Discuss

discuss@lists.surbl.org

1862 discussions

URIBL with "spam sigs" proposal
by Yves Junqueira 07 Oct '04

07 Oct '04

Hi, In some cases, it would be interesting to provide an alternative zone, with a "spam signature info", for domains that could also be used for legitimate purposes. This zone would feature a special TXT part with a regexp or some encoded string that will be used by checking clients to test the message. A fake example: buyziagra.com TXT: listed in re.surbl.org (etc...) #click here.*buy [zvj]iagra# The text between #'s will be used as an regexp that, if matched against the text in slurp mode (whole buffer checked instead of line-by-line), will make the tool return that that e-mail is Spam. I can adapt my suriproxy to do that very easily. (Btw, there is a new test version of suriproxy avaliable with domain whitelisting and a better uri matching algorithm at http://sourceforge.net/projects/pf-aux. Any new feedback would be appreciated) The format I used is just an illustration. It would be ideal to develop or find a simpler "text matching" format then regexp, and yet more powerful, to accept different character coding. The idea of this "URIBL with spam sigs" is to avoid FP's and, specially, to let us list domains in a less restrictive policy. Even if a domain could used for legimate purposes, it could be added to this special zone. I do agree with the current policy used here, but I have several spam arriving everyday, specially from Brazilian domains, that, if the policy is respected, could not get into the list. Yet we need to find a solution for that, and this is my suggestion. This new feature would, then, take two different collaborative anti-spam solutions types - URIBL and on line content checks (Razor, DCC, etc) in a very efficient way and using existing infra-structure, that is, DNS servers. The odds are it would be a bit more difficult to maintain and spam gangs can change the text all the time. Even then, I believe this could be interesting. Do you think this is worth trying? sorry for my bad english, Yves -- Yves Junqueira http://www.lynx.com.br

1 0

Re: [SURBL-Discuss] Possible large whitelist from DMOZ data
by Daniel Quinlan 07 Oct '04

07 Oct '04

Michele Solutions wrote: >> Although directories such as DMOZ are manually edited there is a danger of >> spammers "grabbing" expired domains and abusing them. I've seen a lot of >> scripts for sale that track dmoz listed domains..... Jeff Chan <jeffc(a)surbl.org> writes: > Thanks. That's definitely good to know about. Ah, you could also look at how long a domain has been registered. ;-) Daniel -- Daniel Quinlan ApacheCon! 13-17 November (3 SpamAssassin http://www.pathname.com/~quinlan/ http://www.apachecon.com/ sessions & more)

1 0

Re: Possible large whitelist from DMOZ data
by Daniel Quinlan 07 Oct '04

07 Oct '04

Jeff Chan <jeffc(a)surbl.org> writes: > Those are all good ideas. Do you know if spammer links do get > deleted? How do the folks who maintain the sites find abusers or > bots? Wikipedia tends to find them eventually. Sometimes, spam links can live on a page or two, so higher count links are going to be safer. Also pages that get updated a lot (and the link stays for each revision). Also, while DMOZ might have some spammer links, I suspect most of the spammer links are very stable, well-listed in SBL and your blacklists, etc. It might be easiest to prioritize links by their S/O ratio: (number of blacklist source hits) --------------------------------- (number of whitelist source hits + number of blacklist source hits) Daniel -- Daniel Quinlan ApacheCon! 13-17 November (3 SpamAssassin http://www.pathname.com/~quinlan/ http://www.apachecon.com/ sessions & more)

1 0

Re: Possible large whitelist from DMOZ data
by Daniel Quinlan 07 Oct '04

07 Oct '04

Chris Santerre <csanterre(a)MerchantsOverseas.com> writes: > Wow, it looks like some of the DMOZ data can't be trusted. Some of those > domains in this WS blocklist are pure spammers. DMOZ (and as far as I know, Wikipedia) don't filter URLs based on email policies of those sites. However, the links *should* generally be categorized correctly in the case of DMOZ and useful in the case of Wikipedia. I would not suggest using either to whitelist automatically, but if you get several of these sources and count the number of hits for each domain, then you should be able to prioritize and possibly automatically whitelist the ones that hit in a large number of databases. I would also take snapshots, but for a different reason than the one Jeff suggested. I would take snapshots and take the intersection of two snapshots for each source (two separate days of DMOZ, etc.) as the authoritative list since some spammer links (especially if added by some bot) will drop off once they are found. Clearly, given that most of the hits are in .ws etc. you're in the tail region of false positives. It'll be hard to find a lot. More sources and looking at source counts seems like the best way. Daniel -- Daniel Quinlan ApacheCon! 13-17 November (3 SpamAssassin http://www.pathname.com/~quinlan/ http://www.apachecon.com/ sessions & more)

2 1

RE: Possible large whitelist from DMOZ data
by Chris Santerre 06 Oct '04

06 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, October 06, 2004 5:58 AM >To: SURBL Discuss >Cc: SpamAssassin Developers >Subject: Possible large whitelist from DMOZ data > *snip* > >And some list counts from those hits: > > [ws] hits: 1173 > [ob] hits: 165 > [jp] hits: 61 > [sc] hits: 8 > [ab] hits: 4 > [ph] hits: 2 > >These add up to more than 1338 since some records hit multiple >lists. The actual hits are in: > > http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.ws Wow, it looks like some of the DMOZ data can't be trusted. Some of those domains in this WS blocklist are pure spammers. adultmovienetwork.com has 135+ NANAS hits, is listed in spamhaus, ect..... These need to ALL be checked carefully. Do not use DMOZ to autowhitelist. I will check A-C in this list. Any takers to check the rest? 1173 FPs......I doubt it. --Chris

2 1

Read this policy please
by Fred 06 Oct '04

06 Oct '04

Ok, As I was reviewing a spam domain to submit, I ran across a somewhat disgusting policy I felt the need to share with everyone here. Here is a snipplet: " Additionally, when you open, preview or click on the advertising portion of our e-mails and/or those of our marketing partners and/or affiliates of GroovyUSA, you have agreed to the terms set forth in our Privacy Policy and agree that as a function of opening, previewing or clicking on the advertising portion of our e-mails, that you will receive new or additional marketing communications from us, our marketing partners and/or affiliates of GroovyUSA. " Right before this, they talk about using clear 1 pixel gifs to track what you view, so they are saying, if you view this message, we will send you more and you accept for us to do whatever we want with your information. http://www.groovyusa-MUNGED.net/ Click on the privacy button at the top of the page.

3 3

Experimental CGI GetURI
by Ryan Thompson 05 Oct '04

05 Oct '04

Hey all, I've started phase two of GetURI's development, in the form of a CGI interface. So far, the interface supports lists of ham and spam domains, which will be especially handy for discussions on this list, and for those of you hand-checking lists of submitted domains. I'll also probably at least add a message checker and maybe even an mbox upload feature, based on feedback and testing. The CGI version produces the same output that the commandline version does. (In fact, it uses some clever tricks to communicate with the commandline version and provide progress to the browser). http://ry.ca/cgi-bin/geturi.cgi This will be *especially* useful for all of these "FP" discussions we've been having lately. Now, f'rinstance, if I proclaim topical7074rneds .com should be whitelisted (it shouldn't!!), I could just feed you this: http://ry.ca/cgi-bin/geturi.cgi?domains=topical7074rneds.com&surbl=ws.surbl… ...which is ugly, and gets uglier in a hurry with more domains. So, I implemented caching and unique IDs, so you can just do the lookup yourself, and then cut and paste the resulting (potentially much shorter) link that will show up in your Address bar, like so: http://ry.ca/cgi-bin/geturi.cgi?id=spam-X52p6q8FMYYEINMCsepAG1 These cached results (if referenced by id, as in the last URL) will be available for at least 30 days from their last access time. The page itself describes the caching algorithm in a bit more detail, for those that are interested. Try it out, please, and make some noise about it. It's experimental (read: I started with an idea in my head and a blank file in my editor about 4.5 hours ago), so there are bound to be some interesting bugs. ;-) - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

3 6

Re: [SURBL-Discuss] Read this policy please
by Rob McEwen 05 Oct '04

05 Oct '04

> OE6 on XPsp2 is smart like this now too, by default blocks all external > content. BTW, does anyone here know of a plug-in (or something) to get Outlook XP (office verion, not "outlook express") to do this external image blocking too? I know that image blocking can be done in Outlook 2003, but I don't want to upgrade until the next version of MS Office. Rob McEwen

1 0

Help checking a few FPs
by Jeff Chan 05 Oct '04

05 Oct '04

Got some more FPs from hams: /home/gorilla/black-gorilla-8_04.txt:servebeer.com /web/antispam/outblaze.domains.sort:pacmanhattan.com /web/antispam/mailsecurity.spam.domains:romp.com /home/prolocation/black-prolocation-master:romp.com These all seem to have legitimate uses to me. servebeer.com belongs to dynamic DNS provider No-IP.com so obviously it's subject to some abuse, but it also seems to have legitimate uses. pacmanhattan.com is apparently a university student project to play Pacman on city steets with people. romp.com appears to be a National Lampoon movie site. I'd like to whitelist all of these but would like to hear from Chris, David, Outblaze and Raymond about why they listed them. None have SBL hits. romp and pacman have no NANAS, and as expected serverbeer has 29 NANAS. The full list from the 5 source hams includes the three probable FPs above and some others which are not in SURBLs, but which should probably be whitelisted since they appear in things like Debian Linux newsletters. catb.org debian.org debianforum.de ffii.org gnu.org harddisk-recovery.nl heise.de infodrom.org kitenet.net leidenuniv.nl linuxtag.org opensource.org pacmanhattan.com romp.com servebeer.com spi-inc.org uu.nl wallsplash.net xtronics.com Comments please, Jeff C. -- "If it appears in hams, then don't list it."

4 7

RE: [SURBL-Discuss] Whitelist kit . net
by Chris Santerre 05 Oct '04

05 Oct '04

>-----Original Message----- >From: Yves Junqueira [mailto:yves.junqueira@gmail.com] >Sent: Monday, October 04, 2004 12:04 PM >To: Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] Whitelist kit . net > > >On Mon, 4 Oct 2004 07:29:14 -0700, Jeff Chan <jeffc(a)surbl.org> wrote: >> The policy is: if it has legitimate uses, then don't list. >> >> Can you provide some examples of legitimate sites on kit.net >> (preferably in English)? >> >> Jeff C. > >Sorry, I couldn't find any in english. > >http://www.tmabc.kit.net - >http://www.1mais1.kit.net - They seem good people. They are a group >of volunteers that assist home less people. Doesn't seem to be a scam. > >I'd suggest whitelisting kit.net if, and only if, you are really >strict to the policy. They do host many trojans and scam sites there. > Why not treat them like the tld is 'kit.net' and list on subdomains? --Chris

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss