 29, 2004, 7:58:16 AM, Chris Santerre wrote: >>>> 2.0 URIBL_OB_SURBL Contains an URL listed in the OB >>>SURBL blocklist >>>> [URIs: g4techtv .com] >>> >>>> Ahhhhhhh my game news!!!!!! >>> >>>> --Chris >>> >>>I heard they spam... ;-) >>> >>>Whitelist them with documentation. > >> But it is on OB list, I thought I could only whitelist for WS? > >The SURBL whitelist applies to all SURBLs. > >Jeff C. >-- Done deal. --Chris (I hold in my hand, the first Hot Chocolate of the season!)

2 1

Re: [SURBL-Announce] ANNOUNCE: New JP list is now part of multi.surbl.org
by Mariano Absatz 30 Sep '04

30 Sep '04

On Mon, 27 Sep 2004 16:24:00 -0700, Jeff Chan <jeffc(a)surbl.org> wrote: > JP is now active as part of multi. Please give it a try. We > think you'll like the results. :-) > __ > > http://www.surbl.org/quickstart.html > > jp - jwSpamSpy + Prolocation data source > > Joe Wein's jwSpamSpy program is used both by Joe's own systems > and also Raymond Dijkxhoorn and his colleagues at Prolocation to > process more than 300,000 likely spams per day. The resulting > list has a very good spam detection rate around 80% and a very > low false positive rate below 0.02%. This data is only available > in the combined list multi.surbl.org. > > An SA 2.63 and 2.64 rule and score using SpamCopURI 0.22 or later > looks like this: > > uri JP_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0+64') > describe JP_URI_RBL URI's domain appears in JP at http://www.surbl.org/lists.html > tflags JP_URI_RBL net > > score JP_URI_RBL 4.0 > > An SA 3.0 rule and score using URIBL's urirhssub looks like this: > > urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 > header URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') > describe URIBL_JP_SURBL Contains a URL listed in JP at http://www.surbl.org/lists.html > tflags URIBL_JP_SURBL net > > score URIBL_JP_SURBL 4.0 > __ > > Note that JP is not available as a separate list, only as part of > multi.surbl.org. Use it with urirhssub or SpamCopURI 0.22 as > described above. Please see the lists document mentioned in the > description for more information about JP. > If I understand this right, ws still has jp data, even within multi, is it? That is, if I want to score the rest of ws at 1.3 and jp at 4.0, I should set jp's score at 2.7, right? -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com

2 1

RE: [SURBL-Discuss] Spammer threatening to suesingle4y ou.net
by Tim A 29 Sep '04

29 Sep '04

Are there a SURBL clan in JO?? Where do I find them :) > -----Original Message----- > From: Chris Santerre <csanterre(a)merchantsoverseas.com> > Date: Tue, 28 Sep 2004 10:04:43 -0400 > Subject: RE: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to > suesingle4y ou.net > To: Jeff Chan <jeffc(a)surbl.org>, SURBL Discussion list <discuss(a)lists.surbl.org> > > > > >-----Original Message----- > >From: Jeff Chan [mailto:jeffc@surbl.org] > >Sent: Tuesday, September 28, 2004 9:45 AM > >To: SURBL Discuss > >Subject: Re: [SPAM-TAG] [SURBL-Discuss] Spammer threatening to > >suesingle4y ou.net > > > > > >On Tuesday, September 28, 2004, 6:43:09 AM, Chris Santerre wrote: > >> The only basis we still have is this guys word that he is > >legit. Are we > >> going to whitelist everyone who simply asks to be > >whitelisted? Yes or No? > > > >No. > > Oh, now your taking the fun out of arguing with you ;) > > Did you break your JO cd? DOn't see ya playing much. > > --Chris (I need cover fire on the bridge!!!) > > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] Help classify quickinspirations.com
by Chris Santerre 29 Sep '04

29 Sep '04

>-----Original Message----- >From: Patrik Nilsson [mailto:patrik@patrik.com] >Sent: Wednesday, September 29, 2004 3:59 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Help classify quickinspirations.com > > >At 15:11 2004-09-29 -0400, Chris Santerre wrote: >>quickinspirations.com >>Thoughts on this guy? 48 NANAS hits. Listed in dnsbl.njabl.org > >As well as in: >http://spews.org/html/S1436.html > >>Didn't we already classify this? > >I can find a whitelisting email from Jeff, but not the original >whitelisting request. Seems to be lost in my archives. > >>I wonder if we can get a crossref lookup of >>the global whitelist, so we can see what has already been whitelisted. >> >>I belive this is a spammer in sheeps clothing. But it fools >people into >>signing up for a stupid inspiration newsletter. But the >subjects of the >>newsletter are stuff like: >>Subject: Get a Credit Report Instantly! >>Then a inspiration quote, then a big ad. I think we may see >more of this in >>the future. >>I think it is a UC candidate. Do we have enough listed in UC >for testing >>yet? > >I think it's a surbl candidate. >Why was it whitelisted? >Any actual examples of it showing up in real ham, rather than only in >"fooled into signing up for" spam? > Did you just create a new term? "Fisuf Spam" Works for me! I think I had a "discussion" about this domain with Jeff before. Which is why I rang a bell. I think this may be one of the ones that started the whole UC debate. Hmmm.... could more Fisuf Spam be around the corner? --Chris

