-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
My results, testing ph while I was at it:
: jm 1351...; grep -v " 0.500 " freqs OVERALL% SPAM% HAM% S/O RANK SCORE NAME 121405 22516 98889 0.185 0.00 0.00 (all messages) 100.000 18.5462 81.4538 0.185 0.00 0.00 (all messages as %) 13.453 70.3766 0.4925 0.993 1.00 1.00 SURBL_WS 3.807 20.3811 0.0334 0.998 0.50 1.00 SURBL_SC 2.650 14.2565 0.0071 1.000 0.50 1.00 SURBL_AB 0.019 0.0933 0.0020 0.979 0.50 1.00 SURBL_PH 12.624 67.6275 0.1001 0.999 0.50 1.00 SURBL_OB2 13.295 68.5113 0.7230 0.990 0.00 1.00 SURBL_OB
OB2 looks pretty promising ;)
The one PH fp is a link to this:
http://qrxx.4t.com/barbieOS.htm
(which no longer works, but 4t.com was a geocities-type hosting site as far as I know.)
- --j.
On Friday, June 25, 2004, 12:16:17 AM, Justin Mason wrote:
My results, testing ph while I was at it:
: jm 1351...; grep -v " 0.500 " freqs OVERALL% SPAM% HAM% S/O RANK SCORE NAME 121405 22516 98889 0.185 0.00 0.00 (all messages) 100.000 18.5462 81.4538 0.185 0.00 0.00 (all messages as %) 13.453 70.3766 0.4925 0.993 1.00 1.00 SURBL_WS 3.807 20.3811 0.0334 0.998 0.50 1.00 SURBL_SC 2.650 14.2565 0.0071 1.000 0.50 1.00 SURBL_AB 0.019 0.0933 0.0020 0.979 0.50 1.00 SURBL_PH 12.624 67.6275 0.1001 0.999 0.50 1.00 SURBL_OB2 13.295 68.5113 0.7230 0.990 0.00 1.00 SURBL_OB
OB2 looks pretty promising ;)
Thanks much for the data. Yusuf from Outblaze said to use the ob2 data source, so I will switch ob over to it unless there are any results or comments to the contrary.
If anyone else is able to give some test results for ab, ob and ob2, please speak up.
The one PH fp is a link to this:
http://qrxx.4t.com/barbieOS.htm
(which no longer works, but 4t.com was a geocities-type hosting site as far as I know.)
I have whitelisted 4t.com in SURBLs.
David Hooton, You may want to check how 4t.com got into the phishing data.
Jeff C.
On Fri, 25 Jun 2004 01:04:21 -0700, Jeff Chan jeffc@surbl.org wrote:
On Friday, June 25, 2004, 12:16:17 AM, Justin Mason wrote:
My results, testing ph while I was at it:
<snip>
The one PH fp is a link to this:
http://qrxx.4t.com/barbieOS.htm(which no longer works, but 4t.com was a geocities-type hosting site as far as I know.)
I have whitelisted 4t.com in SURBLs.
David Hooton, You may want to check how 4t.com got into the phishing data.
This domain and one other similar have been removed.
----- Original Message ----- From: "Jeff Chan" jeffc@surbl.org
The one PH fp is a link to this:
http://qrxx.4t.com/barbieOS.htm(which no longer works, but 4t.com was a geocities-type hosting site as far as I know.)
I have whitelisted 4t.com in SURBLs.
David Hooton, You may want to check how 4t.com got into the phishing data.
Has the phishing database been released for use or testing yet? If so, how do we access?
Thanks,
Bill
On Friday, June 25, 2004, 12:52:46 PM, Bill Landry wrote:
Has the phishing database been released for use or testing yet? If so, how do we access?
David Hooton & Co.'s phishing data are available only in multi.surbl.org, the bitmask-combined SURBL list which is supported in SpamAssassin 3. The reason for that is that the ph list would be a fairly small zone of about 200 entries by itself.
Hopefully support for the combined list will be back-ported to SpamCopURI for use with SpamAssassin 2.63 also.
Jeff C.
----- Original Message ----- From: "Jeff Chan" jeffc@surbl.org To: "SURBL Discussion list" discuss@lists.surbl.org Sent: Friday, June 25, 2004 4:18 PM Subject: phishing data available in multi.surbl.org (Was: Re: [SURBL-Discuss]Please test ob, ob2, ab)
On Friday, June 25, 2004, 12:52:46 PM, Bill Landry wrote:
Has the phishing database been released for use or testing yet? If so,
how
do we access?
David Hooton & Co.'s phishing data are available only in multi.surbl.org, the bitmask-combined SURBL list which is supported in SpamAssassin 3. The reason for that is that the ph list would be a fairly small zone of about 200 entries by itself.
Hopefully support for the combined list will be back-ported to SpamCopURI for use with SpamAssassin 2.63 also.
Gotcha, thanks for the update!
Bill
On Friday, June 25, 2004, 1:04:21 AM, Jeff Chan wrote:
On Friday, June 25, 2004, 12:16:17 AM, Justin Mason wrote:
My results, testing ph while I was at it:
: jm 1351...; grep -v " 0.500 " freqs OVERALL% SPAM% HAM% S/O RANK SCORE NAME 121405 22516 98889 0.185 0.00 0.00 (all messages) 100.000 18.5462 81.4538 0.185 0.00 0.00 (all messages as %) 13.453 70.3766 0.4925 0.993 1.00 1.00 SURBL_WS 3.807 20.3811 0.0334 0.998 0.50 1.00 SURBL_SC 2.650 14.2565 0.0071 1.000 0.50 1.00 SURBL_AB 0.019 0.0933 0.0020 0.979 0.50 1.00 SURBL_PH 12.624 67.6275 0.1001 0.999 0.50 1.00 SURBL_OB2 13.295 68.5113 0.7230 0.990 0.00 1.00 SURBL_OB
OB2 looks pretty promising ;)
Thanks much for the data. Yusuf from Outblaze said to use the ob2 data source, so I will switch ob over to it unless there are any results or comments to the contrary.
Judging by Justin's results above the revised data source has nearly the same spam detection rate and a much lower false positive rate, so I agree it's a better list.
My understanding is that the older Outblaze data source reflected in the original ob.surbl.org included spam sender domains used by Outblaze to block message envelopes (headers). The revised list should have only spamvertised site domains (domains from message body URIs). This is more appropriate for SURBL use.
Therefore, I've changed ob.surbl.org to the same, revised Outblaze data source as ob2.surbl.org so that ob should now be about half as large with about 20k domains and have better performance. The ob2 list will go away eventually since it was only meant for testing and now has the same content as ob.
If anyone else is able to give some test results for ab, ob and ob2, please speak up.
Does anyone else have any results of testing ab or ob to share?
Jeff C.
-
Bill Landry -
David Hooton -
Jeff Chan -
jm＠jmason.org