Discuss December 2004

discuss@lists.surbl.org

43 participants
80 discussions

Rookie Question
by Kevin A. McGrail 03 Jan '05

03 Jan '05

OK. It's a silly question but I'd like to start submitting more of the SPAM I hand-filter for inclusion in the SURBL lists. For example, I'm being inundated with offers for free watches linking to http://*.nepel-MUNGED.com/ which redirects to http://www.online-replica-store-MUNGED.com/. What is the best process for me to take a known SPAM and get the ball rolling on something like this? Regards, KAM

7 21

help checking domain please
by Chris Santerre 30 Dec '04

30 Dec '04

OK, I have a hunch it may be spam. It was submitted to SURBL and it pretty much looks like spam, But hard to tell. Anyone help me out? http://www.ijting.com/index.asp?partner=dora Chris Santerre System Admin and SARE/SURBL Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.296 / Virus Database: 265.6.6 - Release Date: 12/28/04

3 4

RE: [SURBL-Discuss] Proflowers again, was: Send Holiday Flowers f or $24.99 plus Beautiful Glass Vase from Proflowers (fwd)
by Chris Santerre 30 Dec '04

30 Dec '04

>>> We've seen piles of spam promoting proflowers.com in the >past two days, >>> all containing asandox.com uris and arriving via an >asandox.com relay. >>> IMO asando.com (http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20781) is >> the uri that should be blocked, not proflowers.com. > > Thank you. That is exactly the right way to reason things. > If asando_ is the actual spamming affiliate or whatever, > then they should be the ones to block. " It raises an interesting philosophical question; is the original company that paid for the compaign and benefits from the sales responsible? I don't claim to have an all-seeing answer, and would like to hear other people's opinions. Cheers, - Bill " Stupid LookOut didn't quote your email :) Anyway......... It depends on the company. I believe _some_ clearly know they are hiring a spammer on the grounds that they can deny knowing it. I believe this percentage is rising. There are a few who don't know they are hiring spammers. Trying to figure out which is which is tough. But in this particular case, the correct thing was done by not listing the flower company. Add then to a watch list. If they show up on radar again, launch the stinger!! --Chris -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.296 / Virus Database: 265.6.6 - Release Date: 12/28/04

2 1

RE: [SURBL-Discuss] Zone File Rsync Server?
by Chris Santerre 29 Dec '04

29 Dec '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Tuesday, December 28, 2004 1:35 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Zone File Rsync Server? > > >Hi! > >> I have to get an ACL setup on the firewall that allows rsync >only to the >> surbl rsync server(s). I have not been able to find >documented anywhere >> what I/P's or server names to use. Can someone point me to >a document >> that provides this information? I would want to rsync multi >(hope this >> request makes sense :-)) >> >> Thanks for any help you can provide. > >You only get the IP once you are allowed to rsync, before that, its >useless to get the IP. We dont list the IP publicly with a >reason, so we >wont post if here either. > First rule of fight club........ ;) --Chris -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.296 / Virus Database: 265.6.6 - Release Date: 12/28/04

1 0

Zone File Rsync Server?
by Johnson, Robert F 28 Dec '04

28 Dec '04

I have to get an ACL setup on the firewall that allows rsync only to the surbl rsync server(s). I have not been able to find documented anywhere what I/P's or server names to use. Can someone point me to a document that provides this information? I would want to rsync multi (hope this request makes sense :-)) Thanks for any help you can provide.

3 2

Proflowers again, was: Send Holiday Flowers for $24.99 plus Beautiful Glass Vase from Proflowers (fwd)
by William Stearns 24 Dec '04

24 Dec '04

Good afternoon, all, We discussed proflowers earlier this year. To quote Jeff: > It also seems they're at least trying to cut back on spamming if we > accept the decrease in recent NANAS sightings. I just received 4 more spams from them, one attached. Perhaps they just get quiet between holidays? I'd like to place one vote for blacklisting them. Opinions? Cheers, - Bill --------------------------------------------------------------------------- "What is the most effective Windows NT remote management tool? A car." -- Network Intrusion Detection, An Analyst's Handbook 2nd Edition, 2000 Stephen Northcutt et al, page 147 (Courtesy of Rodrigo Goya <lucent(a)securenet.com.mx>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

5 8

RE: [SURBL-Discuss] phishing attempt
by Matthew Wilson 24 Dec '04

24 Dec '04

Jeff, I don't know if you ever got access to anti-phishing's phish archive; but if you didn't, you might put up a donation link on your site and solicit contributions that would specifically go toward paying for access to their database, for at least 1 year. Of course, if their database isn't updated as quickly as yours or isn't helpful for the first year, then you obviously wouldn't continue it... Just an idea... Matthew Wilson

2 1

phishing attempt
by Mariano Absatz 24 Dec '04

24 Dec '04

Hi David et al. Just got this phishing attempt referencing: http://211.235.248.74:280/index.php?Ihwt=NBKFdEjFBJRXqkQblivPGRDGUPJEYgMMTy… Cc-ing SURBL just FYI. The complete message is at the bottom. -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com Received: from louiskoo.com ([219.251.237.182]) by prxy6.uba.ar (8.12.10/8.12.10) with ESMTP id iBNB6ZEc035962 for <baby(a)ccc.uba.ar>; Thu, 23 Dec 2004 08:06:37 -0300 (ART) Received: from tcfexpress.com (tcfexpress.com [207.250.12.89]) by louiskoo.com with esmtp id 0D0E50BB10 for <baby(a)ccc.uba.ar>; Thu, 23 Dec 2004 14:07:24 +0300 Reply-To: TCF <support-auto23(a)tcfexpress.com> Message-ID: <110101c4e8df$85ab0d5f$624d22dc(a)tcfexpress.com> From: TCF Support <support-auto53(a)tcfexpress.com> To: Baby <baby(a)ccc.uba.ar> Subject: Debit Card Attention! Date: Thu, 23 Dec 2004 14:07:24 +0300 MIME-Version: 1.0 Content-Type: text/html X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.4682 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 X-GMX-Antivirus: 0 (no virus found) Return-Path: <support-auto53(a)tcfexpress.com> <html> <head><title>TCF - Bank</title></head><body> Dear TCF Client, Information to your attention: our bank is switching to newest transactions security standards. TCF ATM services utilize advanced security technology to protect your personal financial information. This security update will be effective immediately. <a href="http://211.235.248.74:280/index.php?Ihwt=NBKFdEjFBJRXqkQblivPGRDGUPJEYgMMTy…">Please click on this reference.</a> This security upgrade will be effective immediately and requires our customers to update their ATM card information. Thank you for contacting TCF. TCF Security Dept. </body> </html>

2 1

http://www.web-o-trust.org/
by Daniel Quinlan 23 Dec '04

23 Dec '04

(oops, that was sent before I was finished) This whitelist is probably a bit more directly usable than some of my suggestions. I don't know why I didn't think of it before, but Russell Nelson suggested it to me (it's his creation, of course). It should be fairly trivial (and I think there might be a tool for this) to walk the web-o-trust tree, produce a "lowest depth seen" for each domain and then start working through it. I don't know if there are bad entries if you go too deep on the tree. By the way, did I mention why I'm so keen on your whitelist? Once domain authentication becomes a reality, it will be a great source for whitelisting of authenticated senders. I believe Justin has looked at web-o-trust some, so I've copied him on the message. Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

2 1

Re: MIT Spam conference
by Daniel Quinlan 21 Dec '04

21 Dec '04

William Stearns <wstearns(a)pobox.com> writes: > I'll be attending the MIT spam conference this year, Jan 21st, > 9-5. Details at http://www.spamconference.org/ . The registration is > free, but they suggest an early registration before the conference fills > up. Last year, it was awesome to meet up with SpamAssassin developers and other anti-spam folks, but the MIT spam conference itself was disappointing for the second year in a row. It: - was full of poorly reviewed papers of anecdotal information - was unbelievably cold (both inside and outside) - uncomfortable to sit in circa-1965 wood chairs > I'd love a chance to meet other people working on spamassassin and > surbl. Is anyone else planning on attending? I'd love to meet you and other SURBL/SA people. If you want to attend a peer-reviewed anti-spam conference with heating, a pleasant climate, and comfortable seating, I can definitely recommend CEAS. If you're ever in the SF Bay Area and would like to get together, drop me a line. I've met with Jeff a few times. Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss December 2004