Discuss November 2004

discuss@lists.surbl.org

44 participants
81 discussions

more followup
by Steven Champeon 23 Nov '04

23 Nov '04

Having poked around some more, it seems that 1086 of those in Bill's list are IP addresses. Roughly 60 of these were already blacklisted here, and I've added the rest to my local ip bl. -- join us! http://hesketh.com/about/careers/web_designer.html join us! hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us! http://hesketh.com/about/careers/account_manager.html join us!

1 0

comparison of my local blacklist w/ws
by Steven Champeon 23 Nov '04

23 Nov '04

I've just grabbed Bill's list of domains and compared it to my local domains blacklist, with some interesting results. The following is a breakdown (expressed in line counts, each line representing a domain) of the similarities and differences. 27546 comparelists.intersection 155709 comparelists.notboth 117662 comparelists.onlyin.localbl 38046 comparelists.onlyin.sa-blacklist.current.domains 183256 comparelists.union Quick interpretation: my local blacklist has 117662 domains not listed in SURBL. Bill's file has 38046 domains not listed in mine. We only have 27546 domains in common. The counts are a bit off, I realize, as I've got a few entries that I've simply commented out as well as a comment or two. I've posted the files here: http://hesketh.com/schampeo/surbl/comparelists.intersection http://hesketh.com/schampeo/surbl/comparelists.notboth http://hesketh.com/schampeo/surbl/comparelists.onlyin.localbl http://hesketh.com/schampeo/surbl/comparelists.onlyin.sa-blacklist.current.… http://hesketh.com/schampeo/surbl/comparelists.union In case anyone wants to grab and poke around at these. Note that nospammerinhisrightmindwouldusethisdomain.com is just something I threw in for testing purposes, and well, should be obvious as to its farcical nature. -- join us! http://hesketh.com/about/careers/web_designer.html join us! hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us! http://hesketh.com/about/careers/account_manager.html join us!

1 0

Perl/PHP Guru required,
by Alex Broens 23 Nov '04

23 Nov '04

Guys, Need someone to write a perl or php script to parse the ws zone and pipe the entries into a mysql DB. any takers? Pls contact me off list Thanks Alex PS: this is NOT for commercial use - would make my URI data submissions more reliable and easier to handle. // can't program to save my life but can handle amazon wishlists //

2 1

Suggestion for surbl-checker on rulesemporium
by Martin 23 Nov '04

23 Nov '04

Hi, I have a suggestion for the surbl-checker att rulesemporium.com. What do you think of adding a date when a certain link were added to the surbl list(s). My users report spam not catched in a public folder on our server, once a day i submit all reported spam to the surbl-checker to see if it's blocked or not. Most of the time the spam are blocked, but it would be nice if i could see a date/time when the link was blocked. :) Thanks in advance / Martin

2 2

ws updating again
by Jeff Chan 23 Nov '04

23 Nov '04

The problems with ws.surbl.org not updating for the past day or so have been corrected. It looks like there was a bug in the updated rsync or linux distro that Bill had installed on his server. When he reverted back to an earlier version, rsync started working correctly again. Jeff C. -- "If it appears in hams, then don't list it."

1 0

abusebutler data back
by Jeff Chan 23 Nov '04

23 Nov '04

The ab.surbl.org data was missing for a few days while Andy Warner moved his AbuseButler colo server, but it's back up again, and AB is live again. Jeff C. -- "If it appears in hams, then don't list it."

1 0

RE: [SURBL-Discuss] general questions.....
by Chris Santerre 23 Nov '04

23 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, November 19, 2004 5:38 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] general questions..... > > >On Thursday, November 18, 2004, 12:13:26 PM, Chris Santerre wrote: >> About 15% of the spams I get are not in SURBL, but are by >the time I try to >> add :) > >Ask Terry Sullivan sometime what the theoretical maximum >detection rate of a collective spam classification system might >be. He had some research showing it maxes out at around 85%. >So we're probably already pretty close to the theoretical >limits of this type of system. Me thinks I need to google for more data on this :) > >> I have not done any study of domains that continue to try to >spam despite >> being in SURBL. Any numbers on these? Possibly the >most/longest hit domain >> in SURBL lookups?? > >> SHould we post the top 25 lookups to SURBL? > >You mean like: > > http://www.surbl.org/dns-queries.blocklist.counts.txt > Perfect! This is what I mean, block port 80 (or all ports for that matter) for Hits Domain 1875 imgehost.com Hosted by Electric Lightwave, eli.net. Domain List matching dns_a of 67.50.118.130 48 total matches * 1: 123onlinecash.com * 2: 500fastcash.com * 3: absoluteroi.com * 4: americash-online.com * 5: azooimages.com * 6: camasterd.com * 7: cashadvancenow.com * 8: cashbackvalues.com * 9: cashbuzz.com * 10: cbvmasterd.com * 11: costamasterd.com * 12: cvcmasterd.com * 13: d1masterd.com * 14: dabogus.com * 15: directdepositcash.com * 16: efastcashloans.com * 17: egcmasterd.com * 18: epointmasterd.com * 19: equity1auto.com * 20: equityoneauto.com * 21: ezcash-online.com * 22: fast-funds-online.com * 23: fastcashandgas.com * 24: fastcashusa.com * 25: financialhosting.com * 26: hostimages.net * 27: imagedataserver.com * 28: imagesbyaz.com * 29: imgehost.com * 30: imgserver.net * 31: inamasterd.com * 32: lighteningcash.com * 33: mbcashmasterd.com * 34: mycash-online.com * 35: myonlinepayday.com * 36: oledirect.com * 37: oledirect2.com * 38: oneclickcash.com * 39: paydaycity.com * 40: pclmasterd.com * 41: ptymasterd.com * 42: sellingsource.com * 43: smartshopperonline.com * 44: steaksofstlouis.com * 45: tpmasterd.com * 46: webfastcash.com * 47: xenlog.com * 48: yourfastcash.com By blocking port 80 (or all) at the firewall for this IP address, you don't have to worry about them getting new domain names. Only the worst cases should be blocked. If you have 48 spam domains on one host, you suck as an ISP :) I seriously would like to hear the ISP's argument for being unblocked on this one. --Chris

