Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

Re: Bug in Spamcop's surbl add-on module
by Jeff Chan 05 May '04

05 May '04

On Wednesday, May 5, 2004, 5:18:04 AM, Keith Hackworth wrote: > I was installing > a new mail server and testing the surbl lookups, but my test kept > getting through not being marked as spam. The test I was using was > http://e.1asphost.com - this is on the be.surbl.org list. ... > My logs show that the > system is looking up 1asphost.com, which is NOT on the list. For some > reason, it stripped off the "e." > It seems that spamcop's surbl doesn't handle subdomains at all. Anyone > else seeing this? Hmm, it is indeed in BigEvil with the e. : bigevil.cf:uri BigEvilList_181 /\b(?:extreme-rapes\.com|excaliburproducts\.c om|evansezmoney\.estarnetwork\.com|enjoyadvanced097\.org|emedorders\.com|email\. homemadesimple\.com|ehostzzz\.net|e-g\.com|efreedomweb\.net|ecredibledeals\.com| echofrompeople\.com|e\.1asphost\.com)\b/i and it's therefore making it into be.surbl.org with the e. : bigevil.domains:e.1asphost.com However we should be taking off the subdomain before it goes into the SURBL form. I'll need to check with Chris on how we can handle that. BTW, SURBL is not a SpamCop project, although we are using SpamCop URI domains as a data source in the sc.surbl.org list. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

[SURBL-Discuss] Fwd: Re[2]: Proposal to add some anti-phishing data to SURBL
by Jeff Chan 05 May '04

05 May '04

This is a forwarded message From: Robert Menschel To: SpamAssassin Developers <spamassassin-dev(a)incubator.apache.org> Date: Tuesday, May 4, 2004, 7:06:25 PM Subject: Proposal to add some anti-phishing data to SURBL Tuesday, May 4, 2004, 9:42:14 AM, Marc wrote: MP> For what it is worth - I support it. I definitely want to block MP> exposure to fraud of my users. Agreed. The Phishing SURBL sounds like a good idea to me. I see no conflict with a company doing commercial work also offering a public service. Bob Menschel MP> Jeff Chan wrote: >>David Hooton of Platform Networks has been converting the >>proprietary SpamAssassin message content filtering rules of >>MailSecurity.net.au into SURBLs. The data's being organized into >>separate SURBLs, for example pharma, phishing, and other spams. >>In order to give something back to the SURBL/SA community and the >>Internet in general, he is proposing to make the phishing data >>freely available for potential inclusion by Bill Stearns in >>ws.surbl.org. ...

1 0

[SURBL-Discuss] Fwd: Re: Proposal to add some anti-phishing data to SURBL
by Jeff Chan 04 May '04

04 May '04

This is a forwarded message From: Marc Perkel Date: Tuesday, May 4, 2004, 9:42:14 AM Subject: Proposal to add some anti-phishing data to SURBL For what it is worth - I support it. I definitely want to block exposure to fraud of my users. Jeff Chan wrote: >David Hooton of Platform Networks has been converting the >proprietary SpamAssassin message content filtering rules of >MailSecurity.net.au into SURBLs. The data's being organized into >separate SURBLs, for example pharma, phishing, and other spams. >In order to give something back to the SURBL/SA community and the >Internet in general, he is proposing to make the phishing data >freely available

1 0

Proposal to add some anti-phishing data to SURBL
by Jeff Chan 04 May '04

04 May '04

David Hooton of Platform Networks has been converting the proprietary SpamAssassin message content filtering rules of MailSecurity.net.au into SURBLs. The data's being organized into separate SURBLs, for example pharma, phishing, and other spams. In order to give something back to the SURBL/SA community and the Internet in general, he is proposing to make the phishing data freely available for potential inclusion by Bill Stearns in ws.surbl.org. Access to the other lists would be sold commercially, but the phishing data would be a potentially useful spam/fraud/crime fighting tool to make available to everyone, while hopefully creating some recognition for their other lists. A preliminary web page describing the phishing list is at: http://www.mailsecurity.net.au/phish/ Dave describes the status of the phishing list as public in that: "We're going to release our phishing attack list publicly and it will remain that way for the duration of it's life. The only attachment to my business will be that we use it as well & that it will be maintained by my staff." The site will get a phishing spam form added for public submissions before it goes live. Their phishing data sources include spamtraps and feeds from other organizations. Dave asked me to bring up this idea for some discussion and feedback, and he's on these lists so feel free to reply here. How do people feel about adding this data to a public SURBL? Does this kind of division of free and commercial uses seem ok? Would any of the SURBL public name servers have any issues with an arrangement like this? Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

4 11

Re: [SURBL-Discuss] Proposal to add some anti-phishing data to SURBL
by Doc Schneider 04 May '04

04 May '04

Jeff Chan <jeffc(a)surbl.org> wrote .. > On Tuesday, May 4, 2004, 2:03:11 AM, Raymond Dijkxhoorn wrote: > >> I think the intention was for our data to be integrated directly into > >> William's prior to arriving at nameservers, however Jeff is more likely > to > >> be able to confirm this :) > > > That would be perfect, saves the trouble of making a seperate list. > > > Would only be nice for example to give a specific code back, so people > see > > what the hit triggered... But thats possible, we only need to reserve > a > > code in that case. > > It's pretty certain we will want to do a combined list of at > least ws and sc. As an alternative to Bill merging a phishing > list into ws, we could add it to a combined list and *not* have > it as a small, separate list. (In other words it would obly > be available in a combined list.) If we do the latter we could > probably give it a unique result value. > > Either way is possible (i.e. merge into ws, or merge into a > combined list.): > > 1. Merge into ws: probably no specific code for phishing > 2. Merge into combined list: could have a separate code > 2a. (With no separate list for phishing if it's small.) > Jeff, I vote we make a new one called GonePhising.surbl.org 8*) I mean with all these Sasser and various M$ worms on the loose only makes send eh? -Doc (Da-Joker-Ninja) ps. Of course I wasn't being serious!!!!

1 0

[SURBL-Discuss] RE: NEWS: Metamark.net URI shortening and redirection service usi ng SURBL data to deny spammers
by Chris Santerre 03 May '04

03 May '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Saturday, May 01, 2004 12:58 AM >To: SURBL Announce >Cc: SpamAssassin Users; SpamAssassin Developers >Subject: NEWS: Metamark.net URI shortening and redirection >service using >SURBL data to deny spammers > http://www.surbl.org/news.html > >Ask Bjørn Hansen of develooper.com is using SURBL data to block >spammer domains in the Metamark Shorten(tm) Service URI shortening >and redirection service. This is the first use of SURBL data to >prevent abuse of a redirection site that we've heard of! Great >going! CONGRATS!! Forward progress always feels good! --Chris

1 0

RE: [SURBL-Discuss] This ROCKS!
by Chris Santerre 03 May '04

03 May '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Friday, April 30, 2004 9:13 PM >To: Chris Santerre >Cc: 'SURBL Discussion list'; SpamAssassin-dev(a)incubator.apache.org >Subject: Re: [SURBL-Discuss] This ROCKS! > > >Chris Santerre <csanterre(a)MerchantsOverseas.com> writes: > >> Hey there guys! This was the crazy idea I was discussing >with Doc. I wished >> for a realtime form of DB or flat file to be updated >continuously on rule >> hits. No grepping thru logs or anything. Simply when an >email is sent thru >> SA, whatever rules hit, increase a counter in a db or flat >file for that >> rule. Seperate db or flat file for ham and spam. This gives >live stats on a >> system. No grep'n going on. Just a counter per rule. > >That might give you a good hit rate, but it won't give you an accurate >S/O number. Well if it counts spam and ham hits, then an S/O is but a division away ;) > >> This is to be used on some advanced rule writing we want to >work on. It also >> alows an admin to see what might not be worth keeping >around. Allowing them >> to remove poor performers and increase system speed. > >Sort of like http://www.pathname.com/~corpus/DETAILS.new ? Sort of. I didn't know you guys did that nightly. Very nice. I'm looking for a more localized process that doesn't require a run of anything. Having counters generated means just checking totals. And even if one didn't use the exact same rules as another, they could easily combine totals for the ones they do. However your method is more accurate. > >The corpora have to be sorted by humans to be accurate and runs need to >be synchronized so everyone tests the same rules so runs only happen >once a day, which is fast enough. > >We've been doing this for well over a year and it works great. If only >we had more active developers working on rules... I'm not quite sure how to take that last line. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin Charles Darwin