1 0

Re: [SURBL-Discuss] Help classify quickinspirations.com
by Patrik Nilsson 29 Sep '04

29 Sep '04

At 15:11 2004-09-29 -0400, Chris Santerre wrote: >quickinspirations.com >Thoughts on this guy? 48 NANAS hits. Listed in dnsbl.njabl.org As well as in: http://spews.org/html/S1436.html >Didn't we already classify this? I can find a whitelisting email from Jeff, but not the original whitelisting request. Seems to be lost in my archives. >I wonder if we can get a crossref lookup of >the global whitelist, so we can see what has already been whitelisted. > >I belive this is a spammer in sheeps clothing. But it fools people into >signing up for a stupid inspiration newsletter. But the subjects of the >newsletter are stuff like: >Subject: Get a Credit Report Instantly! >Then a inspiration quote, then a big ad. I think we may see more of this in >the future. >I think it is a UC candidate. Do we have enough listed in UC for testing >yet? I think it's a surbl candidate. Why was it whitelisted? Any actual examples of it showing up in real ham, rather than only in "fooled into signing up for" spam? Patrik

1 0

Re: [SURBL-Announce] ANNOUNCE: ccTLDs in two-level-tlds file updated somewhat
by Leonardo Helman 29 Sep '04

29 Sep '04

Hi, don't forget: gov.ar (government) mil.ar (armed forces) edu.ar (universities and university-related research groups) esc.edu.ar (elementary schools, high schools and other (non-universitary educational institutions). uba.ar (Buenos Aires University) educ.ar There was a thread on this list started by Mariano Absatz on Fri, 18 Jun 2004 10:41:30 On Sun, Sep 26, 2004 at 09:22:23PM -0700, Jeff Chan wrote: > On Saturday, September 18, 2004, 11:58:56 PM, Frank Ellermann wrote: > > [Konqueror list] > >>> | name,ai,au,bd,bh,ck,eg,et,fk,il,in,kh,kr,mk,mt,na, > >>> | np,nz,pg,pk,qa,sa,sb,sg,sv,ua,ug,uk,uy,vn,za,zw > > I have updated the ccTLDs for the ones Frank mentioned, > removed some duplicates, and added some data for a few > other ccTLDs. The results are in: > > http://spamcheck.freeapp.net/two-level-tlds > > Really this is just for completeness since geographic > domains other than .us aren't used in spams too often. > > Jeff C. > -- > "If it appears in hams, then don't list it." > > _______________________________________________ > Announce mailing list > Announce(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/announce

4 5

RE: [SURBL-Discuss] FP in OB g4techtv .com
by Chris Santerre 29 Sep '04

29 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, September 29, 2004 11:09 AM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] FP in OB g4techtv .com > > >On Wednesday, September 29, 2004, 7:58:16 AM, Chris Santerre wrote: >> 2.0 URIBL_OB_SURBL Contains an URL listed in the OB >SURBL blocklist >> [URIs: g4techtv .com] > >> Ahhhhhhh my game news!!!!!! > >> --Chris > >I heard they spam... ;-) > >Whitelist them with documentation. > But it is on OB list, I thought I could only whitelist for WS? --Chris "If it appears in spam, do not whitelist."

3 2

RE: [SURBL-Discuss] FP in OB g4techtv .com
by Chris Santerre 29 Sep '04

29 Sep '04

>-----Original Message----- >From: Fred [mailto:tech2@i-is.com] >Sent: Wednesday, September 29, 2004 1:35 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] FP in OB g4techtv .com > > >Jeff Chan wrote: >> I heard they spam... ;-) >> >> Whitelist them with documentation. >> >> Jeff C. > >They were bought by Comcast and we know how much they care about spam.. >Maybe things have changed recently, in the past we were being >attacked by a >different customer daily. > >I want LEO back and I'm still mad at TechTV for taking off the >shows they >did. I say keep them listed ;) > > >If they bring back Leo then we can whitelist them :) I grew >up watching Leo >teach people about computers now I do it myself, but I still miss him! > I agree! X-Play seems lost. Sweat and Players are stupid shows. Bring back Leo!! --Chris (Burnout 3 is hurting my thumbs!)

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss