Discuss July 2004

discuss@lists.surbl.org

65 participants
151 discussions

lindowsinc.com FP in OB.
by Patrik Nilsson 20 Jul '04

20 Jul '04

lindowsinc.com is currently listed in OB. Can't see any reason why it should be listed. Not mentioned in any NANAS reports. Patrik

2 1

WS FP? yourdomain-MUNGED.com
by Ryan Thompson 20 Jul '04

20 Jul '04

So, I'm a filthy spammer, I guess. I just sent out a mass email like so: > 2. At the opening page, enter either your email address (for > example, info(a)yourdomain-MUNGED.com), or your username (for > example, yd-info). I was a little surprised to see yourdomain.com come back with hits on WS. Maybe I'll have to start using "info(a)yourdomainthatnobodywilleverlistinsurbl.org", but that's a bugger to word-wrap. :-) Seriously, what's the deal? Is yourdomain.com really a spamvertized site, or is it just an innocent victim? A quick grep of ~10,000s/10,000h had this hit on 0s/6h. (And only one of them was me :-) - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

1 0

RE: RFC: sex site domain SURBL
by Chris Santerre 20 Jul '04

20 Jul '04

Now that I've seen the data and I've thought about it longer, maybe it isn't right for us to use. If they haven't spam'd, then why should we block it. IF a company wants to block these sites, they should use a proxy. And if someone gets a UCE/UBE from them, we will list. Otherwise they have subscribed and that would be the individual companies policy problem. So I would like to change my vote to a -1. With a clearer view of the picture, it doesn't seem right. --Chris

1 0

RE: [SURBL-Discuss] RE: 6dos data into ds.surbl.org
by Joseph Burford 20 Jul '04

20 Jul '04

Jeff, > I'd like to hear what anyone else has to say before we pull > the plug on ds though. For every 1000 spam hits on SC/WS/OB.surbl.org DS only gets 100. I haven't yet seen a real world spam hit in DS that wasn't in one of the other lists. Over the last few weeks I have had it in our systems it's running between 4 and 5 percent FP. Personally I'm inclined to think it is a waste of resources. The dynamic data on SC, and the ability to submit to WS make those lists a lot more attractive and worthwhile. Regards, Joseph

4 3

New slogan
by Ryan Thompson 20 Jul '04

20 Jul '04

Save a parse tree. Get SURBL. ;-) - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

2 1

Heads up, Bill out next week
by William Stearns 20 Jul '04

20 Jul '04

Good day, all, I'll be away teaching Perimeter Security all next week (Sun 7/25 - Sun 8/1, possibly another day). If you have any requests for spamgate or my end of ws.surbl.org, please let me know beforehand. I'll do my best to check in evenings for email and IM. Cheers, - Bill --------------------------------------------------------------------------- "After 3 weeks of intense cryptanalysis, the Naval codebreakers were still baffled by the messages. They called the Navajo language a 'wierd succession of gutteral, nasal, tongue-twisting sounds... we couldn't even transcribe it, much less crack it.'" - The Code Book, Simon Singh. -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

1 0

RE: 6dos data into ds.surbl.org
by Chris Santerre 20 Jul '04

20 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Sunday, July 18, 2004 5:07 PM >To: SURBL Discuss; SpamAssassin Users >Subject: 6dos data into ds.surbl.org > > >Chris Santerre asked on the spamassassin-users list whether >ds.surbl.org was being updated with the 6dos data. The answer is >no, it's static now based on that snapshot Chris gave me a couple >weeks ago. To be honest, the 6dos data seems too over-inclusive >to me for production use, but perhaps Chris or Rich could help me >figure out something closer to a live feed as we beta test it. > >Jeff C. LOL, I don't remember half the stuff I ask :) Actually the initial data that was used wasn't even the freshest from the source. This data is used in a much different way and is quite large! Well beyond a simple list of domains. I'm actually thinking it should not be used. It does contain a vast amount of info. I'm hoping instead, that this data source could be used for SURBL research in the future. When and if we get a nicer interface to it. So my official recomendation is for ds.surbl.org to go away. --Chris

3 2

Re: [SURBL-Discuss] test
by Jeff Chan 19 Jul '04

19 Jul '04

On Monday, July 19, 2004, 7:23:44 AM, William Stearns wrote: > Good morning, Ramond, Chris, > On Mon, 19 Jul 2004, Raymond Dijkxhoorn wrote: >> > Sorry, it said I was disabled. Just checking. >> >> If you can read this its working just fine :) > The list claimed I had been booted as well. Any idea why? The only change we made recently was to add a third round robin MXer for lists.surbl.org, as mentioned on the announcement list: > We've added another round robin primary MXer for lists.surbl.org, > where the SURBL mailing lists are coming from: > > vmx03.prolocation.net > > In case anyone is somehow authenticating sending servers, you may > need to add this new server to any mail server whitelists, etc. > > The prolocation addresses and servers are generally not on RBLs, > but it has been mentioned that some of their IPs may be listed > in SPEWs (which is being checked and corrected if so). > > We mention this mainly because some people have gotten bounce > (delivery failure) notifications from our Mailman (mailing list > manager program) lately, and had their mail automatically > disabled. To re-enable it, follow the instructions in the > notification or visit the lists web site: > > http://lists.surbl.org/ > > This could also perhaps have been caused an intermittent problem > while the new MXer was propagating in the DNS. > > lists.surbl.org preference = 10, mail exchanger = vmx01.prolocation.net > lists.surbl.org preference = 10, mail exchanger = vmx02.prolocation.net > lists.surbl.org preference = 10, mail exchanger = vmx03.prolocation.net > lists.surbl.org preference = 100, mail exchanger = mx03.prolocation.net > lists.surbl.org preference = 200, mail exchanger = mx01.prolocation.net > lists.surbl.org preference = 300, mail exchanger = mx02.prolocation.net > lists.surbl.org preference = 500, mail exchanger = mx04.prolocation.net > > vmx01.prolocation.net internet address = 212.127.254.132 > vmx02.prolocation.net internet address = 212.127.254.133 > vmx03.prolocation.net internet address = 81.23.230.33 > mx03.prolocation.net internet address = 194.171.240.23 > > mx01.prolocation.net 213.73.255.243 > mx02.prolocation.net 213.197.29.6 > mx04.prolocation.net 213.206.89.181 Jeff C.

1 0

RE: [SURBL-Discuss] exacttarget-MUNGED.com
by Chris Santerre 19 Jul '04

19 Jul '04

>-----Original Message----- >From: William Stearns [mailto:wstearns@pobox.com] >Sent: Monday, July 19, 2004 11:32 AM >To: rob(a)pvsys.com; SURBL Discussion list >Subject: Re: [SURBL-Discuss] exacttarget-MUNGED.com > > >Good morning, Rob, > >On Mon, 19 Jul 2004, Rob McEwen wrote: > >> First, I love SURBL... I have integrated it into my server's mail > > Excellent! Glad to hear it. > >> The purpose of THIS e-mail is to ask about a situation where a >> legitimate opt-in newsletter has been blocked. This was a NewsMax.com >> newsletter that I, in fact, specifically requested. >> >> The offending domain found in this newsletter is the following: >> >> exacttarget-MUNGED.com >> >> Maybe exacttarget-MUNGED.com plays clean sometimes (as the >case of this >> particular newsletter) and plays dirty other times. If that >is the case, >> then I don't have a problem with this domain name getting >blocked... but >> if not please double check this and consider whitelisting them. > > Thanks for the report. We've removed that domain as of >the 11:31 >list. > Cheers, > - Bill These guys apear to be shammers (Spam and ham). NANAS has a bunch of posts. I believe they were added due to a Home Depot spam run to a bunch of harvested addresses. They are NOT white. --Chris

2 1

Fwd: RE: More on SpamCopURI busting tests
by Jeff Chan 19 Jul '04

19 Jul '04

This is a forwarded message From: SRH-Lists <giermo(a)333tech.com> To: Jeff Chan <jeffc(a)surbl.org> Date: Monday, July 19, 2004, 1:19:36 PM Subject: More on SpamCopURI busting tests ===8<==============Original message text=============== > Hmm. I disagree. For three of the machines, I _know_ there is no > port 80 blocking. > > > It might be useful if you could show us which tests are failing, > > but I assume it's the same redirection-handling ones that other > > people have mentioned. > > Yup. Same set: > > t/blacklist........ok > t/dnsrbl...........ok > t/extract_urls.....ok > t/mailto...........ok > t/open_redirect....# Failed test (t/open_redirect.t at line 37) > t/open_redirect....NOK 1# Failed test (t/open_redirect.t > at line 44) > t/open_redirect....NOK 2# Failed test (t/open_redirect.t > at line 52) > t/open_redirect....ok 4/5# Looks like you failed 3 tests of 5. > t/open_redirect....dubious > Test returned status 3 (wstat 768, 0x300) > Scalar found where operator expected at (eval 152) line 1, > near "'int' $__val" > (Missing operator before $__val?) > DIED. FAILED tests 1-3 > Failed 3/5 tests, 40.00% okay > t/spamcopuri.......ok > t/whitelist........ok Just adding my "I get the exact same failed tests, no, port 80 is not blocked and, yes, it seems to work if I force install it" -steve ===8<===========End of original message text===========

2 1

← Newer
1
...
4
5
6
7
8
9
10
...
16
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss July 2004