01 June 2007 Changes (HHH) -------------------------- 1. Action: "live365.com" Added: GoodDomains[i++] = "live365.com"; Reason: Probably one of the most popular radio stations on the web. I think this SPAM rating is old but how would I know (8.1 per week?): http://www.siteadvisor.com/sites/live365.com 2. Action: "casino" From: // BadHostParts[i++] = "casino"; To: BadHostParts[i++] = "casino"; // No online Gambling Reason: See the count ... and this is in ONLY the Porn hosts! 142 casino_Parts.txt 24 casino_Starts_and_Ends.txt 185 casino_Passed_All_Rules.txt ------------------------------- 351 total Next, the "poker" rule 3. Action: "valueclick.net" Added: BadDomains[i++] = ".valueclick.net"; Reason: Well, Mike has tons of em and keeps adding more so why not? 4. Action: "valueclick.com" Removed: BadDomains[i++] = ".valueclick.com"; Reason: I have only found two more in MONTHS, oz.valueclick.com, and www27.valueclick.com So why keep it? I WILL KEEP IT FOR MYSELF ONLY AND FEED ALL RESULTS TO MIKE BURGESS. 5. Action: "spywareremove.com" Added: GoodDomains[i++] = "spywareremove.com"; Reason: Fri May 25 02:35:42: www.spywareremove.com/removeaccessexe.html (was trying to look up a summary of access.exe from download.popcorn.net - which I classify as a Trojan although it has its adware components. 6. Action: "dame" Added: BadHostParts[i++] = "dame"; Reason: Tue Apr 24 03:05:11: www.collegedames.com/content/\ mattsmodels/mia/thumbnails/tnMia2_mm024.jpg 30 dame_Parts.txt 20 dame_Starts_and_Ends.txt 105 dame_Passed_All_Rules.txt ----------------------------- 155 total 7. Action: "shutterstock.com" Added: GoodDomains[i++] = ".shutterstock.com"; Reason: TONS of thumbs. The maddening thing is that these people NEVER have a policy on Porn. They do have it though: http://www.shutterstock.com/s/porn/search.html Since it is less than 1% of their business ... 8. Action: "bluecoat.com" Added: GoodDomains[i++] = ".bluecoat.com"; Reason: Thu Apr 26 01:51:02: forums.bluecoat.com/\ templates/bcoat3/images/folder_new_hot.gif Thu Apr 26 01:51:02: forums.bluecoat.com/\ templates/bcoat3/images/folder_hot.gif "hot", but more to the point they are the K-9 forum. 9. Action: "free-graphics.com" Added: GoodDomains[i++] = ".free-graphics.com"; Reason: Thu Apr 26 13:49:00: www.free-graphics.com\ /clipart/Food_And_Drink/Breads_And_Cereals\ /Pancakes_-_Blueberry.shtml 10. Action: "tobaccofreeutah.org"; Added: GoodDomains[i++] = "tobaccofreeutah.org"; Reason: False positive of free and good example of a // PERSONAL RULE 11. Action: ".cnn.net" Added: GoodDomains[i++] = ".cnn.net"; Reason: Tue May 1 22:03:19: i.cnn.net/v5cache/TCM/Images/Dynamic/i53\ /nakedcity_cu_60x90_042420071236.gif i.cnn.net/v5cache/TCM/Images/Dynamic/i9\ /StreetcarNamedDesire_TR_104x78_042520031045.gif (I may remove this later on) 12. Action: ".tbs.com" Added: GoodDomains[i++] = ".tbs.com"; Reason: Fri May 18 19:35:45: i.tbs.com/v5cache/TBS/Images/Dynamic/i14\ /legally_blonde_80x100_030120051533.jpg (I may remove this later on) 13. Action: ".aolcdn.com" Added: GoodDomains[i++] = ".aolcdn.com"; Reason: Tue May 1 02:41:58: thumbnail.search.aolcdn.com/truveo/images\ /thumbnails/B9/BC/B9BC9A4653AD0C.jpg THIS IS AOL's PRIMARY THUMBNAIL SERVER. 14. Action: ".pbs.org" Added: GoodDomains[i++] = ".pbs.org"; Reason: May 11 07:10:18: www.pbs.org/wnet/secrets/ Tue May 15 20:05:00: www.pbs.org/opb/historydetectives/_gfx/pics\ /onthecase/girls_but2.jpg Tue May 15 20:09:17 www.pbs.org/opb/historydetectives/_gfx/pics\ /onthecase/girls_but2.jpg 15. Action: "eros" end rule altered From: BadURL_WordEnds[i++] = "eros"; To: BadURL_WordEnds[i++] = "[^h]eros"; Reason: Thu May 24 09:55:17: www.vmware.com/files/images/full_heros\ /home_hero_workstation.gif 01 June 2007 UNresolved False Positives (HHH) --------------------------------------------- 1. Pattern: "tgp" Rules: BadURL_Parts[i++] = "tgp"; Reason: www.tomshardware.com/Design/graphics/\ tomshardware/logo_tgpfoot.gif www.vmware.com/files/images/promos/\ ws_promo_tgp.gif www.symantec.com/content/en/us/enterprise/\ images/promo/ent-vista_sec_mktgpromo.jpg ANY IDEAS WHAT TO DO ABOUT IT? 2. Pattern: "chest" Rules: BadURL_WordStarts[i++] = "chest"; BadURL_WordEnds[i++] = "chest"; Reason: Wed May 16 10:11:41: images.bestbuy.com/BestBuy_US/en_US/images/global\ /features/gigrad_blueshirtchest_2007.jpg THE EASY SOLUTION WOULD BE TO ADD A GoodDomains ".bestbuy.com" RULE. THE PROBLEM IS: hope-chest drawer-chest, chest-of-jewels, treasure-chest, etc. Further, even the efficacy of the rule itself poses no reason to drop the rules from URL to HOST: 44 chest_Parts.txt 5 chest_Starts_and_Ends.txt 33 chest_Passed_All_Rules.txt 82 total 3. Pattern: "pee" Rules: BadURL_WordStarts[i++] = "pee[^nrv]"; BadURL_WordEnds[i++] = "pee"; Reason: Wed May 9 12:04:18 forums.bicycling.com/groupee_common\ /jscript/prototype.js For now I have a personal rule but I really worry about a rule this short. 01 June 2007 RESOLVED False Positives (HHH) ------------------------------------------- NONE