[SURBL-Announce] ANNOUNCE: New SURBL lists: ob, ab, multi

Jeff Chan jeffc at surbl.org
Wed Jun 30 04:58:47 CEST 2004


We are pleased to announce the availability of three new SURBL
lists:

  ob.surbl.org - OutBlaze spamvertised sites
  ab.surbl.org - AbuseButler spamvertised sites
  multi.surbl.org - Combined SURBL list

ob is a large list of about 20k spamvertised sites kindly
provided by OutBlaze and based on data found in their spam traps.
ob has a strong spam detection rate of around 70% and a low
false positive rate around 0.1%.  Only domains that have been
registered within the past 90 days are included in ob.surbl.org
and this "newness" requirement is probably one of the reasons
for the low FP rate, given how quickly spammers use and must
discard domains for their web sites.


ab is a smaller list of the top 425 or so spamvertised sites
over the past 7 days kindly provided by AbuseButler:

  http://spamvertised.abusebutler.com/

AbuseButler's data sources include SpamCop and native reports.
In general philosophy and data processing styles, ab.surbl.org
is similar to my own sc.surbl.org which is also based on SpamCop
data, and the results of both lists are similar, but not identical.


multi is a bitmask-combined version of all of the other lists
plus an anti-phishing list provided by Mail Security:

  http://www.mailsecurity.net.au/

The latter is identified as "ph" and it is not available as
a separate list as its size probably does not justify the
resources of its own zone file, etc.  However the data in ph
is important since it represents sites likely to be criminally
phishing for personal and financial information.

Because list membership in multi.surbl.org is encoded in a
bitmasked fashion, results from multi need to be decoded into
their constituent lists by programs such as urirhssub in
SpamAssassin 3.X.  Support for this decoding may be back-ported
into the SpamAssassin 2.63 program for using SURBLs, SpamCopURI.

We expect that multi.surbl.org will become the list of choice
for SURBL use going forward, due to the convenience of getting
all list data in a single list, only needing to cache a single
zone file, etc. 

More information about the all SURBL lists can be found at:

  http://www.surbl.org/lists.html


Please feel free to ask questions or leave comments about
SURBLs on our discussion list at:

  http://lists.surbl.org/mailman/listinfo/discuss

Please let us know about any false positives at:

  whitelist at surbl dot org

Cheers,

Jeff C.
-- 
Jeff Chan
mailto:jeffc at surbl.org
http://www.surbl.org/



More information about the Announce mailing list