-----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Monday, September 06, 2004 9:55 PM To: SURBL Announce; SpamAssassin Users Subject: ANNOUNCE: Top SURBL DNS queries and whitelist hits
We've made a list of the top SURBL DNS queries into my name server:
http://www.surbl.org/dns-queries.counts.txt
and a version with only whitelist hits:
http://www.surbl.org/dns-queries.whitelist.counts.txt
The sample size is somewhat small at 32k queries over the last 48 trailing hours, but it's still somewhat interesting. Specifically 2000 queries are sampled every 3 hours. (Please ignore some of the junk at the end of the unwhitelisted counts. That's stuff left over from DNS packets which I haven't cleaned out yet.)
I'm slightly surprised how high in the total rankings some spam domains are. That represents a huge amount of spam sent and blocked. :-)
Would it be possible to hard code a "SKIP" for certain URLs?
175 yahoo.com 157 w3.org 87 msn.com 77 flowgo.com
Why have the code even bother to check those? Sort of like a permanent hard coded Whitelist. (Bah, Skiplist! I have to stop calling it a whitelist!) This would save traffic.
Just a thought.
--Chris
On Tuesday, September 7, 2004, 6:13:19 AM, Chris Santerre wrote:
From: Jeff Chan [mailto:jeffc@surbl.org]
We've made a list of the top SURBL DNS queries into my name server:
http://www.surbl.org/dns-queries.counts.txt
and a version with only whitelist hits:
Would it be possible to hard code a "SKIP" for certain URLs?
175 yahoo.com 157 w3.org 87 msn.com 77 flowgo.com
Why have the code even bother to check those? Sort of like a permanent hard coded Whitelist. (Bah, Skiplist! I have to stop calling it a whitelist!) This would save traffic.
Just a thought.
--Chris
Yes, Theo proposed exactly such a thing for SA. The top ones should be fairly stable, and also offer the greatest reduction in queries.
SpamCopURI comes with a local whitelist. Eric could we ask you to grab some of these, populate that list in future versions and make it live? The hooks are already there; we just need to use them, and the top whitelist hits would be really useful.
Jeff C.
On Tue, 7 Sep 2004 06:16:53 -0700, Jeff Chan jeffc@surbl.org wrote:
On Tuesday, September 7, 2004, 6:13:19 AM, Chris Santerre wrote:
From: Jeff Chan [mailto:jeffc@surbl.org]
We've made a list of the top SURBL DNS queries into my name server:
http://www.surbl.org/dns-queries.counts.txt
and a version with only whitelist hits:
Would it be possible to hard code a "SKIP" for certain URLs?
175 yahoo.com 157 w3.org 87 msn.com 77 flowgo.com
Why have the code even bother to check those? Sort of like a permanent hard coded Whitelist. (Bah, Skiplist! I have to stop calling it a whitelist!) This would save traffic.
Just a thought.
--Chris
Yes, Theo proposed exactly such a thing for SA. The top ones should be fairly stable, and also offer the greatest reduction in queries.
SpamCopURI comes with a local whitelist. Eric could we ask you to grab some of these, populate that list in future versions and make it live? The hooks are already there; we just need to use them, and the top whitelist hits would be really useful.
Jeff, Eric,
if I want to manually whitelist these, how should I do?
Do I have to add both the wildcard and non-wildcard version of a domain to have the domain and all its subdomains whitelisted?
That is, will whitelist_spamcop_uri *.yahoo.com also whitelist yahoo.com or do I have to explicitly add whitelist_spamcop_uri yahoo.com (since yahoo.com wouln't "match" *.yahoo.com 'cause it's missing the dot)?
TIA
On Tuesday, September 7, 2004, 6:52:31 AM, Mariano Absatz wrote:
if I want to manually whitelist these, how should I do?
Do I have to add both the wildcard and non-wildcard version of a domain to have the domain and all its subdomains whitelisted?
That is, will whitelist_spamcop_uri *.yahoo.com also whitelist yahoo.com or do I have to explicitly add whitelist_spamcop_uri yahoo.com (since yahoo.com wouln't "match" *.yahoo.com 'cause it's missing the dot)?
Not sure the answer, but it should be easy to test with some fake data:
whitelist_spamcop_uri fakedomain1.com *.fakedomain2.com
then try sending in some messages with different fake URIs.
http://fakedomain1.com/ http://host.fakedomain1.com/ http://fakedomain2.com/ http://host.fakedomain2.com/
and see which ones hit.
Or read the source code. ;-)
Jeff C.
On Tue, Sep 07, 2004 at 10:52:31AM -0300, Mariano Absatz wrote:
On Tue, 7 Sep 2004 06:16:53 -0700, Jeff Chan jeffc@surbl.org wrote:
On Tuesday, September 7, 2004, 6:13:19 AM, Chris Santerre wrote:
From: Jeff Chan [mailto:jeffc@surbl.org]
We've made a list of the top SURBL DNS queries into my name server:
http://www.surbl.org/dns-queries.counts.txt
and a version with only whitelist hits:
Would it be possible to hard code a "SKIP" for certain URLs?
175 yahoo.com 157 w3.org 87 msn.com 77 flowgo.com
Why have the code even bother to check those? Sort of like a permanent hard coded Whitelist. (Bah, Skiplist! I have to stop calling it a whitelist!) This would save traffic.
Just a thought.
--Chris
Yes, Theo proposed exactly such a thing for SA. The top ones should be fairly stable, and also offer the greatest reduction in queries.
SpamCopURI comes with a local whitelist. Eric could we ask you to grab some of these, populate that list in future versions and make it live? The hooks are already there; we just need to use them, and the top whitelist hits would be really useful.
Jeff, Eric,
if I want to manually whitelist these, how should I do?
Do I have to add both the wildcard and non-wildcard version of a domain to have the domain and all its subdomains whitelisted?
That is, will whitelist_spamcop_uri *.yahoo.com also whitelist yahoo.com or do I have to explicitly add whitelist_spamcop_uri yahoo.com (since yahoo.com wouln't "match" *.yahoo.com 'cause it's missing the dot)?
Yes, you will need two entries:
whitelist_spamcop_uri *.yahoo.com yahoo.com
Should do it.
--eric
TIA
-- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com _______________________________________________ Discuss mailing list Discuss@lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss
Hi!
I'm slightly surprised how high in the total rankings some spam domains are. That represents a huge amount of spam sent and blocked. :-)
Would it be possible to hard code a "SKIP" for certain URLs?
175 yahoo.com 157 w3.org 87 msn.com 77 flowgo.com
Why have the code even bother to check those? Sort of like a permanent hard coded Whitelist. (Bah, Skiplist! I have to stop calling it a whitelist!) This would save traffic.
Thats why Jeff made the list in the first place, the development for the new version of the SA plugin might have that functionality.
Bye, Raymond.
-
Chris Santerre -
Eric Kolve -
Jeff Chan -
Mariano Absatz -
Raymond Dijkxhoorn