[SURBL-Discuss] RE: RFC: Removing example.com as a testpoint (Was: Re: [SURBL-Dis cuss] Re: No install Problems with 0.10)

Chris Santerre csanterre at merchantsoverseas.com
Tue Apr 20 10:07:50 CEST 2004



> -----Original Message-----
> From: Simon Byrnand [mailto:simon at igrin.co.nz]
> Sent: Monday, April 19, 2004 8:10 PM
> To: Jeff Chan; SURBL Discuss
> Subject: Re: RFC: Removing example.com as a testpoint (Was: Re:
> [SURBL-Discuss] Re: No install Problems with 0.10)

*snip*

>Sounds fine to me....(since no one else is commenting :)

>The whole idea of surbl relies on the fact that there is no legitimate way 
>that a spam url would be found in a genuine message. This isn't too hard 
>considering how obscure and obfuscated most spammer domain names 
>are...they're not the kind of thing that you'd write by accident in casual 
>conversation :)

Oh I wouldn't say that is 100% true!

The following are the rules I removed from BigEvil. They are "Shammers",
people who send spam AND ham.  So these were the domains I had to remove
even though they had sent lots of spam. The one company they get as a
customer to send ham forces your hand to remove them. SURBL will need to
create a list like this sometime soon. 

uri BigEvilList_W	/\b(?:exacttarget\.com|pandasoftware\.com)\b/i

uri BigEvilList_X
/\b(?:12\.156\.5\.69|platinumromance\.com|quickresponder4u\.biz|globalcomput
er\.com|emailfactory\.com|a801\.g\.akamai\.net|rsc03\.net|a904\.g\.akamai\.n
et|doubleclick\.speedera\.net|us\.i1\.yimg\.com|us\.js1\.yimg\.com|us\.news1
\.yimg\.com|thestar\.com|tm0\.com|smartbargains\.com|terra\.es)\b/i

uri BigEvilList_Y
/\b(?:destinationsite\.com|ccprod\.roving\.com|constantcontact\.com|akmaitec
h\.net|dobhran\.com|service\.bfast\.com|blockspamnow\.com|xmr3\.com|entertai
nment\.com|us\.a1\.yimg\.com|click\.atdmt\.com|adfarm\.mediaplex\.com|affili
atefuel\.com|ashnin\.com|bmgmusic\.com|clickserve\.cc-dt\.com)\b/i

uri BigEvilList_Z
/\b(?:mayco\.com|ediets\.com|flowgo\.com|politechbot\.com|servedby\.advertis
ing\.com|g\.trackbot\.com|promos\.hotbar\.com|home\.efax\.com|ipunda\.com|ld
\.net|m0\.net|mybonuscenter\.com|OpenRate\.ymc0\.net|petcarerx\.com|pmd\.bz|
qksrv\.net|registeredsite\.com|statik\.topica\.com)\b/i

Isn't this fun? :)

--Chris




More information about the Discuss mailing list