Announce

announce@lists.surbl.org

183 discussions

three-level-tlds file added, abused hosts added to two and three level TLD files
by SURBL Announcement list [READONLY] 25 Feb '10

25 Feb '10

SURBL has created a three-level-tlds list that contains domains that should now be checked at the fourth level. It joins the existing list of two-level-tlds domains that should be checked at the third level. We also added some frequently abused web hosts into both of these TLD files, so they are no longer strictly CCTLD files, but should be able to function the same way for applications. We also moved the location of the files. For more information please see our Implementation Guidelines: http://www.surbl.org/implementation.html The new location of these files is: http://www.surbl.org/tld/two-level-tlds and: http://www.surbl.org/tld/three-level-tlds Please do not retrieve these files more often than once per day. They update only rarely. The old location will redirect to the new one for a while then go away eventually. Please update all SURBL applications accordingly. The TLD handling change is backward compatible, but there will be more detections if implemented. The updated TLD data in part come from: http://rulesemporium.com/rules/90_3tld.cf http://rss.uribl.com/hosters/hosters.txt http://publicsuffix.org/ https://wiki.mozilla.org/Gecko:Effective_TLD_Service http://mxr.mozilla.org/mozilla-central/source/netwerk/dns/src/effective_tld… http://svn.apache.org/repos/asf/spamassassin/branches/3.3/lib/Mail/SpamAssa… and ongoing but infrequent registry research.

1 0

RFC: Discontinuing rsync service of individual list zone files
by SURBL Announcement list [READONLY] 21 Dec '09

21 Dec '09

In March 2009 we stopped delegating public DNS service of individual list zones such as sc.surbl.org, ws.surbl.org, etc., since they are obsolete and all their data are included in multi.surbl.org. We would also like to stop rsync service for these files, again since their content is included in multi.surbl.org, which is the only zone anyone should be using. If anyone has feedback about this proposed change, then please contact us by email at rsync at our domain.

1 1

Experimental list: XS now contains snowshoe and pill domains, feedback wanted
by SURBL Announcement list [READONLY] 10 Dec '09

10 Dec '09

[Please send follow up discussions to: discuss at lists . surbl. org] An experimental source of some snowshoe and pill domains is now being published in xs.surbl.org. SURBL considers this feed to be experimental and would very much welcome feedback about it, particularly about any false positives. Does anyone know anyone who actually wants to receive snowshoe messages? Here's Spamhaus' description of snowshoe: http://www.spamhaus.org/faq/answers.lasso?section=Glossary#233 XS is not included in multi currently, so for testing purposes it must be specified as a standalone list. For SpamAssassin, a rule would be: urirhssub URIBL_XS_SURBL xs.surbl.org. A 2 body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL Contains an URL listed in the XS SURBL blocklist tflags URIBL_XS_SURBL net #reuse URIBL_XS_SURBL and a score would be: score URIBL_XS_SURBL 0 0.001 0 0.001 or whatever values you like. 0 would disable the test. 0.001 would be visible in headers and reporting, but likely not push a score over a threshold. 6.0 would block outright in most systems, etc. Remember to add the rule and score to a local.cf if you want it to persist across version upgrades. (As an aside, the SpamAssassin command urirhsbl should still work for an individual list, but arguably is obsoleted by urirhssub since the latter is just about universally used now and will handle the case of a standalone list too. More info at: http://spamassassin.apache.org/full/3.2.x/doc/Mail_SpamAssassin_Plugin_URID… ) For use in other systems, treat xs.surbl.org as it's own list and look for a 127.0.0.2 DNS A record result to indicate inclusion. IOW, you won't find it in multi yet. :) Here's a manual test: % dig difficultflamingos.com.xs.surbl.org [...] ;; QUESTION SECTION: ;difficultflamingos.com.xs.surbl.org. IN A ;; ANSWER SECTION: difficultflamingos.com.xs.surbl.org. 180 IN A 127.0.0.2 which of course may roll off the list when that particular record expires. Once it goes into production, XS would be included in multi, and this temporary, standalone test list would go away. ***The configs would need to be adjusted to use multi at that time, or the filtering for that source would go away.*** In other words, please don't put the standalone test list into production and leave it there. It will very likely go away later in favor of inclusion in multi. Note that testing XS after sender blacklists and other filtering techniques may result in XS not getting many hits. Note also that other types of data probably will be added to XS in future. Please test XS and send results to discuss at lists. surbl dot org

1 0

Most Abused TLDs report added
by SURBL Announcement list [READONLY] 03 Nov '09

03 Nov '09

SURBL has added a report of Most Abused TLDs. This is a daily count of the TLDs most commonly appearing in SURBL data and is an indication of relative abuse levels. http://www.surbl.org/tld-subtotals.head The TLD .cn is disproportionately represented, most likely due to persistent and widespread abuse by the "Canadian Pharmacy" botnet-using spam gang. http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Canadian%20Pharm…

1 0

ZeuS Tracker and Malware Domain List added to PH
by SURBL Announcement list [READONLY] 19 Oct '09

19 Oct '09

We've added a couple more malware data sources to the PH list: http://www.surbl.org/lists.html#ph 6/27/09: As of 27 June 2009, the PH list includes ZeuS Tracker malware host data. https://zeustracker.abuse.ch/ 10/18/09: As of 18 October 2009, data from Malware Domain List has been added to the ph list. http://www.malwaredomainlist.com/ Most of the data sources on the PH list are filtered to exclude significant sites that are cracked or abused. This is to reduce potential false positives on sites that are abused, but may be mentioned in significant volumes of hams.

1 0

DNS modification services can distort DNSBL results
by SURBL Announcement list [READONLY] 21 Aug '09

21 Aug '09

An increasing number of DNS services are being deployed to protect end users against and to monetize typo, malware, phishing and spam sites by redirecting web service to an alternate site. Generally they do this by changing the IP address or NXDOMAIN responses to DNS queries. Unfortunately these changes can adversely affect SURBL DNS responses and create false positives or false negatives. One way to test for this is to make sure that responses to SURBL DNS queries are in 127/8, or more specifically 127.0.0.0/24. While this won't fully determine correct results, it's still a recommended and good basic input verification test. A good solution is to run a local caching nameserver for DNS resolution, which can also improve performance. More information can be found at: http://www.surbl.org/faq.html#dnsproxy http://www.surbl.org/implementation.html http://www.surbl.org/public-dns.html

1 0

NS records removed from SURBL zone files
by SURBL Announcement list [READONLY] 23 Jun '09

23 Jun '09

We have removed the NS records from SURBL zone files. They're not needed on public nameservers since authority is delegated from the parent zone, and they're not needed on private nameservers since they would delegate authority back to the public servers. If needed you can add NS records appropriate to your local nameservers on your local copies of the zone, but again this should be unnecessary. The public nameserver NS records are available separately in the rsync directory as: ns.rbldnsd. Again these should not be needed by anyone. If you had local grep or sed filter expressions to remove the NS records from the zones for your local use, then they should no longer be needed.

1 0

Old rsync server gone
by SURBL Announcement list [READONLY] 07 Apr '09

07 Apr '09

The original rsync server that SURBL was using has gone away after many years due to companies merging, etc. We have been contacting rsync users over the past several months to try to get all moved over to newer servers and we were able to reach most about it. If you were on the old server and need rsync access, then please use the Data Feed request form: http://www.surbl.org/datafeed/ If you have questions, please contact us at rsync at our domain. Please note also the current usage policies: http://www.surbl.org/usage-policy.html

1 0

Individual SURBL lists to be shut down on public nameservers February 28, 2009. Use multi.
by SURBL Announcement list [READONLY] 02 Mar '09

02 Mar '09

For historical reasons, the SURBL public nameservers were serving individual lists ab, sc, ob and ws in addition to multi. However these individual lists have all been deprecated in favor of multi for several years since multi contains all lists. Traffic for the individual lists is relatively very low, and no one should be using them any more, so in order to reduce unnecessary and redundant network traffic we will be turning off public nameservice for the individual lists on February 28th, 2009. Everyone should be using multi.surbl.org instead, and this has been the case for many years now. Therefore if anyone is using the individual lists, please stop doing so and use multi instead. A single query to multi will check all SURBL lists. http://www.surbl.org/lists.html Cheers, Jeff C.

1 1

Message Partners' MPP multi-platform mail filter adds SURBL support
by SURBL Announcement list [READONLY] 14 Feb '09

14 Feb '09

Message Partners' MPP multi-platform mail filter and archival system supports SURBLs with MTAs "Postfix, Exim, Sendmail, Qmail, Communigate Pro, Surgemail, Sun Java System Messaging Server and email platforms with a generic SMTP/LMTP filter interface." http://www.messagepartners.com/mpp-products/ MPP can also support SURBLs through a SpamAssassin interface.

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Announce