Announce

announce@lists.surbl.org

1 participants
191 discussions

Experimental list: XS now contains snowshoe and pill domains, feedback wanted
by SURBL Announcement list [READONLY] 10 Dec '09

10 Dec '09

[Please send follow up discussions to: discuss at lists . surbl. org] An experimental source of some snowshoe and pill domains is now being published in xs.surbl.org. SURBL considers this feed to be experimental and would very much welcome feedback about it, particularly about any false positives. Does anyone know anyone who actually wants to receive snowshoe messages? Here's Spamhaus' description of snowshoe: http://www.spamhaus.org/faq/answers.lasso?section=Glossary#233 XS is not included in multi currently, so for testing purposes it must be specified as a standalone list. For SpamAssassin, a rule would be: urirhssub URIBL_XS_SURBL xs.surbl.org. A 2 body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL Contains an URL listed in the XS SURBL blocklist tflags URIBL_XS_SURBL net #reuse URIBL_XS_SURBL and a score would be: score URIBL_XS_SURBL 0 0.001 0 0.001 or whatever values you like. 0 would disable the test. 0.001 would be visible in headers and reporting, but likely not push a score over a threshold. 6.0 would block outright in most systems, etc. Remember to add the rule and score to a local.cf if you want it to persist across version upgrades. (As an aside, the SpamAssassin command urirhsbl should still work for an individual list, but arguably is obsoleted by urirhssub since the latter is just about universally used now and will handle the case of a standalone list too. More info at: http://spamassassin.apache.org/full/3.2.x/doc/Mail_SpamAssassin_Plugin_URID… ) For use in other systems, treat xs.surbl.org as it's own list and look for a 127.0.0.2 DNS A record result to indicate inclusion. IOW, you won't find it in multi yet. :) Here's a manual test: % dig difficultflamingos.com.xs.surbl.org [...] ;; QUESTION SECTION: ;difficultflamingos.com.xs.surbl.org. IN A ;; ANSWER SECTION: difficultflamingos.com.xs.surbl.org. 180 IN A 127.0.0.2 which of course may roll off the list when that particular record expires. Once it goes into production, XS would be included in multi, and this temporary, standalone test list would go away. ***The configs would need to be adjusted to use multi at that time, or the filtering for that source would go away.*** In other words, please don't put the standalone test list into production and leave it there. It will very likely go away later in favor of inclusion in multi. Note that testing XS after sender blacklists and other filtering techniques may result in XS not getting many hits. Note also that other types of data probably will be added to XS in future. Please test XS and send results to discuss at lists. surbl dot org

1 0

Most Abused TLDs report added
by SURBL Announcement list [READONLY] 03 Nov '09

03 Nov '09

SURBL has added a report of Most Abused TLDs. This is a daily count of the TLDs most commonly appearing in SURBL data and is an indication of relative abuse levels. http://www.surbl.org/tld-subtotals.head The TLD .cn is disproportionately represented, most likely due to persistent and widespread abuse by the "Canadian Pharmacy" botnet-using spam gang. http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Canadian%20Pharm…

1 0

ZeuS Tracker and Malware Domain List added to PH
by SURBL Announcement list [READONLY] 19 Oct '09

19 Oct '09

We've added a couple more malware data sources to the PH list: http://www.surbl.org/lists.html#ph 6/27/09: As of 27 June 2009, the PH list includes ZeuS Tracker malware host data. https://zeustracker.abuse.ch/ 10/18/09: As of 18 October 2009, data from Malware Domain List has been added to the ph list. http://www.malwaredomainlist.com/ Most of the data sources on the PH list are filtered to exclude significant sites that are cracked or abused. This is to reduce potential false positives on sites that are abused, but may be mentioned in significant volumes of hams.

1 0

DNS modification services can distort DNSBL results
by SURBL Announcement list [READONLY] 21 Aug '09

21 Aug '09

An increasing number of DNS services are being deployed to protect end users against and to monetize typo, malware, phishing and spam sites by redirecting web service to an alternate site. Generally they do this by changing the IP address or NXDOMAIN responses to DNS queries. Unfortunately these changes can adversely affect SURBL DNS responses and create false positives or false negatives. One way to test for this is to make sure that responses to SURBL DNS queries are in 127/8, or more specifically 127.0.0.0/24. While this won't fully determine correct results, it's still a recommended and good basic input verification test. A good solution is to run a local caching nameserver for DNS resolution, which can also improve performance. More information can be found at: http://www.surbl.org/faq.html#dnsproxy http://www.surbl.org/implementation.html http://www.surbl.org/public-dns.html

1 0

NS records removed from SURBL zone files
by SURBL Announcement list [READONLY] 23 Jun '09

23 Jun '09

We have removed the NS records from SURBL zone files. They're not needed on public nameservers since authority is delegated from the parent zone, and they're not needed on private nameservers since they would delegate authority back to the public servers. If needed you can add NS records appropriate to your local nameservers on your local copies of the zone, but again this should be unnecessary. The public nameserver NS records are available separately in the rsync directory as: ns.rbldnsd. Again these should not be needed by anyone. If you had local grep or sed filter expressions to remove the NS records from the zones for your local use, then they should no longer be needed.

1 0

Old rsync server gone
by SURBL Announcement list [READONLY] 07 Apr '09

07 Apr '09

The original rsync server that SURBL was using has gone away after many years due to companies merging, etc. We have been contacting rsync users over the past several months to try to get all moved over to newer servers and we were able to reach most about it. If you were on the old server and need rsync access, then please use the Data Feed request form: http://www.surbl.org/datafeed/ If you have questions, please contact us at rsync at our domain. Please note also the current usage policies: http://www.surbl.org/usage-policy.html

1 0

Individual SURBL lists to be shut down on public nameservers February 28, 2009. Use multi.
by SURBL Announcement list [READONLY] 02 Mar '09

02 Mar '09

For historical reasons, the SURBL public nameservers were serving individual lists ab, sc, ob and ws in addition to multi. However these individual lists have all been deprecated in favor of multi for several years since multi contains all lists. Traffic for the individual lists is relatively very low, and no one should be using them any more, so in order to reduce unnecessary and redundant network traffic we will be turning off public nameservice for the individual lists on February 28th, 2009. Everyone should be using multi.surbl.org instead, and this has been the case for many years now. Therefore if anyone is using the individual lists, please stop doing so and use multi instead. A single query to multi will check all SURBL lists. http://www.surbl.org/lists.html Cheers, Jeff C.

1 1

Message Partners' MPP multi-platform mail filter adds SURBL support
by SURBL Announcement list [READONLY] 14 Feb '09

14 Feb '09

Message Partners' MPP multi-platform mail filter and archival system supports SURBLs with MTAs "Postfix, Exim, Sendmail, Qmail, Communigate Pro, Surgemail, Sun Java System Messaging Server and email platforms with a generic SMTP/LMTP filter interface." http://www.messagepartners.com/mpp-products/ MPP can also support SURBLs through a SpamAssassin interface.

1 0

SURBL Usage Policy announcement - grace period through Feb 28, 2009
by SURBL Announcement list [READONLY] 02 Dec '08

02 Dec '08

Dear member of the SURBL community: As a valued member of the SURBL community, we are contacting you to provide an update on changes that SURBL has made to its licensing and usage policies, in particular for rsync data feed access. SURBL is dedicated to helping the community detect unsolicited messages, and trust the service is working effectively for your organization. It's important that your organization is aware of these licensing changes to avoid any service interruptions. We are providing you this notice to ensure you are aware of the policy changes, and can help your organization to make a proactive decision. The primary objective of the SURBL project is to ensure that SURBL remains effective, of the highest quality, and sustainable over the long term. The goal is to provide a tool that remains available and effective for the Internet community to control the spiraling growth of unsolicited messages, particularly those sent using botnets. As such, SURBL is following a model that has proven successful in gaining the support of subscribers from its user community. The new licensing policy requires organizations exceeding 1,000 email users or 250,000 messages per day to register and sign up for the Sponsored Data Service (SDS). The funding will be used to enable SURBL to continue as a sustainable organization, and to enhance the effectiveness and capabilities of its service. The funding is, by design, very moderate and will provide much needed support to sustain this project. The needs of the SURBL user community have always been foremost in our planning. Some of the benefits to subscribers include direct access to technical support, the ability to whitelist web sites, and increased rsync updating frequencies. In addition, the whole SURBL community will benefit from expanded research to further improve the speed, completeness and accuracy of the list data. SURBL's vision is to continue to enhance the functionality, quality, and overall effectiveness for the entire user community. Please note that SURBL is allowing a grace period through Feb 28, 2009. Effective March 1, 2009 SURBL will begin restricting access to the datafeed service for unregistered users. Datafeed users who register for SDS prior to Jan 31, 2009, will receive 18 months service for the price of 12 months. SURBL has partnered with MXTools which will provide dedicated customer service and technical support. MXTools provides a similar role for Spamhaus, providing sales and support of the Spamhaus Datafeed Service. Please contact support(a)mxtools.com to provide feedback and to indicate your level of interest in the continued use of SURBL. Pricing information and registration can be found at: http://www.surbl.org/datafeed As valued members of the SURBL community, we appreciate your support, and ask for your help in this new licensing model. It is SURBL's desire that you'll continue to use the SURBL data and subscribe to the SURBL SDS to support the SURBL project. Sincerely, Jeff Chan William Stearns Joe Wein Raymond Dijkxhoorn Andy Warner SURBL http://www.surbl.org/ Arnie Bjorklund MXTools arnieb(a)mxtools.com http://www.mxtools.com/ 1-866-931-9228 Reference Information: SURBL usage policy: http://www.surbl.org/usage-policy.html MXTools - Authorized SURBL Representatives: http://www.surbl.org/datafeed SURBL Usage Policy SURBL data are updated more than 240 times daily and are provided to users worldwide via public DNS servers or via a data feed service. The former (DNS query) is completely free and subject to certain usage restrictions, while the latter (Data Feed) is a paid service. The revenue generated by the paid service ensures that SURBL can continue to reliably provide the information that hundreds of millions of users depend upon to keep their mailboxes and computers safe from messages that are unsolicited, phishing, or malware. Free Use: For individual users, small charitable or non-profit organizations, small businesses or any other organizations that have fewer than 1,000 users or that scan fewer than 250,000 messages per day in total, the SURBL Free Query Service (FQS) is completely free and can be accessed via a worldwide network of servers. This network of servers is geographically diverse to ensure a very high level of responsiveness and reliability. Sponsored Use: Any organization, including software developers, ISPs, or large organizations that provide email filtering (either as hardware, software or services, individually or as a combined offering) of 1,000 or more users SHOULD NOT be using the SURBL FQS. Instead they need to sign up for the Sponsored Data Service (SDS). SDS was developed to meet the professional needs of organizations and email technology providers who have a large number of mail messages to scan. As such it is far more efficient to conduct these scans against a local copy of the SURBL data. The SDS data are provided using an rsync feed that automatically updates the content with new additions. The SDS subscription fee includes unlimited access to our technical support team. SURBL monitors the use of the FQS to ensure that heavy users are not abusing FQS, which is reserved for use by small organizations and individual end users. ________________________________________ SURBL Usage Policy effective 10/1/08

1 0

SURBL public nameserver thanks
by SURBL Announcement list [READONLY] 14 Nov '08

14 Nov '08

Thanks to the folks who very kindly responded to requests for public nameservers, SURBL currently has sufficient public nameservers to serve the current levels of DNS traffic. We will keep open the possibility of requesting more nameservers if the traffic levels rise significantly in future. SURBL is grateful for the support of its public nameserver hosts for helping to make the project possible, and enabling free DNS queries for small and medium sized organizations.

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Announce