2 1

[SURBL-Discuss] Sendmail milter and SURBLs? sbl.spamhaus.org and SpamCopURI or urirhsbl?
by Jeff Chan 03 May '04

03 May '04

Saw a link on the Spamhaus site to a sendmail milter: http://www.five-ten-sg.com/dnsbl.html "This milter will also decode (base64, mime, html entity) and scan for HTTP and HTTPS URLs and bare hostnames in the body of the mail. If any of those host names have A records on the SBL (or a single configurable list), the mail will be rejected unless previously whitelisted." Seems to me that should be just as usable with SURBLs as the more limited spam body domain names in sbl.spamhaus.org. Has anyone tried this milter with SURBLs? Conversely has anyone tried sbl.spamhaus.org as a SURBL in SpamCopURI or urirhsbl? Either could be interesting.... Jeff C. Additionally: Installation and configuration Usage: Note that this has ONLY been tested on Linux, specifically RedHat Linux. In particular, this milter makes no attempt to understand IPv6. Your mileage will vary. You will need at a minimum a C++ compiler with a minimally thread safe STL implementation. The distribution includes a test.cpp program. If it fails this milter won't work. If it passes, this milter might work. Fetch dnsbl.tar.gz and tar xfvz dnsbl.tar.gz bash install.bash

2 2

Spamcop conflict of interest ?
by Simon Byrnand 02 May '04

02 May '04

Hmm....just noticed these comments in a recent slashdot article. Being slashdot it's hard to know whether to take it seriously or not ;-) http://yro.slashdot.org/comments.pl?sid=105978&cid=9022567 Regards, Simon

5 8

Re: better TLD handling
by Jeff Chan 02 May '04

02 May '04

On Friday, April 30, 2004, 7:12:10 PM, Justin Mason wrote: > ... is now in SpamAssassin SVN trunk. it uses quite a lot of data > from the SURBL list of TLDs and their subdomains, btw, thanks! ;) Hehe, I assumed *you* guys had the ccTLD magic bullet. ;-) Will check it out! (I hate to ask but is there any kind of direct URL access into SVN so I don't need to install the entire structure?) An open request to everyone: if you know of or can find any registrar lists of ccTLDs that are not already in our list: http://spamcheck.freeapp.net/two-level-tlds then please forward them to me for addition. I think we're lacking places like Deutschland .de and Italia .it, and probably some smaller ones also. N.B. found at http://www.denic.de/de/domains/index.html and added: moebel.de glueckwunsch.de buecher.de boerse.de kueche.de buero.de fluege.de kuechen.de aerzte.de reisebuero.de Surely there are many more. (Those look strange without Umlauten... :-) This is for country code TLDs which should themselves be whitelisted. Doing so allows us to check the third levels after them. Therefore we want: category.country but not domain.country where an abstract category is like doctors, a city name, etc. where a potential spammer would register at a lower level like spamming.doctor.be or spamming-subdomain.london.uk . We don't want to whitelist spammer.uk so please don't include registered base domains that terminate at the second level. TIA for any help with this, Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss