Discuss August 2004

discuss@lists.surbl.org

56 participants
207 discussions

[SURBL-Discuss] Selectively looking up the IPs to which uri's resolve
by Rich Graves 03 Aug '04

03 Aug '04

As postmaster, I see a lot of double-bounces for a user who forwards their mail to a server that implements the policy: 550 5.7.1 mail containing 8aa.tXokG4N.fagonyenomy.org rejected - sbl; see http://www.spamhaus.org/query/bl?ip=201.3.240.234 They appear to be using the milter mentioned in http://www.surbl.org/faq.html#numbered Sure, fagonyenomy.org is in sc.surbl.org now, but these cretins register new domains pointing at the same IPs on a (at least) daily basis, and there is a time lag. The site they were spamming about this morning, thebest-search.com.sc.surbl.org, exists only on ob.surbl.or, not sc or ws. For the reasons mentioned in the FAQ, I do not agree with uri-to-ip-based blacklisting as a blanket policy, but it does seem very effective in dealing with these rapidly morphing porn spammers. I would like to give such a rule a SA score of 4 or so. In order to implement this nicely, I see a need for a *per surbl* switch in SpamCopURI telling it whether to look up the domain, or the domain as resolved to an IP. Configured something like uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2') uri SPAMHAUS_URI eval:check_spamcop_uri_rbl('sbl.spamhaus.org','127.0.0.2','ip') Obviously there is no point in looking up fagonyenomy.org in spamhaus, nor do I want to look up all resolved IPs in all surbls needlessly. I could write completely separate code to do this, but I'd like to reuse the url and redirector parsing infrastructure. Unfortunately I don't see a clean way to do this without changing the internal hash structure. Ideas? Should I just wait for (or start experimenting with now) SA3's uridnsbl and urirhsbl, which were designed for this? Yeah, that's what I was afraid of... I think I just answered my own question, but I'm curious what others think and how others are dealing with this spam gang. I can't wait for a big ISP to hit them with the big clue stick. -- Rich Graves <rcgraves(a)brandeis.edu> UNet Systems Administrator

4 7

FW: False Positive: WLS_URI_OPT_683
by Chris Santerre 03 Aug '04

03 Aug '04

I don't have this in my files. Anyone else add urbanet.ch?? --Chris >-----Original Message----- >From: Alex Broens [mailto:alexb@midway.ch] >Sent: Tuesday, August 03, 2004 2:07 PM >To: csanterre(a)MerchantsOverseas.com >Subject: False Positive: WLS_URI_OPT_683 > > >describe WLS_URI_OPT_683 URI contains sites starting with u >uri WLS_URI_OPT_683 >m/\bu(?:rbanet\.ch|rbanfreebies\.com|rbanoffers\.com|rentdvds\. >com|rerotic\.com|rgentreplymail\.com|rgentvalue\.com|rhomeloans >ource\.com|rielsys\.com|rinalslut\.com|rlintl\.com|rlintl\.net| >rlsos\.com|rncage\.com|rpersonalservice\.biz|rthelast1in\.com|r >toyz\.biz|s-advertising\.biz|s-auto\.ru|s-bp-im-pt\.info|s-gree >ncard-register\.com|s-monitor-sales\.com|s-paypal\.com|s-site-m >aintenance\.com|s1bet6\.com|s1currency\.biz|sa-dental-care\.com >|sa-greencard\.org|sa-immigration-green-card-lottery\.com|sa99\ >.net|sabusiness1\.com|sabusinesscredit\.com|sacardservices\.us| >sacdt\.com|sacredit\.com|sadentalcare\.com|safreemerchantsource >\.com|sagreencard-register\.com|sagreencardcenter\.com|sagreeti >ngs\.com|sahealthcare\.com|saherbals\.com|sahomemortgageworld\. com|sahomemortgageworld\.net|sahomemortgageworld>\.org|sahomeworkers\.com|sa inkdepot\.com|sainsurancesource\.com >|salendingnetwork\.com|salinks\.net|saloanfinder\.com)\b/i >score WLS_URI_OPT_683 3.0 > > >This footer triggered the rule above: > >Dr Rainer W.BIELINSKI >Bossons 1b >CH-1018 LAUSANNE - SWITZERLAND >Tél. +41-21-6416111 >Fax +41-21-6471968 >Mob.+41-79-2104652 >E-mail: <mailto:rbielinski@urbanet.ch>rbielinski(a)urbanet.ch > >same with the @urbanet addr in the forwarded txt below > > >Meilleures salutations / Best regards >Delisle Pierre >mailto:pierre.delisle@bluewin.ch >tél : 021 635 20 60 > : 079 204 40 72 > > > >----- Original Message ----- >From: "Claudine Wyssa" <claudine(a)wyssa.ch> >To: "Pascal Petter" <pascal.petter(a)acs.ch>; "christianmaeder" ><christianmaeder(a)mydiax.ch>; "Pierre Delisle" ><pierre.delisle(a)bluewin.ch>; >"Bruno Lutz" <blutz(a)vtx.ch>; "Etienne Lasserre" <elasserre(a)urbanet.ch>; >"Pierre Wagnières" <pf.wagnieres(a)hispeed.ch>; "O. Ostertag" ><info(a)jouxtens-mezery.ch>; "JEan Daniel Graf" <v.j-d.graf(a)bluewin.ch> >Sent: Monday, August 02, 2004 1:58 PM >Subject: Police de l'Ouest lausannois > > > >urbanet.ch is a legit ISP. > >Thanks > >Alex > >

