Discuss

discuss@lists.surbl.org

1867 discussions

Please remove SC2 rules or references
by Jeff Chan 04 Nov '05

04 Nov '05

Anyone using custom rules for sc2.surbl.org, please take them out now, since sc.surbl.org is using that data. Jeff C. -- Don't harm innocent bystanders.

1 0

okay to talk about sorbs here?
by George Georgalis 02 Nov '05

02 Nov '05

Before I started using spam.dnsbl.sorbs.net I tested a corpus of spam and ham and determined the best way to implement. But in the past 48 hours, mail relays from road runner, and cablevision have been added. http://www.us.sorbs.net/using.shtml spam.dnsbl.sorbs.net - List of hosts that have been noted as sending spam/UCE/UBE to the admins of SORBS. This zone also contains netblocks of spam supporting service providers, including those who provide websites, DNS or drop boxes for a spammer. Spam supporters are added on a 'third strike and you are out' basis, where the third spam will cause the supporter to be added to the list. While I appreciate sending the message to lame ISPs about controlling their users, adding these relays to the blacklist causes a lot of false positives. Has sorbs been reasonable in their judgment to add them, how often does it take 30 million (or whatever) random subscribers to produce 3 spams, and what is reasonable for an ISP to do about it? I have filled out their (sorbs) complex web support forms before, on behalf of a 3rd party, and never got a response. Now, since I'm complaining about relays being added that aren't mine, I cannot even get through the questions to a dialog I can enter my observation (when I properly answer the questions). Unfortunately for me this is 2 strikes and you're out, sorbs. Is there a good alternative for spam.dnsbl.sorbs.net? // George -- George Georgalis, systems architect, administrator <IXOYE>< http://galis.org/ cell:646-331-2027 mailto:george@galis.org

4 6

Re: RFC: multi.surbl.org testpoint A record value
by Frank Ellermann 02 Nov '05

02 Nov '05

Jeff Chan wrote: > Does anyone have any comments or preferences for either > style? Why set bit 7 if there is no 7th set at the moment ? It would be nice in my test output. OTOH I added support for bits 8..15 a year ago because that's what you wanted, and for that you could also use 127.0.255.126. === test output today (truncated) === 127.0.0.2 (------1-): .ix.dnsbl.manitu.net 127.0.0.2 (------10): .combined.njabl.org 127.0.0.2 (---43210): .opm.blitzed.org 127.0.0.2 (------1-): .multi.surbl.org 127.0.0.2 (-----21-): .sbl-xbl.spamhaus.org === demo output for 127.0.0.126 === 127.0.0.2 (------1-): .ix.dnsbl.manitu.net 127.0.0.2 (------10): .combined.njabl.org 127.0.0.2 (---43210): .opm.blitzed.org 127.0.0.2 (7654321-): .multi.surbl.org 127.0.0.2 (-----21-): .sbl-xbl.spamhaus.org === demo output for 127.0.255.126 === 127.0.0.2 (------1-): .ix.dnsbl.manitu.net 127.0.0.2 (------10): .combined.njabl.org 127.0.0.2 (---43210): .opm.blitzed.org 127.0.0.2 (FEDBCA987654321-): .multi.surbl.org 127.0.0.2 (-----21-): .sbl-xbl.spamhaus.org These "aesthetical considerations" are just for fun, if there are no more serious arguments at all. Bye

2 2

RFC: multi.surbl.org testpoint A record value
by Jeff Chan 02 Nov '05

02 Nov '05

Previously, each SURBL zone file, including the bitmask combined list multi.surbl.org, had testpoitns with A records resolving to 127.0.0.2. That was a design decision, and it was also convenient to the way the zone files were generated before. But Justin Mason or one of the other SpamAssassin developers argued that multi should have testpoints corresponding to all ones in each bitmask position. So one of the changes with the new SURBL engine now running is that the multi testpionts do have all the bits set for an A record value of 127.0.0.126 instead of 127.0.0.2 . This may work better with applications that decode the bits properly into individual list results, but it is a change from before and it may break other applications' use of the testpoints. Does anyone have any comments or preferences for either style? Jeff C. -- Don't harm innocent bystanders.

1 0

New engine, sc2 ready
by Jeff Chan 29 Oct '05

29 Oct '05

After everyone's help testing the revised SC2 data and my writing some code, the new SURBL engine and SC2 data are ready to roll out. SC2 will become the production SC SpamCop-based list. It will catch significantly more spam than the older version. New new engine also features a faster cycle time, more uniform handling of all the data, etc. Unless there are objections, I think I'll probably just start rolling it out and announcing the change when it's done. The process should be seamless and invisible to end users and DNS admins, aside from a higher SC detection rate and some minor improvements elsewhere. Questions? Comments? Jeff C. -- Don't harm innocent bystanders.

1 0

domain "domain" blacklisted
by Jose Marcio Martins da Cruz 28 Oct '05

28 Oct '05

Hi, The domain "domain" 8-) is listed at jp and generated a false positive (at one of our users). Can you whitelist it please ? domain :127.0.0.64:Blocked, domain on lists [jp], See: http://www.surbl.org/lists.html Regards, Jose-Marcio -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

2 2

uk DOT geocities DOT com
by Frank Ellermann 13 Oct '05

13 Oct '05

Hi, please remove uk. geocities .com from all white lists and/or add it manually to local URIBLs, it's a black hat. Bye, Frank <news://news.spamcop.net/43456728.12D5@xyzzy.claranet.de>

10 32

use of surbl to check non-body content?
by Steven Champeon 12 Oct '05

12 Oct '05

I've noticed that SURBL (and URIBL, who I will contact later) lists several domains that have appeared in spam header contents as well as in body contents. I'd like to use SURBL (probably multi) as an optional domains BL check against headers known to contain domains, such as the Message-ID, From, and Reply-To headers, a la Message-Id: <200510020442.j924gBkv021479(a)expoactive.net> From: ExpoActive <advertising(a)expoactive.net> Reply-To: advertising(a)expoactive.net From: "Steven McGuire" <stevenmcguire(a)aaaaa2.com> List-Unsubscribe: <mailto:leave-2005_1-6m_optin-10289508G@aaaaa2.com> Message-Id: <LYRIS-10289508-169-2005.10.03-20.50.13--{vic#tim}(a)aaaaa2.com> From: "iMarketing Sales Leads" <julieandrews(a)imailzone.info> Reply-To: "OAG" <club(a)reachmail.net> From: TuneUp Software Newsletter <newsletter(a)tune-up.com> Reply-To: newsletter4v2-reply(a)newsletter.tune-up.com From: "Solutions" <info(a)disklesspc.com> Reply-To: info(a)disklesspc.com From: "Millionaires Concierge" <info(a)millionaires-concierges1.com> Reply-To: info(a)millionaires-concierges1.com Message-Id: <200510020442.j924gBkv021479(a)expoactive.net> From: ExpoActive <advertising(a)expoactive.net> Reply-To: advertising(a)expoactive.net As I've only received 23 spams not otherwise classifiable as worth blocking using other means (e.g., 419 scams which can be blocked by injection IP) this /month/, having successfully blocked all the rest, I'd really like to take advantage of the realtime nature of SURBLs. I could see immediate results in the form of blocking literally 1/3 of the remaining spam I allow in here. Comments? This would be an optional configuration for my enemieslist package, which I intend to have more widespread distribution eventually but which would not represent a crushing query load at present. -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com antispam news, solutions for sendmail, exim, postfix: http://enemieslist.com/

4 10

Re: [SURBL-Discuss] use of surbl to check non-body content?
by Jeff Chan 12 Oct '05

12 Oct '05

[Rob confirmed he meant to send his reply below to the list. Here's my reply to his (unintentionally) private reply.] On Wednesday, October 12, 2005, 7:14:51 AM, Rob McEwen wrote: >>Were you resolving SURBL domains >>then checking resolved IPs against header IPs? > No, I wasn't. Even though IPs on SURBL are rare, when they do occur, they > are prime candidates for FPs if/when checking headers. > Of course, SURBL FPs on the body of the message are already extremely > rare... But, even so, because we've been constantly making improvements in > that area as well, it is entirely possible that SURBL FPs when checking > against headers might be MORE rare now than in previous months... again, > this being due to our steady and constant across-the-board improvements. While it's true that many of the IPs that appear on SURBLs are probably zombies and those zombies could be used as senders, this is straying pretty far from the original purpose of the lists. Probably something like CBL or XBL would be much better general compromised sender lists to check against message headers. Even something like a Dynamic IP list like dynablock.njabl.org may be a better indicator of zombie-ness. I have not done any research, but far more of the zombies are probably on those lists than as IPs on SURBLs. BTW you sent your reply privately. May I post this? Jeff C. -- Don't harm innocent bystanders.

1 0

Geocities ( and other free/anon hosts...) treated as virtual TLDs
by Eric Montréal 10 Oct '05

10 Oct '05

Hi, I'm new here, so sorry if this have been previously debated. I have seen your discussion about blacklisting geocities. This would create so many FP it's clearly impossible, but I wonder if treating these domains as 3rd / 4th level TLD could be the way to go ... Example: This (-munged) real spammy address http://uk.geocities-munged.com/Gonzalo_Freehling/ could be translated into gonzalo_freehling.uk.geocities-munged.com and then queried ... The translation would require some specific code for these 'virtual TLD' domains in URIDNSBL.pm (for SA3) but would allow catching otherwise undetected URI, while having no FP for non spammy geocities sites. For it to work, the 'virtual TLD' domains should be flagged, either by setting a specific bit in the returned data (during normal queries to the domain) or maintaining a downloadable list. Does it make sense ?

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss