Guys,
Jeff's little XtraSmall (CBL Data) lust, ehhhmm, list seems to be catching quite a bit of trash.
give it a try:
urirhsbl URIBL_XS_SURBL xs.surbl.org. A 2 body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL URL listed in XS SURBL - TEsting tflags URIBL_XS_SURBL net score URIBL_XS_SURBL 1.5
Score to your taste !!!!!
Pretty sure Jeff is anxious to get FP reports.
h2h
Alex --
// no grey data here - its pi11z .-) //
On Tuesday, April 19, 2005, 6:43:56 AM, Alex Broens wrote:
Guys,
Jeff's little XtraSmall (CBL Data) lust, ehhhmm, list seems to be catching quite a bit of trash.
give it a try:
urirhsbl URIBL_XS_SURBL xs.surbl.org. A 2 body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL URL listed in XS SURBL - TEsting tflags URIBL_XS_SURBL net score URIBL_XS_SURBL 1.5
Score to your taste !!!!!
Pretty sure Jeff is anxious to get FP reports.
h2h
Alex
Thanks much Alex!
BTW, the list is about 1k records at the current levels, and it may be a little misleading to talk about 100 new records, because the total records in each category are greater:
Without any processing the current list has about 9k records:
8781 8781 111633 cbl-domains.all
Taking the 97th percentile of volume-ranked hits gives:
565 565 8416 cbl-domains.percentiled
The intersection of all with existing SURBLs is:
906 906 13459 cbl-domains.surbl
And the intersection of the percentiled and SURBL hits is
991 991 14817 cbl-domains.afterwhitelist
1k from 9k may seem like we're losing a lot, but the distributions look Zipfian: A few records get many hits and many records get a few hits, so there's a lot of "noise" down in the "few hits" range which may not be very useable. And even at this conservative setting, we're getting 97 percent of the CBL URI trap hits by volume, which can't be too bad.
Cheers,
Jeff C. -- "If it appears in hams, then don't list it."
Alex Broens wrote:
Guys,
Jeff's little XtraSmall (CBL Data) lust, ehhhmm, list seems to be catching quite a bit of trash.
give it a try:
urirhsbl URIBL_XS_SURBL xs.surbl.org. A 2 body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL URL listed in XS SURBL - TEsting tflags URIBL_XS_SURBL net score URIBL_XS_SURBL 1.5
I got a lint error on that. Should the first line be "urirhssub"?
Stuart Johnston wrote:
urirhsbl URIBL_XS_SURBL xs.surbl.org. A 2 body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL URL listed in XS SURBL - TEsting tflags URIBL_XS_SURBL net score URIBL_XS_SURBL 1.5
I got a lint error on that. Should the first line be "urirhssub"?
Or get rid of the 2 and leave it as urirhsbl?
Daniel
On Tuesday, April 19, 2005, 10:53:10 AM, Daniel Kleinsinger wrote:
Stuart Johnston wrote:
urirhsbl URIBL_XS_SURBL xs.surbl.org. A 2 body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL URL listed in XS SURBL - TEsting tflags URIBL_XS_SURBL net score URIBL_XS_SURBL 1.5
I got a lint error on that. Should the first line be "urirhssub"?
Or get rid of the 2 and leave it as urirhsbl?
Daniel
Yes, you're right. It should be:
urirhsbl URIBL_XS_SURBL xs.surbl.org. body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL URL listed in XS SURBL - TEsting tflags URIBL_XS_SURBL net score URIBL_XS_SURBL 1.5
without the 2 at the end of the first line.
Jeff C. -- "If it appears in hams, then don't list it."
On Tuesday, April 19, 2005, 10:40:53 AM, Stuart Johnston wrote:
Alex Broens wrote:
Guys,
Jeff's little XtraSmall (CBL Data) lust, ehhhmm, list seems to be catching quite a bit of trash.
give it a try:
urirhsbl URIBL_XS_SURBL xs.surbl.org. A 2 body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL URL listed in XS SURBL - TEsting tflags URIBL_XS_SURBL net score URIBL_XS_SURBL 1.5
I got a lint error on that. Should the first line be "urirhssub"?
urirhsbl is used for standalone lists, like xs is for now for testing.
urirhssub is used for combined lists like multi. xs will be put into multi after we finish testing, assuming it can be made to work well.
Jeff C. -- "If it appears in hams, then don't list it."
At 15:43 2005-04-19 +0200, Alex Broens wrote:
Guys,
Jeff's little XtraSmall (CBL Data) lust, ehhhmm, list seems to be catching quite a bit of trash.
give it a try:
After 24 hours, manual summary:
XL catches ~70% of what multi catches. XL catches practically nothing not already caught by multi. Almost all typical zero-hour spam that gets by multi also gets by XL. No FPs on XL.
If this trend continues, IMHO, to be useful, XL needs to be more aggressively tuned.
Patrik
Patrik Nilsson wrote:
At 15:43 2005-04-19 +0200, Alex Broens wrote:
Guys,
Jeff's little XtraSmall (CBL Data) lust, ehhhmm, list seems to be catching quite a bit of trash.
give it a try:
After 24 hours, manual summary:
XL catches ~70% of what multi catches. XL catches practically nothing not already caught by multi. Almost all typical zero-hour spam that gets by multi also gets by XL. No FPs on XL.
If this trend continues, IMHO, to be useful, XL needs to be more aggressively tuned.
Similar results here. In a few cases which XS trapped something new, SBL had it as well, 10 minutes later it was in multi - usually JP.
Definitely no FPs.
Alex
On 4/22/05, Alex Broens surbl@alexb.ch wrote:
If this trend continues, IMHO, to be useful, XL needs to be more aggressively tuned.
Similar results here. In a few cases which XS trapped something new, SBL had it as well, 10 minutes later it was in multi - usually JP.
Definitely no FPs.
Working very nicely here, we're tuning the score up a bit on it now. I'd say this is definately production worthy, although as suggested previously I wouldn't mind seeing what happens if it were made slightly more agressive.
-
Alex Broens -
Daniel Kleinsinger -
David Hooton -
Jeff Chan -
Patrik Nilsson -
Stuart Johnston