2 1

RE: [SURBL-Discuss] Hmmm....what if?
by Chris Santerre 03 Aug '04

03 Aug '04

>-----Original Message----- >From: Patrik Nilsson [mailto:patrik@patrik.com] >Sent: Tuesday, August 03, 2004 3:10 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Hmmm....what if? > > >At 17:47 2004-08-03 +0100, Karanbir Singh wrote: >>Chris Santerre wrote: >>>What if I placed an SURBL server in the beginning of my DNS >query list? Then >>>users would actually check SURBL for a domain in a web page. >If it is in >>>SURBL they will get a 127.0.0.x and get error. Which is good! >> >>Works! All you need to do is add the multi.surbl.org ( or >whatever list >>you want to use ) to the Host Search order. So that x.com is >looked up as >>x.org.multi.surbl.org > >This would only work for x.com, not www.x.com, etc. >The SURBL servers - correctly - return NXDOMAIN when queried >for subdomains >of listed domains, rather than treat the listed domains as wildcards. > >Also - this generates a lot of unnecessary dns queries for >non-listed domains. I hate to say it.....but... Patrik is right :) --Chris

3 2

Re: [SURBL-Discuss] Hmmm....what if?
by Patrik Nilsson 03 Aug '04

03 Aug '04

At 12:11 2004-08-03 -0400, Chris Santerre wrote: >What if I placed an SURBL server in the beginning of my DNS query list? Then >users would actually check SURBL for a domain in a web page. If it is in >SURBL they will get a 127.0.0.x and get error. Which is good! > >Am I missing something, or is it that easy? Your users would query for the RR host.domain.com, not the RR domain.com.multi/xx.surbl.org. Patrik

3 2

Hmmm....what if?
by Chris Santerre 03 Aug '04

03 Aug '04

What if I placed an SURBL server in the beginning of my DNS query list? Then users would actually check SURBL for a domain in a web page. If it is in SURBL they will get a 127.0.0.x and get error. Which is good! Am I missing something, or is it that easy? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 2

RE: [SURBL-Discuss] Hmmm....what if?
by Chris Santerre 03 Aug '04

03 Aug '04

>-----Original Message----- >From: Karanbir Singh [mailto:mail-lists@karan.org] >Sent: Tuesday, August 03, 2004 12:48 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Hmmm....what if? > > >hey, > >Chris Santerre wrote: >> What if I placed an SURBL server in the beginning of my DNS >query list? Then >> users would actually check SURBL for a domain in a web page. >If it is in >> SURBL they will get a 127.0.0.x and get error. Which is good! > >Works! All you need to do is add the multi.surbl.org ( or >whatever list >you want to use ) to the Host Search order. So that x.com is looked up >as x.org.multi.surbl.org > >Whatever DNS servers you are using at the time, should keep working + >Caching. > >I run this at a few places. Works well across a squid proxy, specially >since u can then have a real page on the 127.0.0.x interface ( = the >gateway machine's ) telling your users what happened. > >Is this what you had in mind ? > VERY COOL! Thanks! Now if only I could get Win98 to actually listen to the search order! :) --Chris

1 0

Possible FP in WS - imagestation.com
by Patrik Nilsson 03 Aug '04

03 Aug '04

imagestation.com is listed in WS. It's a Sony domain. Searching NANAS, I can't find any recent reports mentioning imagestation.com. Outgoing imagestation.com mail servers, such as zms0.imagestation.com, are listed in AUDNSBL and SORBS - as servers sending to spamtraps. But they are not listed in SBL or Spews. So... it's ambiguous. I assume that there are quite a few willing subscribers to the imagestation news letters though, so there is probably a high level of collateral damage if it's listed. Patrik

2 1

RE: [SURBL-Discuss] FP's in ws.surbl.org
by Chris Santerre 03 Aug '04

03 Aug '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Monday, August 02, 2004 4:48 PM >To: Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] FP's in ws.surbl.org > > >Hi! > >> > OUCH I'm farther behind then I thought!! I have 2 lists, >one 416 domains, >> > the other 347 domains. All to be checked. And that's not >all!!!! So if two >> > people would each take a list, I could work on the other 500+. > >> Looks like we need a clearinghouse so multiple people can help >> check these. It needn't be the fancy one Paul proposed; just >> some way to distribute them. >> >> Does anyone have a trouble ticket system already running that >> we could use and feed these into? > >We allready worked away the backlog, so pump in some new ones. >Chris is >bored :) heh. > >Ohw, btw, we just passed the 40k domains on WS. > Yeah if I get swamped again I just might send up the red flag here for some people to help like yesterday. Was a big help! I have more to add today ;) --Chris

1 0

Please whitelist ebooks.com
by Bitz 03 Aug '04

03 Aug '04

This is a legit site -- X-Spam-Status: No, hits=5.0 required=10.0 tests=WS_URI_RBL=5 http://www.ebooks.com Thanks, -B.

2 1

RE: [SURBL-Discuss] FP's in ws.surbl.org
by Chris Santerre 03 Aug '04

03 Aug '04

>-----Original Message----- >From: Joseph Burford [mailto:joseph.burford@gmail.com] >Sent: Monday, August 02, 2004 4:29 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] FP's in ws.surbl.org > > >Hi all, > >just wondering if anyone else has reported FPs for ws.surbl.org, if so >how long did the removal take? > >While I'm here, can anyone else confirm that spam submissions to >http://www.rulesemporium.com/cgi-bin/uribl.cgi?report=1 get read. > They ABSOLUTELY get read. Usually quite quickly. However they all need to be hand checked. Currently I'm 236 submissions behind for just that. About 400 submissions behind on another. Soooo much to do! --Chris

5 8

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss August 2004