Hi!

...

blah.com This was in a ProFTPd mailing list message "how do I set up a virtual host for "blah.com".

Uhm, if people need to type 'some' domain, its often blah.com or foo.com, thats common use, and the spammer using blah.com does take nice advantage of this.

These all look relatively ok to me. I'm whitelisting them.

Note that there is some slight overlap with the "Large ham corpus" and another recent FP report, in the astrology, surveymonkey, and blah.com mentions.

Counter-arguments welcome, but most include some evidence that these don't appear in hams.

Ohw well, if i get fresh ones from blah.com i'll let you know, so far i did not.

Bye, Raymond.

On Saturday, September 11, 2004, 10:47:03 AM, Ryan Thompson wrote:

Raymond Dijkxhoorn wrote to Jeff Chan and SURBL Discussion list:

...

...

...

blah.com This was in a ProFTPd mailing list message "how do I set up a virtual host for "blah.com".

Uhm, if people need to type 'some' domain, its often blah.com or foo.com, thats common use, and the spammer using blah.com does take nice advantage of this.

Yeah, and, unfortunately, there isn't much we can do about that to list them, since they'll definitely be used in ham.

I'm making a list of generic placeholder domains that people use in examples, with the idea to whitelist them all to prevent FPs.

The good news is that most of them seem to be very old vanity registrations, so they're probably not going to be taken over by spammers any time soon. Here's a few I could think of:

domain.com domainname.com mydomain.com somedomain.com foo.com foobar.com example.com example.us

Can anyone think of others commonly used in examples?

Jeff C.

On Sat, Sep 11, 2004 at 04:08:15PM -0700, Jeff Chan wrote:

I'm making a list of generic placeholder domains that people use in examples, with the idea to whitelist them all to prevent FPs. The good news is that most of them seem to be very old vanity [...] Can anyone think of others commonly used in examples?

The same with org and net. And edu, but we can ignore those.

Are you sure we want to whitelist 'em all pre-emptively? Some of these combos seem to be for sale. (Want to buy spammer.net?)

Not sure it's "commonly" but off the top of my head:

baz (comes after foo, bar) localdomain internet intranet outside inside local site test evil good safe hacker cracker spammer blackhat us them friend friendly enemy hostile private secret secure black white red green one two three alpha beta gamma omega big acme wireless

On Saturday, September 11, 2004, 10:37:57 PM, David Funk wrote:

Um, people, this precise issue is ancient history. The IETF community ran into this buzz-saw years ago, and there is now a set of reserved domain names -just- for sake of documentation & examples.

See RFC-2606, check out the registration info for "example.com".

So we just need to encourage people to use the reserved names (EG: "example.com") rather than 'foo/bar/blah.com'

Thanks Dave. I'll add the ones mentioned in RFC 2606:

example.com example.net example.org

but we should also include common examples from everyday use, even if they're not technically RFC compliant.

Jeff C.

On Sunday, September 12, 2004, 11:04:57 AM, Frank Ellermann wrote:

Jeff Chan wrote:

...

I'll add the ones mentioned in RFC 2606: example.com example.net example.org but we should also include common examples from everyday use, even if they're not technically RFC compliant.

Be very careful with this. I know that test.de and invalid.de are okay, but generally you can't fix all silly abuse ideas.

We probably would not be whitelisting geographic names like these.

It's better to support 2606 (example.cno, *.example, *.test, *.invalid, *.localhost). For the TLDs that's no problem, you already know that example/test/invalid/localhost are reserved. And *.local isn't better (but not officially reserved).

We won't be whitelisting any entire TLDs, even these test ones.

But something like say local.tv, who knows ? Maybe they are spammers, maybe they don't exist, maybe they are okay. One SLD rarely or never abused might be NIC.* in all existing TLDs.

There's no capability for wildcarding whitelist entries, nor do I plan to add any. local.tv would be a geographic name which we would not generically whitelist.

Jeff C.