Discuss

discuss@lists.surbl.org

1862 discussions

RE: [SURBL-Discuss] RE: (1) Another Possible FP, and (2) header p arsing issues
by Chris Santerre 12 Aug '04

12 Aug '04

>-----Original Message----- >From: Rob McEwen [mailto:rob@pvsys.com] >Sent: Thursday, August 12, 2004 12:17 PM >To: 'Chris Santerre'; 'SURBL Discussion list' >Subject: RE: [SURBL-Discuss] RE: (1) Another Possible FP, and >(2) header >parsing issues >Importance: High > > >Chris said: > >>I'm confused. (Theres a first!) SURBL only >>check the body for URLs. How did the message-ID get hit? > >Its simply an issue where someone's implementation of SURBL >provided the >option of extracting domains out of either (1) the header, >and/or (2) the >client's IP address, and/or (3) the body of the e-mail. Any >combination was >possible/configurable. The "default" setting was to use all three. > >The following is the software package that I am using for >SURBL filtering: > >http://www.2150.com/regexfilter/ > >I chose this because it works well with my Merak IceWarp >webmail software I >have running on Windows 2000 server. > >The guy who wrote this is very smart. Because he uses the >filter for himself >and didn't have to worry about "clients", he was very >aggressive with his >default settings both for SURBL and for other linguistic aspects of his >filter. Just about everyone using it has had to contend with having to >"loosen" it in a number of ways to prevent false positives for their >clients... but this was a small price to pay for a well >designed and FREE >software package. > Ah now I see. I would strongly say to NOT use SURBL on headers. Too many faked headers. --Chris (Beer me!)

2 1

[SURBL-Discuss] RE: (1) Another Possible FP, and (2) header parsing issues
by Rob McEwen 12 Aug '04

12 Aug '04

I have a two-part question: (1) header parsing issues... I was reading a web site discussing an implementation of SURBL on the IceWarp web server (using a third party add-on). One person complained that there are too many false positives when submitting IPs and domains found in the header of the e-mail. They felt like ONLY the body of the message should be examined. I see good arguments both ways. For example, parsing the header can catch spam which was originally sent to one place, but then forwarded to another. On the other hand, actual affiliate URLs would only normally occur in the body of the message. Any thoughts or suggestions? (2) Another Possible FP... This person was asked to give an example of a message which shouldn't have been blocked and which would have gone through if the header wasn't parsed. They provided an example which had the following line in the header: Message-ID: <000b01c47f1a$e02f73e0$0200a8c0(a)MUNGED-callatg.com> The offending domain was MUNGED-callatg.com Therefore, I must ask, could MUNGED-callatg.com be a FP? The reason I suspect so is because they mentioned that this company is a division of GE. Please check on this. Rob McEwen

2 1

fp whitelisted: callatg.com, others
by Jeff Chan 12 Aug '04

12 Aug '04

I've whitelisted: atgi.net callatg.com advancedtelcom.com All of which belong to the same legitimate company. They make telephone switch hardware, etc. and I knew someone who worked there. callatg.com was on ws. Bill can you see how it got on? Jeff C.

1 0

Re: Message Not Getting to the SURBL List
by Jeff Chan 12 Aug '04

12 Aug '04

On Thursday, August 12, 2004, 7:27:06 AM, Rob McEwen wrote: > Jeff, > The enclosed message is not getting to the list (See attached). If this is > due to a normal delay, please disregard this message. > Thanks, > Rob McEwen I can't see your message getting out. Maybe I can ask you to gateway this back to them: SURBLs should be used on message body URIs, not message headers. Though I can see some of the reasons for wanting to try on headers, they're really meant for URIs. I've whitelisted: atgi.net callatg.com advancedtelcom.com All of which belong to the same legitimate company. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

RE: [SURBL-Discuss] Possible fps
by Chris Santerre 12 Aug '04

12 Aug '04

>-----Original Message----- >From: William Stearns [mailto:wstearns@pobox.com] >Sent: Thursday, August 12, 2004 10:54 AM >To: SURBL Discussion list >Cc: 'Jeff Chan'; Chris Santerre; William Stearns >Subject: RE: [SURBL-Discuss] Possible fps > > >Good morning, Chris, > >On Thu, 12 Aug 2004, Chris Santerre wrote: > >> I would like to hand check these. We should split the list >up. I volunteer >> to check A-H on the list. I'll check them this afternoon. > > I've done A-L. The problem is, without actual spam or >ham emails, >a lot of these can't be added to either white or black lists. > Chris, could you do M-Z, and whitelist the domains that are >certain to be FP's, and not do anything about the rest? > Cheers, > - Bill > Sure thing! M-Z is for me ;) --Chris

1 0

RE: [SURBL-Discuss] Possible fps
by Chris Santerre 12 Aug '04

12 Aug '04

I would like to hand check these. We should split the list up. I volunteer to check A-H on the list. I'll check them this afternoon. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, August 12, 2004 3:59 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] Possible fps > > >Here is a list of 130 domains that come from messages have been >manually marked as "not spam" at a large but deliberately unnamed >mail provider. We may want to consider whitelisting these. > >Here's a summary of matches against the lists, with some overlap: > >list count: 130 > >ws: 77 >ob: 54 >ab: 2 >ph: 4 >sc: 0 > >activismispatriotism.org >anwod.com >anyxhost.com >appleseedsacks.com >aramova.com >asexstoryforyou.com >asianangels.com >autumntiger.com >b33r.us >barnstablepatriot.com >bigbigsavings.com >bl4h.net >cashspiders.info >casinovendors.com >challengerone.com >cherryinc.com >chinese960.com >cllgeprgamsonlne.biz >cmaya.com >cn4e.com >conception766pi11.us >condominiums.tk >coolerfix.com >courrielleur.com >dakotacom.net >easysitelaunch.com >eletricjoy-bz.com >eletricjoy-hm.com >emailministry.org >findbrooke.com >fivecentclicks.com >freepornofreeporn.com >gaingreenbacks.com >gayartworks.org >geileheissemaus.com >getuni.com >golady.com >goldnow.st >grmushkinsexxx.com >healthinsurancesavings.com >heightmax.com >hottigotti.com >humaniststudies.org >hunt4stuff.com >iasurvey.org >indiapakistanpeace.org >kehuidao.com >kimberlygordon.biz >lavahelp.net >lenovo2008.com >letnaderdebate.org >livingmath.net >lowratesource.com >lvalite.com >magicpages.biz >manchuriangame.com >marketingdealtime.com >marketmysite.com >maybeyes.biz >megacockcravers.com >mellamed.com >memri.org.il >messagizer.de >micropoint.biz >misshaped982twisty.com >monarchhs.com >mtnonline.com >mxincome.com >myebay-secure.net >mypharmanex.com >nameauditors.com >newsenterpriseonline.com >nexuswebs.net >niceshemale.net >numbersusa.com >onlneductnprgms.biz >onlywantsex.net >ourpictures.com >outplan.com.br >ownsthis.com >paidbymouse.com >pcdepot.co.il >pdgexchanger.com >pdginventory.com >peoplejudgebush.org >peterforflorida.com >philosc.com >pksnetwork.com >plainfunxe.com >politicalbrew.com >qerhj.com >recyclemycell.com >rxmedaid.com >sandicarismasport.com >santosdiablos.com >savedarfur.org >scotclayton.org >scottrader.com >securybanks.net >smileycons.com >soroacaba.us >spaceports.com >spamusement.com >stayandorplay.com >tastingsjournal.com >thundercloud.net >topvaluenow.com >totallyamateurs.com >trickortranny.com >ultraqualityforyou.com >unitedemailsystems.com >usabusiness1.com >utadaexodus.com >utopiafootball.com >vetomail.com >vherb.idv.tw >webmasterlose.de >webmldlz.com >widomaker.com >worldjobs.us >wz-bbs.com >xfhotel.net >xfjob.net >xfsale.net >xfte.net >xuevsdes.net >yourdomainhere.com >youthbuy.net >ysmtrucker.com >zdrux.com > >Jeff C. >-- >Jeff Chan >mailto:jeffc@surbl.org >http://www.surbl.org/ > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

RE: [SURBL-Discuss] Re: another round on the SpamAssassin logos?
by Chris Santerre 12 Aug '04

12 Aug '04

Um....I know we are going to do this logo contest for SARE....so.....SURBL? >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, August 12, 2004 6:01 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] Re: another round on the SpamAssassin logos? > > >FWIW I think the arrow one is by far the best. Professional, >pretty, meaningful, etc... I like the one with only the >orange message being hit the best. > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

RE: Another Possible FP and header parsing issues
by Rob McEwen 12 Aug '04

12 Aug '04

1 0

Re: another round on the SpamAssassin logos?
by Jeff Chan 12 Aug '04

12 Aug '04

FWIW I think the arrow one is by far the best. Professional, pretty, meaningful, etc... I like the one with only the orange message being hit the best. Jeff C.

1 0

Whitelisting allthesites.org
by Jeff Chan 12 Aug '04

12 Aug '04

I'm whitelisting allthesites.org which appears in WS and may be a false positive. Would the WS folks please check it and also remove if appropriate. It looks to be a domain that has appeared in a few spam headers, meaning it's an occasional spam sending domain. Thanks, Jeff C.

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss