Discuss

discuss@lists.surbl.org

1867 discussions

RE: [SURBL-Discuss] FP: SallyFoster-MUNGED.com
by Chris Santerre 01 Sep '04

01 Sep '04

>-----Original Message----- >From: Rob McEwen [mailto:rob@powerviewsystems.com] >Sent: Wednesday, September 01, 2004 8:41 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] FP: SallyFoster-MUNGED.com > > >FP: SallyFoster-MUNGED.com > >1. Zero NANAS hits >2. domain registered in 1997 >3. very popular fundraiser for school & other organizations (they sell >wrapping paper) > >As a matter of fact, I found this by actually attempting to >send a relative >an e-mail about my own child's school fundraiser. I'm >horrified. I don't >even audit my client's SURBL-blocked mail... perhaps I should now? > >I don't know if they do illegal harvesting or not. I'm >guessing not because >I'd think they would get some NANAS hits if they did. Many of >their e-mails >go out via a parent keying in their friends & family's e-mail >address on the >SallyFoster-MUNGED.com site. I could see how some of these friends or >relatives might not read the resulting message carefully and >automatically >report it as spam :) Therefore, I think that this domain should be >whitelisted, or it probably WILL get relisted for the wrong >reasons, as you >can see. > Agreed, they seem clean on my end as well. --Chris

2 1

Re: [SURBL-Discuss] To MUNGE to not to MUNGE
by Rob McEwen 01 Sep '04

01 Sep '04

>It doesn't work that way. The whitelist means we dont add THOSE domains to >the SURBLs, other domains listed in those mails will still trigger the >SURBL filtering. First, I'm referring to a person's LOCAL whitelisting of SURBL list messages so that these messages bypass all filtering in order to allow SURBL-blocked domains to not stop the SURBL list message. In this scenario, SURBL-filtering could possibly be totally bypassed if the message contained "lists.surbl.org", ... thus creating a loophole for spammers who might try to use this as a tactic for their spam to also bypass the filter. However, my question was probably a silly question to begin with because (as I realized when reading other's messages) the actual IP address of the surbl list server could also be factored into the local whitelisting so that such potentially shrewd tactics of spammers I mentioned above could be defeated. Follow? Rob McEwen

2 1

Re: [SURBL-Discuss] To MUNGE to not to MUNGE
by Rob McEwen 01 Sep '04

01 Sep '04

> Can you explain what you mean? Dont get it i am afraid. All the surbl > domains are whitelisted, but that was not your question i guess? I simply meant, what happens if a spammer tries to sneak various references to surbl in the e-mail (separate from their actual affiliate link, of course) as a means of trying to get whitelisted, thus defeating our whitelisting? ...but, as I said, maybe I'm too paranoid here :) > Sometimes it takes time to find out the how and the what, be happy we are > still responsive ;) Please also note, a whitelist request isnt a guarantee > that it will indeed be whitelisted... Sorry... I didn't mean to sound impatient. Chris weighed in agreeing that it probably should be whitelisted (see archive). I was thinking that when one of the "main players" (Jeff, Raymond, Chris, Joe, etc.) agrees without other disagreements... it was practically considered done. But, again, I don't mean to sound impatient... I just wanted to make sure that SallyFoster-MUNGED.com wasn't going to be missed. Thanks, Rob McEwen

2 1

RE: [SURBL-Discuss] To MUNGE to not to MUNGE
by Chris Santerre 01 Sep '04

01 Sep '04

>-----Original Message----- >From: Ryan Thompson [mailto:ryan@sasknow.com] >Sent: Wednesday, September 01, 2004 9:38 AM >To: SURBL Discussion list >Subject: [SURBL-Discuss] To MUNGE to not to MUNGE > > *snip* > >I see no reason to MUNGE domains posted to this list. Unless >someone has >some really compelling evidence to the contrary, could we please curb >this silly practice before it really becomes a silly collective habit? >:-) I agree --Chris_MUNGED_Santerre :p >

4 4

FP: SallyFoster-MUNGED.com
by Rob McEwen 01 Sep '04

01 Sep '04

FP: SallyFoster-MUNGED.com 1. Zero NANAS hits 2. domain registered in 1997 3. very popular fundraiser for school & other organizations (they sell wrapping paper) As a matter of fact, I found this by actually attempting to send a relative an e-mail about my own child's school fundraiser. I'm horrified. I don't even audit my client's SURBL-blocked mail... perhaps I should now? I don't know if they do illegal harvesting or not. I'm guessing not because I'd think they would get some NANAS hits if they did. Many of their e-mails go out via a parent keying in their friends & family's e-mail address on the SallyFoster-MUNGED.com site. I could see how some of these friends or relatives might not read the resulting message carefully and automatically report it as spam :) Therefore, I think that this domain should be whitelisted, or it probably WILL get relisted for the wrong reasons, as you can see. Rob McEwen

1 0

[SURBL-Discuss] IN the interest in a bigger SA score and fewer FPs.....
by Chris Santerre 31 Aug '04

31 Aug '04

I have removed a rather large group of domains from WS. Time and time again FPs came from this rather large set of data from July. Since we have improved our contributor methods and numbers, I decided to yank them. If they continue to spam, they would just be readded by us anyway. So you might see a slight decrease in file size. And a few more slipping thru we will have to add again. But this will reduce overall FPs. --Chris (Did you know you can get dominoes to deliver to a parking lot at 1 AM!)

3 2

FP
by Chris Santerre 31 Aug '04

31 Aug '04

This was on the bottom of a legit email to a co worker. _______________________________________________ AsianAvenue.com free e-mail - www.asianavenue.com. Click into Asian America. Check out our Special Introductory Offer - E-mail Forwarding for just $5.95 per year! Powered by Outblaze Whitelist asianavenue.com or is it a spam site. Going to it looks fishy. But it is from outblaze, which is VERY antispam I think. --Chris

2 1

RE: [SURBL-Discuss] RFC: Public false positve reporting form
by Chris Santerre 31 Aug '04

31 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, August 30, 2004 7:33 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] RFC: Public false positve reporting form > > >How does anyone feel about a public false positive reporting >form? Such a form would include the reporting party, the >domain(s) or IPs, reasons why it's a false positive, etc. > I think the public needs a way to report FP, to be listed, and greylist domains. However, only if more then one person can work on these. ;) >It could be processed publically or privately in a bug >tracking system. It would be hand checked by some of our >experienced spam fighters. The results could be published >or simply aggregated without public announcement into the >overall whitelist. > >Is this a good or bad idea? good >What level of publication should there be? Answers to none. They give, we take info. Too time consuming to answer all. > >What forms of proof (if any) does anyone like? spam with headers. The rest is up to us. > >Other comments? Who was the first nut ever to think up pole vaulting? "Hey Jim, see that there bush? I bet if I run fast enough with this here flagpole......." --Chris

2 1

FP on WS
by Bill Landry 31 Aug '04

31 Aug '04

Okay, here we go again... ;-) ===== Domain, proflowers.MUNGEDcom is listed on WS. ===== ===== Sending IP listed on two aggressive RBLs, otherwise looks clean: http://www.dnsstuff.com/tools/ip4r.ch?ip=198.31.62.30 ===== ===== Domain, proflowers.com, registered through Network Solutions and domain registered in early 1998: Record created on 04-Feb-1998 ===== ===== Address space owned by Level 3: [whois.arin.net] Level 3 Communications, Inc. LVLT-ORG-198-31 (NET-198-31-0-0-1) 198.31.0.0 - 198.31.255.255 Subnet delegated to: Double Click DOUBLECLICK7-62-28 (NET-198-31-62-0-1) 198.31.62.0 - 198.31.63.255 RegDate: 2003-03-28 ===== ===== No NANAS listings: References: [ Proflowers: 0 ] ===== Anything else needed for this one? :-\ Bill

5 7

Re: [SURBL-Discuss] FP on WS
by Rob McEwen 30 Aug '04

30 Aug '04

> Domain, proflowers.MUNGEDcom is listed on WS. Thanks Bill for your good work. I hope this gets removed fast. I've heard Jeff ask in the past, "hey, what caused this to get on in the first place?" ...well, even though I often lean towards the aggressive side of the arguments, it seems like FPs like this one really are getting on SURBL too often. Therefore, I hope that Jeff or someone can find and correct the source of these particularly egregious types of FPs soon. Rob McEwen

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss