Announce

announce@lists.surbl.org

187 discussions

Deprecation of OB sublist, creation of MW malware sublist
by SURBL Announcement list [READONLY] 22 Oct '12

22 Oct '12

In order to keep improving SURBL data, we plan to reorganize some of the sublists inside the combined list multi as described below. OB -- OB sublist to be deprecated immediately Due to reduced effectiveness, SURBL will be deprecating the data in the OB sublist in a multi-stage process described below, with a the timeline at the end of this announcement. We will emptying the OB dataset beginning immediately. Since the current OB data are resulting in few detections, the effect of emptying the list should not significantly impact most production systems that are using the data. After the OB dataset has been empty for a period of time, we will be replacing bitmask bit 16 that OB currently uses with a new list described next. SURBL would like to sincerely thank the Outblaze team and their successor organization IBM for very kindly making the Outblaze data available to the SURBL community for several years. Special thanks go to Suresh Ramasubramanian and his colleagues for their many years of dedication in helping SURBL and the broader Internet community to stop messaging, botnet, malware, phishing and other forms of abuse. MW -- New malware sublist After some time with OB data emptied, the bitmask bit 16 formerly used by OB will be used by a new list MW which will consist of malware domains and IPs, most of which which are currently merged into the PH list. We had overloaded the phishing list PH with both phishing and malware data since they were somewhat related, but several users of SURBL data have expressed an interest in separate classifications for phishing and malware. Splitting those categories of data info separate sublists will make the distinctions between phishing and malware available for the whole SURBL community to use. Having a separate malware sublist should allow SURBL applications to make finer-grained, more accurate classifications and to perform better as a result. Some records may be on multiple lists. For example if a site has both phishing and malware, then it may be on both the PH and MW lists. Overlap between any datasets has been and will continue to be possible. Timeline: Deprecation of the OB dataset - Immediate Creation of the MW (malware) dataset - 1 May 2013 The documentation on the SURBL site will be updated the next few weeks to reflect the changes. It has not been updated yet. http://www.surbl.org/lists Recommended action: We recommend that SURBL application developers prepare to update their configurations according to these changes so they are ready when the changes are put into production on our name servers and zone files. Please direct followup discussion to the SURBL Discussion list.

1 0

SURBL Open Letter To Operators Of Redirection Sites updated with best practice recommendations
by SURBL Announcement list [READONLY] 24 Oct '11

24 Oct '11

SURBL has updated its Open Letter To Operators Of Redirection Sites by adding some best practice recommendations: http://www.surbl.org/redirection-sites They include: * Check links against URI Blacklists, * Recheck periodically including, if possible, when redirecting, * Deny link creation from malicious IP addresses, * Check the resolved IP addresses of the original url, * Disallow redirection to other redirectors, * Register an abuse contact role account at abuse.net, * Return an http status code of 410 when an abused redirector is removed.

1 0

ANNOUNCE: Some two-level-tlds accented characters changed to IDN
by SURBL Announcement list [READONLY] 04 Apr '11

04 Apr '11

Anthony Howe noticed that gcc was complaining about ISO 8859-1 accented characters used in the two-level-tlds file. With his kind help, we converted those to equivalent IDN representation. Diffs are: 278c278 < aéroport.ci --- > xn--aroport-bya.ci 893c893 < drøbak.no --- > xn--drbak-wua.no 1955c1955 < lea?gaviika.no --- > xn--leagaviika-52b.no 2835c2835 < osterøy.no --- > xn--ostery-fya.no 3554c3554 < tysvær.no --- > xn--tysvr-vra.no 3587c3587 < unjárga.no --- > xn--unjrga-rta.no 3650c3650 < vegårshei.no --- > xn--vegrshei-c0a.no As a practical matter this should have little operational impact since those domains are obscure and unlikely to be abused. Nonetheless, we thank Anthony for the correction.

1 0

SURBL at RSA
by SURBL Announcement list [READONLY] 29 Jan '11

29 Jan '11

SURBL will be exhibiting at RSA Conference 2011 in San Francisco, California from February 14 through 18 with our reseller http://www.mxtools.com/ MXTools at booth 1159. Please stop by and say hi if you use SURBL data. We'd love to meet you and let you know about our latest initiatives to improve SURBL data. You can use code EC11MXT to gain free access to the show floor and keynote addresses, a $100 value. Please feel free to share the code with friends.

1 0

three-level-tlds file added, abused hosts added to two and three level TLD files
by SURBL Announcement list [READONLY] 25 Feb '10

25 Feb '10

SURBL has created a three-level-tlds list that contains domains that should now be checked at the fourth level. It joins the existing list of two-level-tlds domains that should be checked at the third level. We also added some frequently abused web hosts into both of these TLD files, so they are no longer strictly CCTLD files, but should be able to function the same way for applications. We also moved the location of the files. For more information please see our Implementation Guidelines: http://www.surbl.org/implementation.html The new location of these files is: http://www.surbl.org/tld/two-level-tlds and: http://www.surbl.org/tld/three-level-tlds Please do not retrieve these files more often than once per day. They update only rarely. The old location will redirect to the new one for a while then go away eventually. Please update all SURBL applications accordingly. The TLD handling change is backward compatible, but there will be more detections if implemented. The updated TLD data in part come from: http://rulesemporium.com/rules/90_3tld.cf http://rss.uribl.com/hosters/hosters.txt http://publicsuffix.org/ https://wiki.mozilla.org/Gecko:Effective_TLD_Service http://mxr.mozilla.org/mozilla-central/source/netwerk/dns/src/effective_tld… http://svn.apache.org/repos/asf/spamassassin/branches/3.3/lib/Mail/SpamAssa… and ongoing but infrequent registry research.

1 0

RFC: Discontinuing rsync service of individual list zone files
by SURBL Announcement list [READONLY] 21 Dec '09

21 Dec '09

In March 2009 we stopped delegating public DNS service of individual list zones such as sc.surbl.org, ws.surbl.org, etc., since they are obsolete and all their data are included in multi.surbl.org. We would also like to stop rsync service for these files, again since their content is included in multi.surbl.org, which is the only zone anyone should be using. If anyone has feedback about this proposed change, then please contact us by email at rsync at our domain.

1 1

Experimental list: XS now contains snowshoe and pill domains, feedback wanted
by SURBL Announcement list [READONLY] 10 Dec '09

10 Dec '09

[Please send follow up discussions to: discuss at lists . surbl. org] An experimental source of some snowshoe and pill domains is now being published in xs.surbl.org. SURBL considers this feed to be experimental and would very much welcome feedback about it, particularly about any false positives. Does anyone know anyone who actually wants to receive snowshoe messages? Here's Spamhaus' description of snowshoe: http://www.spamhaus.org/faq/answers.lasso?section=Glossary#233 XS is not included in multi currently, so for testing purposes it must be specified as a standalone list. For SpamAssassin, a rule would be: urirhssub URIBL_XS_SURBL xs.surbl.org. A 2 body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL Contains an URL listed in the XS SURBL blocklist tflags URIBL_XS_SURBL net #reuse URIBL_XS_SURBL and a score would be: score URIBL_XS_SURBL 0 0.001 0 0.001 or whatever values you like. 0 would disable the test. 0.001 would be visible in headers and reporting, but likely not push a score over a threshold. 6.0 would block outright in most systems, etc. Remember to add the rule and score to a local.cf if you want it to persist across version upgrades. (As an aside, the SpamAssassin command urirhsbl should still work for an individual list, but arguably is obsoleted by urirhssub since the latter is just about universally used now and will handle the case of a standalone list too. More info at: http://spamassassin.apache.org/full/3.2.x/doc/Mail_SpamAssassin_Plugin_URID… ) For use in other systems, treat xs.surbl.org as it's own list and look for a 127.0.0.2 DNS A record result to indicate inclusion. IOW, you won't find it in multi yet. :) Here's a manual test: % dig difficultflamingos.com.xs.surbl.org [...] ;; QUESTION SECTION: ;difficultflamingos.com.xs.surbl.org. IN A ;; ANSWER SECTION: difficultflamingos.com.xs.surbl.org. 180 IN A 127.0.0.2 which of course may roll off the list when that particular record expires. Once it goes into production, XS would be included in multi, and this temporary, standalone test list would go away. ***The configs would need to be adjusted to use multi at that time, or the filtering for that source would go away.*** In other words, please don't put the standalone test list into production and leave it there. It will very likely go away later in favor of inclusion in multi. Note that testing XS after sender blacklists and other filtering techniques may result in XS not getting many hits. Note also that other types of data probably will be added to XS in future. Please test XS and send results to discuss at lists. surbl dot org

1 0

Most Abused TLDs report added
by SURBL Announcement list [READONLY] 03 Nov '09

03 Nov '09

SURBL has added a report of Most Abused TLDs. This is a daily count of the TLDs most commonly appearing in SURBL data and is an indication of relative abuse levels. http://www.surbl.org/tld-subtotals.head The TLD .cn is disproportionately represented, most likely due to persistent and widespread abuse by the "Canadian Pharmacy" botnet-using spam gang. http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Canadian%20Pharm…

1 0

ZeuS Tracker and Malware Domain List added to PH
by SURBL Announcement list [READONLY] 19 Oct '09

19 Oct '09

We've added a couple more malware data sources to the PH list: http://www.surbl.org/lists.html#ph 6/27/09: As of 27 June 2009, the PH list includes ZeuS Tracker malware host data. https://zeustracker.abuse.ch/ 10/18/09: As of 18 October 2009, data from Malware Domain List has been added to the ph list. http://www.malwaredomainlist.com/ Most of the data sources on the PH list are filtered to exclude significant sites that are cracked or abused. This is to reduce potential false positives on sites that are abused, but may be mentioned in significant volumes of hams.

1 0

DNS modification services can distort DNSBL results
by SURBL Announcement list [READONLY] 21 Aug '09

21 Aug '09

An increasing number of DNS services are being deployed to protect end users against and to monetize typo, malware, phishing and spam sites by redirecting web service to an alternate site. Generally they do this by changing the IP address or NXDOMAIN responses to DNS queries. Unfortunately these changes can adversely affect SURBL DNS responses and create false positives or false negatives. One way to test for this is to make sure that responses to SURBL DNS queries are in 127/8, or more specifically 127.0.0.0/24. While this won't fully determine correct results, it's still a recommended and good basic input verification test. A good solution is to run a local caching nameserver for DNS resolution, which can also improve performance. More information can be found at: http://www.surbl.org/faq.html#dnsproxy http://www.surbl.org/implementation.html http://www.surbl.org/public-dns.html

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Announce