Discuss

discuss@lists.surbl.org

1867 discussions

[SURBL-Discuss] RE: ANNOUNCE: How to report false positives in ph anti-phishing l ist to MailSecurity
by Chris Santerre 28 Jul '04

28 Jul '04

In general the only way to report one for Blacklisting for WS is to go to http://www.rulesemporium.com/cgi-bin/uribl.cgi do a lookup, if not in WS there is a report button that shows up. Placing a copy of the spam will get it listed MUCH faster, then if you don't. These are always hand checked. As for MailSecurity reporting, nothing yet. --Chris >-----Original Message----- >From: Rakesh [mailto:rakesh@netcore.co.in] >Sent: Wednesday, July 28, 2004 2:45 AM >To: Jeff Chan >Cc: SURBL Announce; SpamAssassin Users >Subject: Re: ANNOUNCE: How to report false positives in ph >anti-phishing >list to MailSecurity > > >And where to report domains to be blacklisted ? > >Jeff Chan wrote: > >>We've updated the SURBL Lists document to add information about >>how to contact MailSecurity with reports about false positives in >>ph, the anti-phishing list included (only) in multi.surbl.org: >> >> http://www.surbl.org/lists.html#ph >> >>"Please report false positives on the ph list to: postmaster >> at corp.mailsecurity.net.au. Be sure to include supporting >> reasons explaining why the domain should not be listed." >> >>Jeff C. >> >> > >

1 0

Re: RE: [SURBL-Discuss] Phone Number Spam
by Rob McEwen 28 Jul '04

28 Jul '04

Matt, I'll gather a list over the next week or so and I'll send them to you. Then, I'll try to send them as I get them. You are correct in that these types of spam are rare. But they do expose a weakness in the system and they are more noticeable now that so much else is blocked. On the other hand, it has to take guts for a spammer to expose something so traceable as a phone number within an obvious spam message. You'd think that fear of prosecution from authorities and/or harassment from vigilantes would be enough of a deterrent. Thanks, Rob McEwen

1 0

Re: RE: [SURBL-Discuss] Phone Number Spam
by Rob McEwen 28 Jul '04

28 Jul '04

Bret: That is exactly what I'm talking about. Only, that list seems small and I wonder if there is a good system in place to submit phone numbers and to get these spam phone #s listed within hours instead of days. Also, is there another similar list somewhere else? Rob McEwen PowerView Systems rob(a)pvsys.com (478) 475-9032

2 1

Phone Number Spam
by Rob McEwen 28 Jul '04

28 Jul '04

RE: Phone Number Spam Have ya'll see the phone number spam which makes it through SURBL because they don't have an offending URL? I was wondering, is there a clearinghouse for this? It would be great if these phone numbers could also be reported and a list of recent hits could be downloaded for inclusion into heuristic filtering scripts or rules (etc). Rob McEwen

2 1

RE: [SURBL-Discuss] FPs - cooler email dot com and icebase dot co m
by Chris Santerre 28 Jul '04

28 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, July 27, 2004 5:35 PM >To: SURBL Discussion List >Subject: Re: [SURBL-Discuss] FPs - cooler email dot com and icebase dot >com > > >On Tuesday, July 27, 2004, 7:53:50 AM, Steven Champeon wrote: >> Both of these are associated with Strong Week, a legit >"what's going on" >> newsletter received by one of my users here. > >I see cooleremail dot com and icebase dot com on ws.surbl.org and >have whitelisted them in SURBLs. We should ask Chris or Bill to >see why they are getting onto ws and try to correct that. > >Jeff C. > I reported these on the 23rd. But.....what the....? How come everytime I go back and look at these I say to myself, this shouldn't have been added? I checked these buy hand, but there doesn't apear to be sufficient data to support being listed for either. It appears that these were submissions from the web report. And the actuall emails Looked VERY spammy. Which is why they got listed. And it could have been a spam run that they dump the customer. Could....but maybe not. I say remove them both for now, and watch them. NANAS would have me think they are not spammers. But they *may* get fooled byt heir own customers every now and then. I will remove from submisions. --Chris

1 0

Re: [SURBL-Discuss] Death By DNS
by Rob McEwen 28 Jul '04

28 Jul '04

sm said: > If the DNS server is slow, it will cause problems. If you are going to use > DNS based blacklists, you should have a reliable DNS server. While I generally agree with this statement, I would add that that reliability and speed are not always a "yes/no", or "good/bad" thing. There are some grey areas or varying degrees of responsiveness and speed and, definitely, using blacklists in the way that SURBL does puts a new level of burden or stress on DNS servers. For example, if a DNS server is generally good, but does have a 12 millisecond response time (using an arbitrary number) due to being shared among dozens (or hundreds) of other servers, this 12 milliseconds gets multiplied out when a dozen SURBL lookups hit at practically the same instant. In this case, the message is dependent on ALL of these requests being answered before the message can continue. This can also cause the mail server to have to work more threads at any one given time... which can lead to additional scalability and performance issues. Therefore, many DNS server situations which are more than adequate for regular situations may not be adequte for SURBL lookups. Rob McEwen

4 4

I figured it out!!!!
by David Groce 28 Jul '04

28 Jul '04

Man do I feel dumb. The day before I decided to tackle the CPAN install of Spamassassin, I had downloaded a rule from exit0.us (BodyRules.cf) it was an odd download since the page that displays it was a PHP page, so I went through and cleaned out all the extra html, but apparently didn't do a very good job. So I added the rules I had been using one by one and running spamassassin --lint to find out what was breaking it, and sure enough the error: > Scalar found where operator expected at (eval 17) line 686, near "} $self" > (Missing operator before $self?) > Failed to run header SpamAssassin tests, skipping some: syntax error at > (eval 17) line 686, near "} $self" was coming from the BodyRules.cf file. I have also updated my LWP through cpan and I get no errors, so I'm off to test my maildroprc file to see if I can get this mail server back into shape. I appreciate all the help. David Groce CCNA Network Server Analyst/Coordinator North Kitsap School District (360) 394-2621 dgroce(a)nksd.wednet.edu

1 0

FPs - getty images dot com and moz dev dot org
by Steven Champeon 28 Jul '04

28 Jul '04

Guys, why is getty images dot com listed in SURBL? Or moz dev dot org? -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/

3 6

FP: cmp events dot com
by Steven Champeon 27 Jul '04

27 Jul '04

Did something change over the past couple days? I'm getting 3-5 FPs a day off multi. -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/

2 2

FPs - cooler email dot com and icebase dot com
by Steven Champeon 27 Jul '04

27 Jul '04

Both of these are associated with Strong Week, a legit "what's going on" newsletter received by one of my users here. -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss