Discuss November 2004

discuss@lists.surbl.org

44 participants
81 discussions

RE: [SURBL-Discuss] general questions.....
by Rob McEwen (PowerView Systems) 18 Nov '04

18 Nov '04

>maybe denying these by IP at firewall? Also, the IP address of the sending server is NOT necessarily the IP address of the NameServer the domain is assigned to. (Or maybe I'm misunderstanding you altogether) Also... I don't mean to be so negative... certainly, this is the kind of brainstorming that leads to great ideas. I'm just double-checking your ideas :) Rob McEwen

1 0

RE: [SURBL-Discuss] general questions.....
by Rob McEwen (PowerView Systems) 18 Nov '04

18 Nov '04

> AN example to my own question: > 63.251.163.112 Chris: (1) Why then is this IP address NOT listed in either SpamHaus (all lists) and NOT listed in dsbl.org? Is there **ANOTHER** RBL list which WOULD include this IP, but WITHOUT the kind of FPs that you get with many RBLs. (2) Could **other** legitimate mail be coming from that IP address. Certainly, such mail **deserves** to get blocked because of the "company it keeps"... but try explaining that to a client. Basically IP blocking is very drastic. Going from SURBL blocking to IP blocking is like using a sledgehammer rather than a surgeon's scalpel. I'm not against this approach. But consider that not everyone used SpamAssassin. Some programs can't automatically check the nameserver's IP against RBLs, etc. Also, I strongly recommend not taking these out of SURBL. Certainly, it would be good to encourage people to block in ways that save processing time and lookups where needed. But don't use that as an excuse to remove these because not everyone will be know to do this type of blocking and removing these from SURBL will give them a pass. (not to mention, what happens if the domain name stays the same, but switches hosting providers?) Rob McEwen

1 0

Astaro will release new version with builtin SA 3.01 and SURBL-support!
by Martin 18 Nov '04

18 Nov '04

Read the announcement here: http://www.astaro.org/showflat.php?Cat=&Number=52033&page=0&view=collapsed&… This is way cool! / Martin

1 0

Possible SURBL DNS poisoning attempt
by Doc Schneider 18 Nov '04

18 Nov '04

Nov 18 03:01:13 dns named[22511]: denied recursion for query from [24.14.194.168].137 for TRESPASSERS IN Nov 18 03:01:15 dns named[22511]: denied recursion for query from [24.14.194.168].137 for TRESPASSERS IN Just a headsup. I'm seeing these in my name server logs... obviously it isn't working on my server. Meaning this (comcast) virused machine is trying to (appears to be) injecting some type of data into my named (bind) server. Also am still getting a whole whale of surbl queries to the wrong IP/DNS server here. In other words servers are trying to get surbl returns from my bind server and not my rbldnsd server. -Doc

1 0

SURBL bomb
by Matthew Wilson 18 Nov '04

18 Nov '04

SURBL list, Has anyone seen any emails with hundreds of URIs - meant to overload filtering servers and the SURBL DNS servers, not poison them...? Matthew Wilson, MCSE (2003), MCSA-Messaging Network Administrator matthew(a)boomer.com Boomer Consulting, Inc. 610 Humboldt Manhattan, KS 66502 http://www.boomer.com 1-888-266-6375 x 17

6 7

Possible warning to users. Santa phish.
by Chris Santerre 16 Nov '04

16 Nov '04

I just got a spam that hit 2 SURBL domains. Advert for "Send your kids an email from santa!" How nice of spammers to not only tkae your $10, but harvest your children's email account and name as well. I'll be drafting up a warning to my users shortly. Others may want to do the same. Spread the love :) Content preview: Commercial Announcement ======================================= Get a Letter From Santa! Go here to get started: http://kelepouri113.com/ssnbpsq.php?oioWAHTwnlp94ooMSG_bcfchahj.3284859ioWAH Twnlp94oo22SJWMerchantsOverseas.comioWAHTwnlp94oo1027163931&f=493&i=1908 [...] Content analysis details: (5.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_HELO_PASS SPF: HELO matches SPF record 0.7 EXCUSE_6 BODY: Claims you can be removed from the list 0.8 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 0.2 HTML_90_100 BODY: Message is 90% to 100% HTML 0.6 MY_ALT RAW: Empty ALT uri 0.5 MY_NO_QU RAW: Q without a U 0.4 MY_OBFU_LONG RAW: One long word! 2.0 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: kelepouri113.com equalispecialvecto.com] --Chris (Santa don't need this crap right now!)

1 0

RE: [SURBL-Discuss] Should we list ratware?
by Chris Santerre 16 Nov '04

16 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, November 15, 2004 10:06 PM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] Should we list ratware? > > >On Monday, November 15, 2004, 8:13:18 AM, Chris Santerre wrote: >> MailinglistMaster.com > >Q: "Should we list ratware?" > >A: Only if the domain appears exclusively in spams. > A2: Or if the domain is responsible for one of the major tools for delivering spams. I sure the heck don't want anyone in my company getting an email with a link to their site. I'm guessing ISPs and colleges would feel the same. --Chris

1 0

RE: [SURBL-Discuss] FW: SURBL+ Checker Submission
by Chris Santerre 16 Nov '04

16 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, November 15, 2004 10:33 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] FW: SURBL+ Checker Submission > > >On Monday, November 15, 2004, 3:54:18 PM, David Funk wrote: >> On Mon, 15 Nov 2004, Chris Santerre wrote: > >>> Both domains in this submission are Whitelisted. Let me guess..... >>> >>> sina.com and 6to23.com appear in ham :/ >>> >>> --Chris > >> Not to dissapoint you Chris but sina.com is the Chinese equivalent >> of yahoo/geocities, big ISP (webmail, hosting, etc). >> Clearly whitelisting material. > >Yes, sina.com one of the globally most visited web sites according >to Alexa: > > http://www.alexa.com/site/ds/top_sites?ts_mode=global&lang=none > >6to23.com is also on the Alexa Global 500. > >Both have legitimate uses, so we don't list them. > LOL....Show offs! ;) I didn't know Dave could read Chinese :-) Well then they better clean up their act now, just like yahoo :/ --Chris

1 0

RE: [SURBL-Discuss] domain check dealsforrecruiters.net
by Chris Santerre 16 Nov '04

16 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, November 15, 2004 11:59 PM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] domain check dealsforrecruiters.net > > >On Monday, November 15, 2004, 12:47:43 PM, Chris Santerre wrote: >> I've got numerous reports on these guys. But I can't make up >my mind. But I >> have at least 6 spammy looking submitted mails. > >> so anyone got an opinion on dealsforrecruiters.net? > >FWIW It shows up on no RBLs. > >The real question is whether it has legitimate uses. Can >we tell from their web site? Their web site seems to offer >"Targeted-mail marketing" and it also seems to have a >subscription form. I did not try the subscription but >if it's open, perhaps vigilantes are signing up anti-spam >addresses to try to get these guys listed? If so that >would be highly annoying and a counterproductive waste of >our time, and I wish they would stop. > Agreed. I'm putting them on my watch closely list. They will go unlisted.....for now. --Chris

1 0

Keep getting this spam, not listed in multi.
by Martin 16 Nov '04

16 Nov '04

Hi, I've keep getting the same spam every now and then. I think i have reported this spam atleast 4 times on the submission form at rulesemporium.com. How come it won't be listed? The domain in the spam is http://www.pinksheetsMUNGED.com and the spam is about stocks. I get this spam reported almost every day from different users in our organization. This is 100% spam! When will this be added to multi? I can send the message in original if you want, just let me know. Thank you / Martin

3 5

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss November 2004