Discuss

discuss@lists.surbl.org

1876 discussions

[SURBL-Discuss] Re: [SURBL-Announce] ANNOUNCE: The SARE SURBL+ Checker v0.4
by Ralph Seichter 23 Apr '04

23 Apr '04

> [Linked from the surbl site also... -- Jeff C.] Ok Jeff, you caught me in the middle of a mail asking for this "lookup link", so where is the web cam you installed? ;-) -- Mit freundlichen Grüßen / Yours sincerely Dipl. Inform. Ralph Seichter HORUS-IT Ahornweg 10 D-57635 Oberirsen Tel +49 2686 987880 Fax +49 2686 987889 http://horus-it.de/

2 1

[SURBL-Discuss] Re: [SURBL-Announce] ANNOUNCE: Mail::SpamAsssassin::SpamCopURI 0.11
by Jeff Chan 23 Apr '04

23 Apr '04

On Tuesday, April 20, 2004, 10:51:55 PM, Eric Kolve wrote: > I have just released SpamCopURI version 0.11. This fixes a few > bugs that had been reported and adds open redirect resolution. > This basically takes a URL from say rd.yahoo.com and attempts > to resolve the Location header without ever fetching from > the potential spammy site. > Only the URLs that have hosts that match an address list get > redirect resolution. As well, redirect resolution is off > by default, but can be enabled in the conf file. I have > placed several open redirect sites in the conf file. > The basic requirement is that the redirect return a 300 > level HTTP response when fetching. I placed google.com > in there even though they don't have their own redirect > domain, but this should be fairly safe since most if not > all google URLs are either redirects or searches. Give > it a try and tell me what you think. This is all dependent > upon LWP, but if you don't have LWP everything else > will function as it did before. Eric, you may want to share your redirection resolution strategies with the 3.0 developers. I haven't heard Justin getting beyond patterns yet. ;-) Jeff C.

3 5

RE: [SURBL-Discuss] How effective is SURBL?
by Chris Santerre 23 Apr '04

23 Apr '04

I use sa-stats.pl It isn't like what I'm talking about. Working with the SA devs to keep an outputed DB of score hits. Not logging each hit. But updating a counter. --Chris >-----Original Message----- >From: Doc Schneider [mailto:maddoc@maddoc.net] >Sent: Friday, April 23, 2004 3:35 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] How effective is SURBL? > > > > >Chris Santerre wrote: > >>>>What tools are people using to see what are the most hit rulesets? >>> >>>I've been thinking of writing a tool to check out some of >>>those rulesets >>>the spammy crap hits on. >>> >>>Figured if nothing else it would be fun! 8*)) >>> >>> >>> >>>-Doc >> >> >> How about working with the devs to have a function in SA to >dump rule hits >> into a seperate log? Just rule hits. I'd buy that for a dollar! > >Which Developers? I'm game to do something like this. I know there is >already one for SA. sa-stats.pl or some such. Too bad it never has >worked for me. (probably missing a module or something) Ork! > >But hey I sure can whip something up if there is an interest. > >-Doc (Brushes off his coding skills)(needs more WD-40) > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

RE: [SURBL-Discuss] How effective is SURBL?
by Chris Santerre 23 Apr '04

23 Apr '04

>-----Original Message----- >From: Doc Schneider [mailto:maddoc@maddoc.net] >Sent: Friday, April 23, 2004 2:05 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] How effective is SURBL? > > > > > > What tools are people using to see what are the most hit rulesets? > >I've been thinking of writing a tool to check out some of >those rulesets >the spammy crap hits on. > >Figured if nothing else it would be fun! 8*)) > > > >-Doc How about working with the devs to have a function in SA to dump rule hits into a seperate log? Just rule hits. I'd buy that for a dollar! --Chris

3 3

RE: [SURBL-Discuss] How effective is SURBL?
by Chris Santerre 23 Apr '04

23 Apr '04

>-----Original Message----- >From: Don Newcomer [mailto:newcomer@dickinson.edu] >Sent: Friday, April 23, 2004 9:17 AM >To: SURBL Discussion List >Subject: [SURBL-Discuss] How effective is SURBL? > > >Look for yourself. Here are my top 10 rule hits for yesterday: > >18173 HTML_MESSAGE >11898 WS_URI_RBL >11871 MIME_HTML_ONLY >6951 SPAMCOP_URI_RBL >6847 CLICK_BELOW >6035 HTML_LINK_CLICK_HERE >5278 MIME_HTML_NO_CHARSET >5085 MY_SHRT_IMG >4993 COMBINED_FROM >4140 BE_URI_RBL > >Nice work, gentlemen! What's better is the fact that my system load >appears to have dropped considerably. Life is good... > Considering I also wrote MY_SHRT_IMG, this data makes me VERY happy ;) --Chris

3 2

RE: [SURBL-Discuss] Re: Bill Stearns' sa-blacklist available as S URBL: ws.surbl.org
by Chris Santerre 23 Apr '04

23 Apr '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, April 23, 2004 9:05 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Re: Bill Stearns' sa-blacklist >available as >SURBL: ws.surbl.org > > >On Friday, April 23, 2004, 5:25:06 AM, Raymond Dijkxhoorn wrote: >> So, when >> can we start using the combined lists :) > >We're waiting to hear back from Bill, Chris, Paul, et. al., >about whether they want to combine their rules before they >reach us. Should have a better idea after a conference >call this evening. > >Jeff C. > I think we will find that everyone wants to combine. Just need to find a 'trusted' way for us to all add to one. Emailing domains to one guy for them to add is NUTZ! Happens to me all the time :) --Chris

1 0

probable impact of cid:.* urls in uri_to_domain
by Yusuf Goolamabbas 23 Apr '04

23 Apr '04

Hi, Currently URIDNSBL.pm uses SA's get_uri_list to get a list of URI's from a message, the current regex seems to also get uri's of the form cid:random_characters in the list cid:.* seems to refer to content-ids,attachments in the same message when these uris are run through uri_to_domain, they return back the same result cid:.* My feeling is that a message can contain some artificial cid:.* url's which may skew the set of random domains used for SURBL lookup's I am not sure if cid:.* url's should be returned from get_uri_list() or they should be stripped correctly in uri_to_domain. Quite a few of the values after cid: seem to refer to host names/domain names Regards, Yusuf

3 3

[SURBL-Discuss] [Fwd: cloud-cuckoo-land: M-W's Word of the Day] (fwd)
by Don Newcomer 23 Apr '04

23 Apr '04

I was able to whitelist mail from these people but I'm wondering, more importantly, why they were picked up by the WS_URI_RBL rule. I used the new SURBL checking website and none of the URIs came up positive as far as I could tell. Any ideas? ================================================================================ Don Newcomer Dickinson College Senior Manager, Systems P.O. Box 1773 newcomer(a)dickinson.edu Carlisle, PA 17013 Phone: (717) 245-1256 FAX: (717) 245-1690 ---------- Forwarded message ---------- Date: Fri, 23 Apr 2004 08:44:44 -0400 From: Paul Levit <levitp(a)dickinson.edu> To: Don Newcomer <newcomer(a)dickinson.edu> Subject: [Fwd: cloud-cuckoo-land: M-W's Word of the Day] -------- Original Message -------- Return-Path: <bounce-mw-20902366(a)blast1.myfree.com> Received: from blast1.myfree.com by alpha.dickinson.edu (8.11.1/1.1.29.3/19Aug03-0302PM) id i3N9V0d0000454121; Fri, 23 Apr 2004 05:31:01 -0400 (EDT) Received: from lanai.startsampling.com ([64.85.80.203]) by blast1.myfree.com with SMTP (Lyris ListManager WIN32 version 6.1b); Tue, 20 Apr 2004 13:45:02 -0500 Received: (from nobody@localhost) by lanai.startsampling.com (8.11.6/8.9.3) id i3KIiD316859; Tue, 20 Apr 2004 11:44:13 -0700 Date: Thu, 22 Apr 2004 23:59:00 -0500 Message-Id: <LYRIS-20902366-1782963-2004.04.23-00.00.01--LEVITP#dickinson.edu(a)blast1.myfree.com> From: word(a)m-w.com To: LEVITP(a)dickinson.edu MIME-Version: 1.0 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: cloud-cuckoo-land: M-W's Word of the Day List-Unsubscribe: <mailto:leave-mw-20902366A@blast1.myfree.com> Reply-To: word(a)m-w.com X-Dickinson-MailScanner-Information: Please contact the ISP for more information X-Dickinson-MailScanner: Found to be clean X-Dickinson-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=3.876, required 3, BAYES_00 -4.90, CLICK_BELOW 0.10, DATE_IN_PAST_03_06 0.42, FREE_TRIAL 0.90, HTML_50_60 0.10, HTML_LINK_CLICK_HERE 0.10, HTML_MESSAGE 0.10, J_CHICKENPOX_16 0.60, MIME_HTML_ONLY 0.32, MK_BAD_HTML_02 0.68, MK_BAD_HTML_05 0.30, NO_REAL_NAME 0.16, WS_URI_RBL 5.00) X-MailScanner-From: bounce-mw-20902366(a)blast1.myfree.com <http://www.merriam-webster.com> <http://www.merriam-webster.com/game/> <http://www.wordcentral.com> <http://www.merriam-websterunabridged.com> *Did you share your favorite word with us? Visit our web site for details!* No Yes The Word of the Day for Apr 23 is: *cloud-cuckoo-land* \klowd-KOO-koo-land\ /noun/ : a realm of fantasy or of whimsical or foolish behavior <http://www.merriam-webster.com/sound/c/cloud_01.wav> *Example sentence: * If the boss really thinks he can up productivity and increase profit after the company is downsized, he is living in cloud-cuckoo-land. *Did you know? *In Aristophanes' 5th century B.C. comedy /Birds/, Peisthetaerus (a human) convinces the king of the birds and his followers to help him build an ideal city juxtaposed between heaven and earth. They plan to intercept all of the sacrifices rising from the earth to the gods on Olympus, thereby starving the gods into cooperating with them. The newly built city is dubbed "Nephelokokkygia," (from "nephos," meaning "cloud," and "kokkyx," the native European cuckoo). By the late 19th century, English speakers had translated the town's name as "Cloud-Cuckoo-Land" and had begun using it as a general term for any similarly unreal or whimsical place or situation. *Indicates the sense illustrated in the example sentence. <http://www.startsampling.com/sm/wod/redirector.iphtml?item=3243&url=http%3A…> ------------------------------------------------------------------------ You Are Subscribed As: LEVITP(a)dickinson.edu ------------------------------------------------------------------------ Subscribe to Word of the Day via the Web: click here <http://www.startsampling.com/sm/wod/register.iphtml> Unsubscribe to Word of the Day via the Web: click here <http://www.startsampling.com/sm/wod/changeofaddress.iphtml?email=LEVITP@dic…> To change the email format from html to text: click here <http://www.startsampling.com/sm/wod/changeofaddres s.iphtml> Questions about your subscription? click here <http://www.startsampling.com/sm/wod/faq.htm l> © 2004 by Merriam-Webster <http://www.Merriam-Webster.com>, Incorporated <http://www.startsampling.com/sm/wod/redirector.iphtml?item=3243&url=http%3A…> ------------------------------------------------------------------------ Word game lovers! Enjoy a free trial subscription to Merriam-Webster Unabridged and try our new brainteasers! click here <http://www.startsampling.com/sm/wod/redirector.iphtml?html=1&item=3243&url=…> ------------------------------------------------------------------------ <http://www.startsampling.com/sm/wod/redirector.iphtml?item=3243&url=http%3A…> <http://www.startsampling.com/sm/wod/redirector.iphtml?item=3243&url=http%3A…> *mf mwh 042304 LEVITP(a)dickinson.edu mf* If you cannot read this email, please copy and paste the following address into your web browser to subscribe to the text version of the Merriam-Webster Word of the Day: http://www.startsampling.com/sm/wod/changeofaddress.iphtml -- Paul Levit '71 Executive Director Information Technology Dickinson College Carlisle, PA 17013 717.245.1256 Promote, provide and support the effective use of information technology to advance Dickinson's mission and strategic goals.

2 5

How effective is SURBL?
by Don Newcomer 23 Apr '04

23 Apr '04

Look for yourself. Here are my top 10 rule hits for yesterday: 18173 HTML_MESSAGE 11898 WS_URI_RBL 11871 MIME_HTML_ONLY 6951 SPAMCOP_URI_RBL 6847 CLICK_BELOW 6035 HTML_LINK_CLICK_HERE 5278 MIME_HTML_NO_CHARSET 5085 MY_SHRT_IMG 4993 COMBINED_FROM 4140 BE_URI_RBL Nice work, gentlemen! What's better is the fact that my system load appears to have dropped considerably. Life is good... ================================================================================ Don Newcomer Dickinson College Senior Manager, Systems P.O. Box 1773 newcomer(a)dickinson.edu Carlisle, PA 17013 Phone: (717) 245-1256 FAX: (717) 245-1690

1 0

RE: [SURBL-Discuss] Re: Bill Stearns' sa-blacklist available as SURBL: ws.surbl.org
by Scott Truman 23 Apr '04

23 Apr '04

On Tuesday, April 20, 2004, 6:10:30 PM, Bill Landry wrote: > ----- Original Message ----- > From: "Jeff Chan" <jeffc(a)surbl.org> >> So the quick answer is they'll probably not be combined. >> >> However we probably will offer a combined version of Bill's >> list and Chris' BigEvil list since they are more similar in >> character. > Jeff, why not one DNS query that supports multiple result codes: > test: somedomain.com.sc.surbl.org > results: > 127.0.0.2 = Spamcop > 127.0.0.3 = WS List > 127.0.0.4 = BigEvil List > 127.0.0.5 = etc... > Same thing multi-test RBLs like AHBL, Sorbs, Blars, FiveTen, NJABL and > others do. That's pretty cool. One could even extend that as such (if they don't already): test: example.com.all.surbl.org ;) results: 127.0.0.2 = SC List 127.0.0.4 = WS List 127.0.0.8 = BigEvil List 127.0.0.16 = Someother List etc.... Multiple hits for the same lookup could be returned by combining the last octet i.e. a result of 127.0.0.10 would indicate the URI was found in both the SC and BigEvil lists. If one was only interested in what SC found, then one would AND the result with 127.0.0.2 just thinking out loud...

5 5

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss