Discuss

discuss@lists.surbl.org

2 participants
1873 discussions

RE: [SURBL-Discuss] How effective is SURBL?
by Chris Santerre 23 Apr '04

23 Apr '04

>-----Original Message----- >From: Doc Schneider [mailto:maddoc@maddoc.net] >Sent: Friday, April 23, 2004 2:05 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] How effective is SURBL? > > > > > > What tools are people using to see what are the most hit rulesets? > >I've been thinking of writing a tool to check out some of >those rulesets >the spammy crap hits on. > >Figured if nothing else it would be fun! 8*)) > > > >-Doc How about working with the devs to have a function in SA to dump rule hits into a seperate log? Just rule hits. I'd buy that for a dollar! --Chris

3 3

RE: [SURBL-Discuss] How effective is SURBL?
by Chris Santerre 23 Apr '04

23 Apr '04

>-----Original Message----- >From: Don Newcomer [mailto:newcomer@dickinson.edu] >Sent: Friday, April 23, 2004 9:17 AM >To: SURBL Discussion List >Subject: [SURBL-Discuss] How effective is SURBL? > > >Look for yourself. Here are my top 10 rule hits for yesterday: > >18173 HTML_MESSAGE >11898 WS_URI_RBL >11871 MIME_HTML_ONLY >6951 SPAMCOP_URI_RBL >6847 CLICK_BELOW >6035 HTML_LINK_CLICK_HERE >5278 MIME_HTML_NO_CHARSET >5085 MY_SHRT_IMG >4993 COMBINED_FROM >4140 BE_URI_RBL > >Nice work, gentlemen! What's better is the fact that my system load >appears to have dropped considerably. Life is good... > Considering I also wrote MY_SHRT_IMG, this data makes me VERY happy ;) --Chris

3 2

RE: [SURBL-Discuss] Re: Bill Stearns' sa-blacklist available as S URBL: ws.surbl.org
by Chris Santerre 23 Apr '04

23 Apr '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, April 23, 2004 9:05 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Re: Bill Stearns' sa-blacklist >available as >SURBL: ws.surbl.org > > >On Friday, April 23, 2004, 5:25:06 AM, Raymond Dijkxhoorn wrote: >> So, when >> can we start using the combined lists :) > >We're waiting to hear back from Bill, Chris, Paul, et. al., >about whether they want to combine their rules before they >reach us. Should have a better idea after a conference >call this evening. > >Jeff C. > I think we will find that everyone wants to combine. Just need to find a 'trusted' way for us to all add to one. Emailing domains to one guy for them to add is NUTZ! Happens to me all the time :) --Chris

1 0

probable impact of cid:.* urls in uri_to_domain
by Yusuf Goolamabbas 23 Apr '04

23 Apr '04

Hi, Currently URIDNSBL.pm uses SA's get_uri_list to get a list of URI's from a message, the current regex seems to also get uri's of the form cid:random_characters in the list cid:.* seems to refer to content-ids,attachments in the same message when these uris are run through uri_to_domain, they return back the same result cid:.* My feeling is that a message can contain some artificial cid:.* url's which may skew the set of random domains used for SURBL lookup's I am not sure if cid:.* url's should be returned from get_uri_list() or they should be stripped correctly in uri_to_domain. Quite a few of the values after cid: seem to refer to host names/domain names Regards, Yusuf

3 3

[SURBL-Discuss] [Fwd: cloud-cuckoo-land: M-W's Word of the Day] (fwd)
by Don Newcomer 23 Apr '04

23 Apr '04

I was able to whitelist mail from these people but I'm wondering, more importantly, why they were picked up by the WS_URI_RBL rule. I used the new SURBL checking website and none of the URIs came up positive as far as I could tell. Any ideas? ================================================================================ Don Newcomer Dickinson College Senior Manager, Systems P.O. Box 1773 newcomer(a)dickinson.edu Carlisle, PA 17013 Phone: (717) 245-1256 FAX: (717) 245-1690 ---------- Forwarded message ---------- Date: Fri, 23 Apr 2004 08:44:44 -0400 From: Paul Levit <levitp(a)dickinson.edu> To: Don Newcomer <newcomer(a)dickinson.edu> Subject: [Fwd: cloud-cuckoo-land: M-W's Word of the Day] -------- Original Message -------- Return-Path: <bounce-mw-20902366(a)blast1.myfree.com> Received: from blast1.myfree.com by alpha.dickinson.edu (8.11.1/1.1.29.3/19Aug03-0302PM) id i3N9V0d0000454121; Fri, 23 Apr 2004 05:31:01 -0400 (EDT) Received: from lanai.startsampling.com ([64.85.80.203]) by blast1.myfree.com with SMTP (Lyris ListManager WIN32 version 6.1b); Tue, 20 Apr 2004 13:45:02 -0500 Received: (from nobody@localhost) by lanai.startsampling.com (8.11.6/8.9.3) id i3KIiD316859; Tue, 20 Apr 2004 11:44:13 -0700 Date: Thu, 22 Apr 2004 23:59:00 -0500 Message-Id: <LYRIS-20902366-1782963-2004.04.23-00.00.01--LEVITP#dickinson.edu(a)blast1.myfree.com> From: word(a)m-w.com To: LEVITP(a)dickinson.edu MIME-Version: 1.0 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: cloud-cuckoo-land: M-W's Word of the Day List-Unsubscribe: <mailto:leave-mw-20902366A@blast1.myfree.com> Reply-To: word(a)m-w.com X-Dickinson-MailScanner-Information: Please contact the ISP for more information X-Dickinson-MailScanner: Found to be clean X-Dickinson-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=3.876, required 3, BAYES_00 -4.90, CLICK_BELOW 0.10, DATE_IN_PAST_03_06 0.42, FREE_TRIAL 0.90, HTML_50_60 0.10, HTML_LINK_CLICK_HERE 0.10, HTML_MESSAGE 0.10, J_CHICKENPOX_16 0.60, MIME_HTML_ONLY 0.32, MK_BAD_HTML_02 0.68, MK_BAD_HTML_05 0.30, NO_REAL_NAME 0.16, WS_URI_RBL 5.00) X-MailScanner-From: bounce-mw-20902366(a)blast1.myfree.com <http://www.merriam-webster.com> <http://www.merriam-webster.com/game/> <http://www.wordcentral.com> <http://www.merriam-websterunabridged.com> *Did you share your favorite word with us? Visit our web site for details!* No Yes The Word of the Day for Apr 23 is: *cloud-cuckoo-land* \klowd-KOO-koo-land\ /noun/ : a realm of fantasy or of whimsical or foolish behavior <http://www.merriam-webster.com/sound/c/cloud_01.wav> *Example sentence: * If the boss really thinks he can up productivity and increase profit after the company is downsized, he is living in cloud-cuckoo-land. *Did you know? *In Aristophanes' 5th century B.C. comedy /Birds/, Peisthetaerus (a human) convinces the king of the birds and his followers to help him build an ideal city juxtaposed between heaven and earth. They plan to intercept all of the sacrifices rising from the earth to the gods on Olympus, thereby starving the gods into cooperating with them. The newly built city is dubbed "Nephelokokkygia," (from "nephos," meaning "cloud," and "kokkyx," the native European cuckoo). By the late 19th century, English speakers had translated the town's name as "Cloud-Cuckoo-Land" and had begun using it as a general term for any similarly unreal or whimsical place or situation. *Indicates the sense illustrated in the example sentence. <http://www.startsampling.com/sm/wod/redirector.iphtml?item=3243&url=http%3A…> ------------------------------------------------------------------------ You Are Subscribed As: LEVITP(a)dickinson.edu ------------------------------------------------------------------------ Subscribe to Word of the Day via the Web: click here <http://www.startsampling.com/sm/wod/register.iphtml> Unsubscribe to Word of the Day via the Web: click here <http://www.startsampling.com/sm/wod/changeofaddress.iphtml?email=LEVITP@dic…> To change the email format from html to text: click here <http://www.startsampling.com/sm/wod/changeofaddres s.iphtml> Questions about your subscription? click here <http://www.startsampling.com/sm/wod/faq.htm l> © 2004 by Merriam-Webster <http://www.Merriam-Webster.com>, Incorporated <http://www.startsampling.com/sm/wod/redirector.iphtml?item=3243&url=http%3A…> ------------------------------------------------------------------------ Word game lovers! Enjoy a free trial subscription to Merriam-Webster Unabridged and try our new brainteasers! click here <http://www.startsampling.com/sm/wod/redirector.iphtml?html=1&item=3243&url=…> ------------------------------------------------------------------------ <http://www.startsampling.com/sm/wod/redirector.iphtml?item=3243&url=http%3A…> <http://www.startsampling.com/sm/wod/redirector.iphtml?item=3243&url=http%3A…> *mf mwh 042304 LEVITP(a)dickinson.edu mf* If you cannot read this email, please copy and paste the following address into your web browser to subscribe to the text version of the Merriam-Webster Word of the Day: http://www.startsampling.com/sm/wod/changeofaddress.iphtml -- Paul Levit '71 Executive Director Information Technology Dickinson College Carlisle, PA 17013 717.245.1256 Promote, provide and support the effective use of information technology to advance Dickinson's mission and strategic goals.

2 5

How effective is SURBL?
by Don Newcomer 23 Apr '04

23 Apr '04

Look for yourself. Here are my top 10 rule hits for yesterday: 18173 HTML_MESSAGE 11898 WS_URI_RBL 11871 MIME_HTML_ONLY 6951 SPAMCOP_URI_RBL 6847 CLICK_BELOW 6035 HTML_LINK_CLICK_HERE 5278 MIME_HTML_NO_CHARSET 5085 MY_SHRT_IMG 4993 COMBINED_FROM 4140 BE_URI_RBL Nice work, gentlemen! What's better is the fact that my system load appears to have dropped considerably. Life is good... ================================================================================ Don Newcomer Dickinson College Senior Manager, Systems P.O. Box 1773 newcomer(a)dickinson.edu Carlisle, PA 17013 Phone: (717) 245-1256 FAX: (717) 245-1690

1 0

RE: [SURBL-Discuss] Re: Bill Stearns' sa-blacklist available as SURBL: ws.surbl.org
by Scott Truman 23 Apr '04

23 Apr '04

On Tuesday, April 20, 2004, 6:10:30 PM, Bill Landry wrote: > ----- Original Message ----- > From: "Jeff Chan" <jeffc(a)surbl.org> >> So the quick answer is they'll probably not be combined. >> >> However we probably will offer a combined version of Bill's >> list and Chris' BigEvil list since they are more similar in >> character. > Jeff, why not one DNS query that supports multiple result codes: > test: somedomain.com.sc.surbl.org > results: > 127.0.0.2 = Spamcop > 127.0.0.3 = WS List > 127.0.0.4 = BigEvil List > 127.0.0.5 = etc... > Same thing multi-test RBLs like AHBL, Sorbs, Blars, FiveTen, NJABL and > others do. That's pretty cool. One could even extend that as such (if they don't already): test: example.com.all.surbl.org ;) results: 127.0.0.2 = SC List 127.0.0.4 = WS List 127.0.0.8 = BigEvil List 127.0.0.16 = Someother List etc.... Multiple hits for the same lookup could be returned by combining the last octet i.e. a result of 127.0.0.10 would indicate the URI was found in both the SC and BigEvil lists. If one was only interested in what SC found, then one would AND the result with 127.0.0.2 just thinking out loud...

5 5

Statistics
by Doc Schneider 23 Apr '04

23 Apr '04

Gang, [root@newmail root]# grep SPAMCOP_URI_RBL /home/maddoc/mail/caughtspam|wc -l 361 [root@newmail root]# grep WS_URI_RBL /home/maddoc/mail/caughtspam|wc -l 213 [root@newmail root]# grep BE_URI_RBL /home/maddoc/mail/caughtspam|wc -l 92 [root@newmail root]# All this in 24 hours. Well I did NOT get my usual volume of spam, I did get enough. And FWIW it caught 99% and no FPs! Way kewl! -- -Doc --- MomNDoc Online Consultants http://www.maddoc.net/ momndoc(a)maddoc.net

1 0

ANNOUNCE: Mail::SpamAsssassin::SpamCopURI 0.14
by Eric Kolve 22 Apr '04

22 Apr '04

Release 0.14 is up on sourceforge.net. Sorry about all these releases. This is just a small one to fix the 'Modification of non-creatable array value attempted' error a few people have been seeing. You can fetch it at http://sourceforge.net/projects/spamcopuri --eric

2 4

ANNOUNCE: Mail::SpamAsssassin::SpamCopURI 0.13
by Eric Kolve 22 Apr '04

22 Apr '04

I have just released SpamCopURI 0.13. This release adds some basic query caching as well as registrar based lookups against the RBL. Instead of querying for both the 2nd and 3rd level domain we are now only querying for the 2nd OR the 3rd based on the TLD. Let me know if you see any issues with this: false positives, misses that should be hits, etc. We are now caching the query results on a per test basis so multiple URLs to the same to domain should only get checked once per RBL. There is also a change that fixes a compile error under Perl 5.005 reported on this list. Open redirect resolution is still off by default. I would like to hear how this has worked out for those that have enabled it. Do you think its safe enough to enabled it by default? The latest release can be retrieved from http://sourceforge.net/projects/spamcopuri --eric

5 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss