Discuss December 2004

discuss@lists.surbl.org

43 participants
80 discussions

list of TLDs
by Daniel Quinlan 02 Dec '04

02 Dec '04

I got a long list of TLDs from John Levine, he made no promises about accuracy (quite the opposite), so I suspect there are some mistakes, but I yield it to you. Please let us know if any TLDs should be added to the SpamAssassin URIBL module, though. ;-)

4 3

using local cache?
by Ronan 02 Dec '04

02 Dec '04

hi i posted a mail similar to this on the spamassassin list but its more appropriate to this list... how do i check that my local multi.surbl.org bind file that i put into our DNS is the one being checked when doing SURIBLs lookups? Is there anyway to check who is checking DNS records? I do a spamassassin --lint -D and there is no mention of which DNS server its querying... any other hints?? ronan -- Regards Ronan McGlue ============== Analyst/Programmer Information Services Queens University Belfast BT7 1NN

1 0

RE: [SURBL-Discuss] FP: rgc3.net
by Chris Santerre 02 Dec '04

02 Dec '04

>-----Original Message----- >From: Rob McEwen (PowerView Systems) [mailto:rob@powerviewsystems.com] >Sent: Wednesday, December 01, 2004 2:19 PM >To: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] FP: rgc3.net > > >RE: rgc3.net > >After looking into this some more, I also found it in the >header of a legitimate OfficeDepot newsletter > 1) Its in the header, so don't worry. 2) Total scumbags! http://spews.org/html/S975.html 3) OfficeDepot should be notified. 4) I think this was discussed on Spam-L, that they were fooling legit companies. 5) You will see om-xxxxx.rgcx.net in many headers of spam. 6) If you need more, I'd ask the Spam-L guys. RSK could educate you ;) I believe Playboy actually used them until they found out they were scum. --Chris

3 2

RE: Image Composition Analysis
by Chris Santerre 02 Dec '04

02 Dec '04

Yeah this is a definite candidate for SURBL. This is the Huntsville-consulting spam gang: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL20528 353+ domains diretly linked. This is going to be the next trend. The final destination of this pron spam was throatstuffers . com, but it used a throw away domain of marlacell . com as a forwarder. Not directly either. That domain simply hosted a mirrored page of throatstuffers . com. We are seeing an increase in throw away domains being used to reroute to other domains that will NEVER show up directly in a spam. All in attempts to get passed SURBL. No biggy, the more pople that submit and manage SURBL the faster they get added. However there has been discussion on blocking the final destinations via web proxy's and host files. I think we will begin to see an increase in companies blocking these IPs or domains at the firewall or proxy server. Its actually helping some antispammers. We are able to tie more spammers together thru looking at who is trying to get passed SURBL thru throw away domains. Some of the small guys are only rogues of the bigger ones. We got people watching spammers six ways from Sunday. Funny how much they don't realise we know ;) --Chris >-----Original Message----- >From: Smart,Dan [mailto:SmartD@VMCMAIL.com] >Sent: Wednesday, December 01, 2004 4:57 PM >To: spamassassin-users(a)incubator.apache.org >Subject: RE: Image Composition Analysis > > >Attached is the spam that got through. I changed the porn URL to not >offend. It's a little mangled as it was forwarded by the user >via Outlook, >and tags got mangled by my Sanitizer. > >I capture the headers of all files, and here is what they look >like. The >bayes = 0 is what got this through. > ><<Dan>> > >======================================== >From filter Wed Nov 3 01:29:14 2004 >Return-Path: <Bebeskbs(a)kmanus.com> >Received: from great.amberalist.com (great.amberalist.com >[209.200.9.222]) > by dalton.vul.com (Vulcan E-mail Relay) with SMTP id 56BD89BB2C > for <xxxxxxx(a)vmcmail.com>; Wed, 3 Nov 2004 01:29:14 >-0600 (CST) >Received: from mail pickup service by kmanus.com with >Microsoft SMTPSVC; > Wed, 3 Nov 2004 14:17:54 -0800 >Received: from 194.3.74.35 by by7fd.bay7.kmanus.com with HTTP; > Wed, 3 Nov 2004 14:17:54 GMT >X-Originating-IP: [194.3.74.35] >X-Originating-Email: [Bebeskbs(a)kmanus.com] >X-Sender: Bebeskbs(a)kmanus.com >From: Bebe <Bebeskbs(a)kmanus.com> >To: XXXXX <XXXXXXX(a)vmcmail.com> >Subject: re: our appreciation >Date: 3 Nov 2004 14:17:54 -0500 >Mime-Version: 1.0 >Content-type: text/html >Message-ID: <SR0-81197F1166274AB5A8701DBB47173D6E(a)kmanus.com> >X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on >dalton.vul.com >X-Spam-DCC: : dalton 1182; Body=1 Fuz1=1 Fuz2=1 >X-Spam-AWL: Auto_Whitelist= >X-Spam-Status: No, hits=1.7 required=6.5 >tests=BAYES_00,CP_RANDOMWORD_10, > HTML_MESSAGE,MIME_HTML_NO_CHARSET,MIME_HTML_ONLY,OB_URI_RBL, > RCVD_IN_SBL,SARE_HTML_FSIZE_1ALL,WS_URI_RBL autolearn=no >version=2.64 >X-Spam-Level: * >Status: RO >X-Status: >X-Keywords: >X-UID: 1219 > >====================================== ><<Dan>> > > > > >> -----Original Message----- >> From: John Andersen [mailto:jsa@pen.homeip.net] >> Sent: Wednesday, December 01, 2004 2:45 AM >> To: spamassassin-users(a)incubator.apache.org >> Subject: Re: Image Composition Analysis >> >> On Tuesday 30 November 2004 01:27 pm, Smart,Dan wrote: >> >> > Catching image only E-mail with pornographic images is >> really difficult. >> > My users are offended when they get one, and wonder how I >> could not >> > catch it. Explaining that the document was text, filled >with bayes >> > poison, and the one porn image with no porn words in the document >> > doesn't seem to have much of an impression on them. >> >> Open the image with a text editor and challenge them to >> determine if it is spam or not. >> >> Really, people this dumb should not be turned loose on the internet. >> >> -- >> _____________________________________ >> John Andersen >> > >

3 2

FP: rgc3.net
by Rob McEwen (PowerView Systems) 01 Dec '04

01 Dec '04

Potential False Positive: If found the following in a header of an e-mail that was a legitimate Realtor.com/HomeStore newsletter: rgc3.net Examine e-mail here: http://www.pvsys.com/fp.txt (I know that SURBL is not suppose to be used to check headers... but this still raises a red flag that this domain would be found in such a legit newsletter) Thanks, Rob McEwen

2 1

Re: [SURBL-Discuss] FP: rgc3.net
by Rob McEwen (PowerView Systems) 01 Dec '04

01 Dec '04

RE: rgc3.net After looking into this some more, I also found it in the header of a legitimate OfficeDepot newsletter Rob McEwen

1 0

RE: [SURBL-Discuss] virtumundo.com
by Paul Schwarz 01 Dec '04

01 Dec '04

Shows up on this page http://www.stearns.org/sa-blacklist/sa-blacklist.current.domains Paul Schwarz -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan Sent: Wednesday, December 01, 2004 11:06 AM To: Paul Schwarz Cc: 'SURBL Discussion list' Subject: Re: [SURBL-Discuss] virtumundo.com On Wednesday, December 1, 2004, 6:47:37 AM, Paul Schwarz wrote: > Why doesn't multi.surbl.org stop > virtumundo.com > It is listed in the ws.surbl.org if I look it up manually > the online surbl lookup tool doesn't detect it either. It's not listed for me: % dig virtumundo.com.ws.surbl.org a ; <<>> DiG 8.3 <<>> virtumundo.com.ws.surbl.org a ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10041 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUERY SECTION: ;; virtumundo.com.ws.surbl.org, type = A, class = IN Jeff C. -- "If it appears in hams, then don't list it." _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: [SURBL-Discuss] Hi I'm new and I like SURBL
by Paul Schwarz 01 Dec '04

01 Dec '04

Thank you for your response ! Who on this list was using greylisting and then decided to turn it off. Looking for more feedback. What rates of spam detection are you getting with surbl ? And what methods do you use to complement it. I would like to run some RFC checks but some of them seem to stringent.... I.E - Reverse PTR checks, etc Thanks again ! Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100 -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Chris Santerre Sent: Tuesday, November 30, 2004 9:53 AM To: 'SURBL Discussion list' Subject: RE: [SURBL-Discuss] Hi I'm new and I like SURBL >-----Original Message----- >From: Paul Schwarz [mailto:Paul.Schwarz@starktruss.com] >Sent: Tuesday, November 30, 2004 9:03 AM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] Hi I'm new and I like SURBL > Greetings noob, I mean Paul :-) >what are others thoughts of the effectiveness of SURBL , risks of false >positives, CPU usage, etc SURBL rocks, but I'm a bit partial. The risks of FP are low, and we strive to get them to zero. And anything reported as an FP is dealt with right away, by numerous people. We take them very seriously. Lookups are quick and getting quicker with each new mirror added. If you have a LOT of traffic you can rsync to get lookups local. Directions are on the SURBL.org site. > >I'm currently doing my spam checking in this order > >sbl-xbl.spamhaus.org - reject at SMTP level standard greylisting SURBL >- using multi.surbl.org I like everything but greylisting. It can have some issues when a timely email is needed. Particularly with airline info. We've seen it here from another SURBL contributor. > >How are you guys doing it and do you have any suggestions ? >Low false >positives are my goal in my setup. I wondered if surbl should replace >greylisting or RBL or should just complement. Complement is always better, but if anything I would remove greylisting for now. With SURBL I don't think you need it. But if you have the time and don't mind waiting sometimes 20 minutes for some companies to resend, then go ahead. I think you will be very happy with SURBL. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

4 5

virtumundo.com
by Paul Schwarz 01 Dec '04

01 Dec '04

Why doesn't multi.surbl.org stop virtumundo.com It is listed in the ws.surbl.org if I look it up manually the online surbl lookup tool doesn't detect it either. Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100

2 1

Hi I'm new and I like SURBL
by Paul Schwarz 01 Dec '04

01 Dec '04

what are others thoughts of the effectiveness of SURBL , risks of false positives, CPU usage, etc I'm currently doing my spam checking in this order sbl-xbl.spamhaus.org - reject at SMTP level standard greylisting SURBL - using multi.surbl.org How are you guys doing it and do you have any suggestions ? Low false positives are my goal in my setup. I wondered if surbl should replace greylisting or RBL or should just complement. thank you Paul

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss December 2004