3 4

Phishing attempt
by Mariano Absatz 23 Nov '04

23 Nov '04

Hi David et al. for some reason my Thunderbird severed the topmost headers (including trace headers) for this message (see bottom) I got this weekend. However, it seems to me it's a phishing attempt from 210.127.248.68... the page doesn't seem to be up, anyway. Checking in http://www.rulesemporium.com/cgi-bin/uribl.cgi the address only hit sc. Regards. -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com From: "SunTrust Access Review" <holdaccount0115nf93797(a)suntrust.com> To: <baby(a)baby.com.ar> Subject: Banking Online Message IDXXX003014585815 Date: Fri, 19 Nov 2004 02:12:23 +0300 MIME-Version: 1.0 Content-Type: text/html; Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal <html> <head> <title>SunTrust Account Access</title> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"> </head> <body bgcolor=3D"#FFFFFF" text=3D"#000000"> <table width=3D"940" border=3D"0" cellpadding=3D"0" cellspacing=3D"0"> <tr> <td colspan=3D"2" height=3D"66" valign=3D"top"><img src=3D"http://www.r= ogueweb.com/logo_home.gif" width=3D"171" height=3D"66"></td> <td width=3D"562"></td> <td width=3D"107"></td> </tr> <tr> <td height=3D"9" width=3D"26"></td> <td width=3D"245"></td> <td></td> <td></td> </tr> <tr> <td height=3D"176"></td> <td colspan=3D"2" valign=3D"top"> Dear Valued Customer, SunTrust Banks Inc., is committed to maintaining a safe environme= nt for our customers. To protect the security of your account, SunTrus= t Banks Inc., employs some of the most advanced security systems in the wor= ld and our anti-fraud teams regularly screen the SunTrust system for u= nusual activity. We are contacting you to remind you that on Nov. 17, 2004 our Acco= unt Review Team identified some unusual activity in your account. In ac= cordance with SunTrust's User Agreement and to ensure that your account has = not been compromised, access to your account was limited. Your account = access will remain limited until this issue has been resolved. We encourage you to log in and perform the steps necessary to rest= ore your account access as soon as possible. Allowing your account acce= ss to remain limited for an extended period of time may result in furt= her limitations on the use of your account and possible account closure= . Click here to unlock your <a href=3D"http://210.127.248.68/personal/check= ing/OnlineBanking/Internet_Banking/index.php">online access.</a> </td> <td></td> </tr> <tr> <td height=3D"26"></td> <td></td> <td></td> <td></td> </tr> <tr> <td height=3D"95"></td> <td colspan=3D"2" valign=3D"top"> Thank you for your prompt attention t= o this matter. Please understand that this is a security measure meant to he= lp protect you and your account. We apologize for any inconvenience. Sincerely, Suntrust Banks Inc., Account Review Department </td> <td></td> </tr> <tr> <td height=3D"18"></td> <td></td> <td></td> <td></td> </tr> </table> </body> </html>

2 1

RE: [SURBL-Discuss] general questions.....
by Chris Santerre 22 Nov '04

22 Nov '04

>-----Original Message----- >From: David B Funk [mailto:dbfunk@engineering.uiowa.edu] >Sent: Saturday, November 20, 2004 12:31 AM >To: surbl(a)alexb.ch; SURBL Discussion list >Subject: Re: [SURBL-Discuss] general questions..... > > >On Thu, 18 Nov 2004, Alex Broens wrote: > >> Rob McEwen (PowerView Systems) wrote: >> >>Have any of you seen fewer spams? I don't see many these days. >> > >> > >> > Chris, >> > >> > Overall, I'm getting less and less spam. I think that >SURBL is getting better, some graymarketers are cleaning up >their acts, and my rules-based filering is also improving. >> > >> > However, a few days ago, I started getting slammed with >mortgage spam using the following domains: >> > >> > dalehaym.biz >> >> This I sent to SURBL on 2004-11-16 09:11:10 GMT +1 >> Why it never made it to the list is above me. >> >> Alex > >I think that something is wrong with the WS-surbl feed. >None of the entries that I've submitted in the past few days >have shown up in the ws.surbl list, usually they're posted >in less than an hour. > Actually thre is still a slight problem. One of the contributors on the submission list is swamped with work, and away from keyboard. We are having some technical issues removing him from the submission list. So he got a bunch that never got added. He forwarded them to me today. I will go thru. We are hoping to fix the problem soon. --Chris

1 0

general questions.....
by Chris Santerre 21 Nov '04

21 Nov '04

Have any of you seen fewer spams? I don't see many these days. About 15% of the spams I get are not in SURBL, but are by the time I try to add :) I have not done any study of domains that continue to try to spam despite being in SURBL. Any numbers on these? Possibly the most/longest hit domain in SURBL lookups?? SHould we post the top 25 lookups to SURBL? This way people can look at maybe denying these by IP at firewall? --Chris (I am an anal-retentive and highly-clueful well-motivated maniac.) ;)

6 6

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss November 2004