-----Original Message----- From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] Sent: Friday, September 10, 2004 8:48 PM To: discuss@lists.surbl.org Subject: [SURBL-Discuss] important reduce wrise renkles & skin spots (fwd)
Hi!
Our favorite pill spammers also try to get around SURBL now.
I dont want to end up making SA rulesets for this, any suggestions ?
ns3.airmaramba.biz ns3.avk29.biz
The same crap... But, with less SA hits now, since its not touched by SURBL. Bah.
---------- Forwarded message ---------- Date: Sat, 11 Sep 2004 01:50:29 +0100 From: kenneth clakley auroraschorn@rfc.every1.net To: wilfredo moote reyes@prolocation.net Subject: important reduce wrise renkles & skin spots
suc-oneonta sony-steo lettery
From inside to outside, from w^eig_ht l`o^ss to skin care. From mental
relief to physical relief, from antidepressant to muscle relaxant. The care inside out.
you can copy
wjq.s.adjuster6370pinn.com/56/
to your browser
Not all of these are listed in SURBL:
(Yes one day I hope to make this info availible to you.)
* 1: abrasions6681tabs.biz * 2: absentia4304drug.biz * 3: abstention2386tads.us * 4: accordance3414drugs.biz * 5: addable8060biz.com * 6: adorer457dryg.com * 7: agronomy9603dryg.com * 8: aground8965drugs.biz * 9: agues346rneds.us * 10: aider8333tads.com * 11: alighted2110tads.us * 12: alitalia9689pi11.us * 13: amateurish8859rx.us * 14: anaerobe9918tabs.us * 15: annularity789drugs.biz * 16: antioch8386drygs.us * 17: apercus9591dryg.us * 18: aperiodic1001pill.biz * 19: appetite352tads.us * 20: arc4679biz.biz * 21: armenian5748drug.biz * 22: armenian8291drygs.com * 23: arteriole1448drygs.us * 24: articular9420tabs.biz * 25: aspirated8343pi11.us * 26: assemblies7268biz.us * 27: assumpsit9521drygs.us * 28: astf2571pills.us * 29: attendee9327tads.us * 30: authorise5969rneds.us * 31: avk29.biz * 32: axing5875pi11s.us * 33: aye3054biz.us * 34: bedtime7591rx.us * 35: benzene4347drug.us * 36: benzine6086dryg.com * 37: bier3709pi11.biz * 38: bleach2839drugs.us * 39: breakup9732pi11.us * 40: bream1462rneds.us * 41: bridegroom6963rx.us * 42: brimming6028pill.biz * 43: bumble2318pills.biz * 44: burnie5422pinn.com * 45: caraway307biz.us * 46: carp6499pi11s.us * 47: caw5709biz.us * 48: cctv6483tabs.biz * 49: centralism3766rx.us * 50: charlatan9181rneds.us * 51: chopsticks4847tabs.biz * 52: cleat7228pirrs.com * 53: closed6129tads.us * 54: cobra133pirrs.com * 55: cog5687tads.us * 56: collocutor9120dryg.com * 57: comparable6635tads.com * 58: concinnity6196pi11s.us * 59: congener1455rneds.com * 60: copenhagen1026tabs.us * 61: crane7149biz.biz * 62: crucify8156pi11.us * 63: cyrconium8981biz.us * 64: dale1949pi11.us * 65: dayak3409tabs.biz * 66: decatur9854rx.us * 67: dehydrated8623meds.us * 68: destitute6182drygs.com * 69: dewlap752drygs.com * 70: dhl7809tads.com * 71: digestion5594rneds.us * 72: digital9420rx.biz * 73: directory1403rx.biz * 74: disjoint5156drygs.com * 75: docket9430pi11.us * 76: duodenum1797nx.com * 77: duodenum6414biz.us * 78: earwax8995rneds.com * 79: embody6740tabs.biz * 80: emerge2198dryg.com * 81: enactment859drygs.us * 82: enriched3735pi11.us * 83: entail2096drygs.us * 84: epitheory4065dryg.com * 85: ergo2905drygs.us * 86: fabricate2671rneds.us * 87: faire4813rneds.com * 88: farcical3545rneds.us * 89: fatality5443drugs.com * 90: fateful3948pill.us * 91: feminine2966biz.us * 92: ferryboat4957meds.biz * 93: fie9819meds.biz * 94: fitful1499tads.us * 95: flank4240biz.us * 96: flatfoot8255tabs.us * 97: flew7838tads.com * 98: flimsiness4164dryg.us * 99: fortress221drug.biz * 100: fox621dryg.us * 101: frankly8033pi11s.us * 102: fraudulent4567pill.us * 103: glassy5030nx.com * 104: gratuitous4973meds.us * 105: griffith4438biz.us * 106: grin7749pi11.us * 107: guano7904pills.us * 108: gui7176biz.com * 109: haphazard8933tads.us * 110: hard8589meds.us * 111: harmonious682pi11s.us * 112: healing7489biz.com * 113: heartbreak7918rneds.biz * 114: hits359pills.biz * 115: hopefully3701rneds.us * 116: humpback726pirrs.com * 117: hyaena988drygs.us * 118: identifier618pi11.us * 119: imbed3506pinn.com * 120: impede276tads.us * 121: indenting1562pill.com * 122: indoor954pill.biz * 123: inequality2661pi11s.us * 124: infinitive6385biz.us * 125: inflect5194drygs.us * 126: insure3484biz.us * 127: integrated7310tads.us * 128: involute6538drygs.us * 129: issued5633drug.biz * 130: jell8297drugs.us * 131: joliet5195biz.com * 132: kathy8786pi11.us * 133: katzner3273biz.us * 134: kick6502pi11.us * 135: killing8335biz.us * 136: knowingly606meds.us * 137: lawful7322dryg.us * 138: laxative5682dryg.us * 139: laziness6976dryg.com * 140: leaden9828biz.us * 141: lessee7050tabs.biz * 142: lettish3429pill.us * 143: liaison6083tabs.biz * 144: limped6950pill.us * 145: lotus9106rneds.com * 146: luxuriate7999tads.us * 147: madder8828biz.us * 148: magenta4358rx.us * 149: med12now.com * 150: mediate3804rx.us * 151: medic7.com * 152: medspro7.com * 153: microcode3252meds.biz * 154: milan1517biz.com * 155: mirroring5831dryg.us * 156: mis6163pi11s.us * 157: misogynist2527dryg.biz * 158: moisten982rx.us * 159: monitor8072pill.biz * 160: narrowly1946biz.us * 161: narrowly9558pi11.us * 162: negater6398tads.com * 163: nevermore8513pi11.us * 164: newmedsgo.com * 165: nude7755pi11s.us * 166: obscuring7328drygs.biz * 167: odometer3845meds.us * 168: oleaginous9337meds.us * 169: onyx810dryg.us * 170: optimize5129drug.com * 171: oscillator9247biz.com * 172: osprey9824drug.us * 173: outgoing9256pi11s.us * 174: outweigh9214pills.us * 175: overhand1383biz.us * 176: packaged2320rneds.biz * 177: paperwork970tads.com * 178: paramour5839biz.biz * 179: parfaits6405drygs.us * 180: passivism3981tads.com * 181: payout4174pills.us * 182: pelves963tads.com * 183: penney5099rx.us * 184: phantasia6277biz.us * 185: phoneme6858biz.com * 186: phosphite1908tads.com * 187: plasticize6988drygs.com * 188: pleader7286pi11.us * 189: plus2766rx.biz * 190: pollacks6901biz.us * 191: pompadour8149meds.us * 192: poncho4491dryg.us * 193: pottage6834pirrs.us * 194: prairie4725biz.com * 195: pressman1177nx.com * 196: pretzel3736pills.com * 197: primness6560nx.us * 198: probity7464tads.com * 199: procuress4029pinn.com * 200: project2089biz.com * 201: propylene3479pi11s.us * 202: qts7851drygs.us * 203: quits8304drygs.com * 204: quoter7237tabs.biz * 205: race874pi11s.us * 206: racetrack2853pirrs.com * 207: radial1212rx.biz * 208: rainproof4172tads.com * 209: ram7888dryg.com * 210: randomness3999pi11.us * 211: rata2536tads.com * 212: rating1857rneds.us * 213: rationale9722dryg.us * 214: receive5709tads.us * 215: recruited2055rneds.com * 216: replenish4787nx.com * 217: reproduced2714tads.us * 218: resist9528rneds.com * 219: rework5964drugs.us * 220: rhubarb454rneds.us * 221: richmond8106dryg.com * 222: ringlet6664biz.us * 223: rustic9925rneds.com * 224: safflower170dryg.com * 225: sahib5037biz.com * 226: salesman8694tabs.biz * 227: sanguine882rneds.com * 228: sanita77.biz * 229: satrapy8385tads.com * 230: sauntering5306biz.biz * 231: scarfs7993pi11s.us * 232: scatters8393rneds.com * 233: sceptical5237tabs.us * 234: schlepp5206biz.com * 235: science6119dryg.us * 236: scratchpad4718tads.us * 237: scuttle5567pills.us * 238: searim7571tads.us * 239: seascape9247dryg.us * 240: seconds9619pills.biz * 241: seduction6895drygs.us * 242: sergeancy8489pinn.com * 243: servile9023tads.us * 244: sewerage5665pills.us * 245: sextette9640drug.us * 246: shadowy9804pinn.com * 247: shaves4465drugs.biz * 248: shied5615rneds.us * 249: shingle6722dryg.us * 250: shipshape6075pi11.us * 251: shirts7008drygs.us * 252: showplace1294pirrs.com * 253: showroom3161drygs.us * 254: shrieking3773pi11s.us * 255: shrinks489pinn.com * 256: shudder4751dryg.us * 257: shudder6654meds.biz * 258: sideband9064dryg.us * 259: silenced221pills.us * 260: silvers2867biz.us * 261: simpleness128pill.us * 262: siphonage8358pi11.us * 263: skills4744rneds.us * 264: skunk2642drugs.us * 265: sky5490pirrs.com * 266: skydives9635pi11s.us * 267: slates8323rx.biz * 268: slays1093drugs.biz * 269: sleety6351pills.biz * 270: slide6037drygs.us * 271: smeltery7284pills.us * 272: smithies7780biz.us * 273: smock928pill.us * 274: smoldering3120drugs.biz * 275: snivels460biz.biz * 276: snoozed2548rneds.com * 277: soaker1916tads.com * 278: societies7375tads.us * 279: sociologic3084biz.us * 280: sods4562rx.us * 281: soluble7830pinn.com * 282: souped9129pill.biz * 283: sparring2432pi11s.us * 284: spidery4421biz.com * 285: spiritous5262dryg.us * 286: spoilt7777rneds.com * 287: squelched807rx.us * 288: stack7167biz.us * 289: statutory1625pi11s.us * 290: stein3843dryg.us * 291: stereo661drugs.us * 292: stiffed5912tads.com * 293: stillness4372pills.us * 294: stillwater7481drug.us * 295: stockinet9618nx.com * 296: stolidly8964biz.us * 297: stony4921rneds.com * 298: stoppage9046drugs.us * 299: subcell5587drugs.us * 300: summit4716drygs.com * 301: sundae8155pi11.us * 302: sundance4111pills.biz * 303: swaged5905biz.com * 304: tachometer4191rx.us * 305: tangential3858pill.us * 306: tentative8691pinn.com * 307: terminable3646drygs.com * 308: textiles528tads.us * 309: them1275pinn.com * 310: thickly6764drugs.us * 311: threadbare2938rneds.us * 312: throughput9067pi11.us * 313: thumbscan6966tads.us * 314: thumper4635pi11s.us * 315: tidings7196rx.biz * 316: tiled2118rneds.com * 317: timeworn642tads.us * 318: tingle3751drygs.com * 319: tipped2161pills.us * 320: tiptoe1538rx.us * 321: toaster7461drygs.com * 322: towing613pill.biz * 323: transient3126drygs.com * 324: transitive7329pi11.us * 325: treatable4145pill.biz * 326: trinity7698pi11s.us * 327: tunny1567rx.us * 328: ugh5315biz.biz * 329: unawares6248pinn.com * 330: unburdened2613pills.us * 331: uncocked5801tabs.biz * 332: undefended7133pinn.com * 333: underload9603pirrs.com * 334: unhewn2916drug.us * 335: unordered6621rx.us * 336: unpainted4643pills.us * 337: valencia9167pill.biz * 338: vcr1047pinn.com * 339: vermouth9192drugs.biz * 340: very9221rx.us * 341: voodoo5623rx.biz * 342: wanton5925pill.biz * 343: waterside9155dryg.us * 344: weak2133drug.us * 345: weaponless8185biz.com * 346: weeper9194nx.com * 347: wimbledon743pill.us * 348: winney6568drugs.biz * 349: winning7272tads.com * 350: wolfhound8782biz.us * 351: workman3166tabs.us * 352: worrisome5163pill.us * 353: wrasse8984pi11.us * 354: yachtsmen1959pi11s.us * 355: yip3909tads.com
--Chris
on Tue, Sep 14, 2004 at 02:40:32PM -0400, Chris Santerre wrote:
Not all of these are listed in SURBL:
Neither are these:
92sell3323serve.biz ball5552drugs.biz cheapest5145tabs.biz cheapestt216655tabs.biz extra3535pills.biz global2000hosting.net hide5056tabs.biz myprog3205pillys.biz odevide2003drugs.biz optin9987free.net serenajones2000netscape.net stored78778pillllls.biz vgeorge7098drugs.biz your1511pills.biz your2512pills.biz
FYI.
Hi!
Neither are these:
92sell3323serve.biz ball5552drugs.biz cheapest5145tabs.biz cheapestt216655tabs.biz extra3535pills.biz global2000hosting.net hide5056tabs.biz myprog3205pillys.biz odevide2003drugs.biz optin9987free.net serenajones2000netscape.net stored78778pillllls.biz vgeorge7098drugs.biz your1511pills.biz your2512pills.biz
Please submit them to WS, you can also mail them offlist to me, we dont have to wait till they start using them again...
Bye, Raymond.
On Tuesday, September 14, 2004, 2:53:06 PM, Raymond Dijkxhoorn wrote:
Neither are these:
92sell3323serve.biz ball5552drugs.biz cheapest5145tabs.biz cheapestt216655tabs.biz extra3535pills.biz global2000hosting.net hide5056tabs.biz myprog3205pillys.biz odevide2003drugs.biz optin9987free.net serenajones2000netscape.net stored78778pillllls.biz vgeorge7098drugs.biz your1511pills.biz your2512pills.biz
Please submit them to WS, you can also mail them offlist to me, we dont have to wait till they start using them again...
Yes, I'd say if you can find them, add them to a SURBL.
We'll need to have some kind of expiration mechanism though, so the lists don't fill up with old, unused domains.
Is anyone working on the latter?
Jeff C.
Jeff Chan wrote:
On Tuesday, September 14, 2004, 2:53:06 PM, Raymond Dijkxhoorn wrote:
Neither are these:
92sell3323serve.biz ball5552drugs.biz cheapest5145tabs.biz cheapestt216655tabs.biz extra3535pills.biz global2000hosting.net hide5056tabs.biz myprog3205pillys.biz odevide2003drugs.biz optin9987free.net serenajones2000netscape.net stored78778pillllls.biz vgeorge7098drugs.biz your1511pills.biz your2512pills.biz
Please submit them to WS, you can also mail them offlist to me, we dont have to wait till they start using them again...
Yes, I'd say if you can find them, add them to a SURBL.
We'll need to have some kind of expiration mechanism though, so the lists don't fill up with old, unused domains.
Is anyone working on the latter?
I'm using a mysql DB for my data, every time a URI is added, the list gets exported into a local_zone and a surbl_zone file to upload to spamgate, expireing would be quite simple.
maybe SURBL should take a similar approach.
Alex
On Tuesday, September 14, 2004, 11:03:08 PM, Alex Broens wrote:
I'm using a mysql DB for my data, every time a URI is added, the list gets exported into a local_zone and a surbl_zone file to upload to spamgate, expireing would be quite simple.
maybe SURBL should take a similar approach.
Alex
What is your expiration algorithm?
Jeff C.
Jeff Chan wrote:
On Tuesday, September 14, 2004, 11:03:08 PM, Alex Broens wrote:
I'm using a mysql DB for my data, every time a URI is added, the list gets exported into a local_zone and a surbl_zone file to upload to spamgate, expireing would be quite simple.
maybe SURBL should take a similar approach.
Alex
What is your expiration algorithm?
None so far. As its all very new, I'm still "collecting". On my local IP RBL I have 30 days, dunno yet what to use on URIs, I assume that using 6 months at least would be safe.
Suggestions?
Alex
Alex Broens wrote:
What is your expiration algorithm?
None so far. As its all very new, I'm still "collecting". On my local IP RBL I have 30 days, dunno yet what to use on URIs, I assume that using 6 months at least would be safe.
Suggestions?
In my spamfilter I keep a "referenced" list of domains: Every time I have a positive lookup and the domain is not in the referenced list, I add it.
Then every couple of weeks I rename the referenced list file and start from scratch. By intersecting these limited timeframe usage lists with the larger blacklist I can later verify which domains were actively spamvertised during what period.
So I could do someting like remove all entries added to the local blacklist list between January and April that were not advertised between May and August, for example.
If we had activity data for how many times the DNS server returned a hit for which domains on a given day, we could also work out such heuristics.
Joe
On Wednesday, September 15, 2004, 1:13:57 AM, Joe Wein wrote:
Alex Broens wrote:
What is your expiration algorithm?
None so far. As its all very new, I'm still "collecting". On my local IP RBL I have 30 days, dunno yet what to use on URIs, I assume that using 6 months at least would be safe.
Suggestions?
In my spamfilter I keep a "referenced" list of domains: Every time I have a positive lookup and the domain is not in the referenced list, I add it.
Then every couple of weeks I rename the referenced list file and start from scratch. By intersecting these limited timeframe usage lists with the larger blacklist I can later verify which domains were actively spamvertised during what period.
So I could do someting like remove all entries added to the local blacklist list between January and April that were not advertised between May and August, for example.
If we had activity data for how many times the DNS server returned a hit for which domains on a given day, we could also work out such heuristics.
There is a rough count of SURBL DNS hits at:
http://www.surbl.org/dns-queries.counts.txt
It's only a sampling of about 32k queries over two days, so the source data is a little sparse, yet it can give some idea of some of the queries being hit.
Jeff C.
On Wednesday, September 15, 2004, 3:18:39 AM, Jeff Chan wrote:
On Wednesday, September 15, 2004, 1:13:57 AM, Joe Wein wrote:
Alex Broens wrote:
What is your expiration algorithm?
None so far. As its all very new, I'm still "collecting". On my local IP RBL I have 30 days, dunno yet what to use on URIs, I assume that using 6 months at least would be safe.
Suggestions?
In my spamfilter I keep a "referenced" list of domains: Every time I have a positive lookup and the domain is not in the referenced list, I add it.
Then every couple of weeks I rename the referenced list file and start from scratch. By intersecting these limited timeframe usage lists with the larger blacklist I can later verify which domains were actively spamvertised during what period.
So I could do someting like remove all entries added to the local blacklist list between January and April that were not advertised between May and August, for example.
If we had activity data for how many times the DNS server returned a hit for which domains on a given day, we could also work out such heuristics.
There is a rough count of SURBL DNS hits at:
It's only a sampling of about 32k queries over two days, so the source data is a little sparse, yet it can give some idea of some of the queries being hit.
And here's some perhaps more useful versions. Only the whitelist hits:
http://www.surbl.org/dns-queries.whitelist.counts.txt
And only the blocklist hits:
http://www.surbl.org/dns-queries.blocklist.counts.txt
If these are useful, we can increase the sampling to improve the quality of the data.
BTW does anyone see any obvious FPs in the blocklist hits? Or any pure spammers in the whitelist hits?
Jeff C.
Jeff Chan wrote:
On Wednesday, September 15, 2004, 3:18:39 AM, Jeff Chan wrote:
On Wednesday, September 15, 2004, 1:13:57 AM, Joe Wein wrote:
Alex Broens wrote:
What is your expiration algorithm?
None so far. As its all very new, I'm still "collecting". On my local IP RBL I have 30 days, dunno yet what to use on URIs, I assume that using 6 months at least would be safe.
Suggestions?
In my spamfilter I keep a "referenced" list of domains: Every time I have a positive lookup and the domain is not in the referenced list, I add it.
Then every couple of weeks I rename the referenced list file and start from scratch. By intersecting these limited timeframe usage lists with the larger blacklist I can later verify which domains were actively spamvertised during what period.
So I could do someting like remove all entries added to the local blacklist list between January and April that were not advertised between May and August, for example.
If we had activity data for how many times the DNS server returned a hit for which domains on a given day, we could also work out such heuristics.
There is a rough count of SURBL DNS hits at:
It's only a sampling of about 32k queries over two days, so the source data is a little sparse, yet it can give some idea of some of the queries being hit.
And here's some perhaps more useful versions. Only the whitelist hits:
http://www.surbl.org/dns-queries.whitelist.counts.txt
And only the blocklist hits:
http://www.surbl.org/dns-queries.blocklist.counts.txt
If these are useful, we can increase the sampling to improve the quality of the data.
BTW does anyone see any obvious FPs in the blocklist hits? Or any pure spammers in the whitelist hits?
blacklist FP:
iaef.org.ar
as to the whitelist, that was a great source including MANY greyhats to add to my local "UC" zone :-)))))
Alex
On Wednesday, September 15, 2004, 2:01:43 PM, Jeff Chan wrote:
On Wednesday, September 15, 2004, 5:33:11 AM, Alex Broens wrote:
blacklist FP:
iaef.org.ar
Can you explain who they are and why we should whitelist them?
http://www.iaef.org.ar/e_iafei.asp
Looks like they are a non-profit association of financial executives. Probably not major spammers.
I am whitelisting them.
Thanks for spotting this Alex, but anyone proposing FPs, please try to include a little research or info about who they are.
Jeff C.
Jeff Chan wrote:
On Wednesday, September 15, 2004, 2:01:43 PM, Jeff Chan wrote:
On Wednesday, September 15, 2004, 5:33:11 AM, Alex Broens wrote:
blacklist FP:
iaef.org.ar
Can you explain who they are and why we should whitelist them?
http://www.iaef.org.ar/e_iafei.asp
Looks like they are a non-profit association of financial executives. Probably not major spammers.
I am whitelisting them.
Thanks for spotting this Alex, but anyone proposing FPs, please try to include a little research or info about who they are.
I did the research... was just too lazy to paste it all. :-)
Alex
Jeff Chan wrote:
On Wednesday, September 15, 2004, 5:33:11 AM, Alex Broens wrote:
blacklist FP:
iaef.org.ar
Can you explain who they are and why we should whitelist them?
Argentine Financial Executives Association, non profit.
the equivalent of: British Financial Executives Association (http://www.cima.org.uk/) US Financial Executives Institute (http://www.fei.org/) Financial Executives Institute of Australia (http://www.fei.org.au) etc.
why? I doubt they'd spam... REALLY DOUBT IT.
There's one NANAE report from 2003 which I don't trust.
btw: Seems to me that there's been quite a few Argentine (*.ar) FPs lately. (and that not because its my place of birth :-)
h2h
Alex
On Wednesday, September 15, 2004, 2:39:04 PM, Alex Broens wrote:
iaef.org.ar
Argentine Financial Executives Association, non profit.
the equivalent of: British Financial Executives Association (http://www.cima.org.uk/) US Financial Executives Institute (http://www.fei.org/) Financial Executives Institute of Australia (http://www.fei.org.au) etc.
why? I doubt they'd spam... REALLY DOUBT IT.
Thanks I whitelisted all those ones too.
Jeff C.
On Wednesday, September 15, 2004, 12:46:00 AM, Alex Broens wrote:
Jeff Chan wrote:
On Tuesday, September 14, 2004, 11:03:08 PM, Alex Broens wrote:
I'm using a mysql DB for my data, every time a URI is added, the list gets exported into a local_zone and a surbl_zone file to upload to spamgate, expireing would be quite simple.
maybe SURBL should take a similar approach.
What is your expiration algorithm?
None so far. As its all very new, I'm still "collecting". On my local IP RBL I have 30 days, dunno yet what to use on URIs, I assume that using 6 months at least would be safe.
6 months sounds reasonable to me. 3 months could work also.
The way the sc data works is that it's refreshed by new reports or the records fall off the list after some number of days. In other words it's report-driven.
Jeff C.
Hi Chris,
Not all of these are listed in SURBL:
(Yes one day I hope to make this info availible to you.)
- 1: abrasions6681tabs.biz
- 2: absentia4304drug.biz
- 3: abstention2386tads.us
- 4: accordance3414drugs.biz
- 5: addable8060biz.com
In my list there are a gazillion more of those. Can send them offlist fo you can update your counting ;) I think you easilly double.
Bye, Raymond