Discuss September 2004

discuss@lists.surbl.org

62 participants
229 discussions

Probable FPs
by Ryan Thompson 13 Sep '04

13 Sep '04

I found the following domains listed in a ~20K ham corpus from the last couple of days: Domain Age in Days Score (#msgs) attac.biz 826 -3.3333 (1) blah.com 3462 -3.3333 (1) chartshop.com 2275 -3.3333 (1) publicaster.com 965 -3.3333 (1) resortvacationstogo.com 1849 -3.3333 (1) send4fun.com 1681 -30.0000 (1) surveymonkey.com 1770 -3.3333 (4) topcities.com 1926 -2.5000 (1) whtirc.com 246 -3.2491 (1) whtradio.com 196 -2.3630 (1) Full GetURI output: http://ry.ca/geturi/runs/20040910-fps.html Quick look: attac.biz Looks real fishy, but appeared in some travel newsletter. Related to eturbonews.com. Maybe de-list, but don't whitelist. blah.com This was in a ProFTPd mailing list message "how do I set up a virtual host for "blah.com". chartshop.com Astrology.com newsletter. People really do sign up for those things. surveymonkey.com AFAICT, mostly legit surveys send4fun.com Jokes, example was person to person links topcities.com Free subdomain host. whtirc.com, whtradio.com Web Hosting Talk newsletter. Yes, it's legit. publicaster.com Used in some legit newsletters/mass media resortvacationstogo.com Looks mostly legit, and they've been around for 1800+ days without any NANAS hits at all. Related to vacationstogo.com. With the exception of attac.biz, I'd say whitelist the lot of these, unless anyone knows some reason why not. :-) The *real* cool part is GetURI (devel version) actually processed all of these messages in one run, producing ~4MB of output. Mozilla, on the other hand, crashed rather unceremoniously. Be thankful I re-ran on only the messages that generated the FPs. :-) Also, if someone wants to go through the *other* domains (i.e., those on a grey (not blue) background), there are probably quite a few other whitelist candidates there. (gc.ca, for instance :-) - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

7 11

FP in OB & WS?
by Bill Landry 13 Sep '04

13 Sep '04

The link below was included in an e-mail announcing the Seattle Career Fair by National Career Fairs (http://www.nationalcareerfairs.com/). I found no NANAS listing for this domain. http://www.ncfmail1-MUNGED-.com/lt/t_go.php?i=429&e=aGVhdGhlcnJAdmFsbGV5aW5… This link redirects to a registration page on the National Career Fairs web site. Bill

2 1

No SURBL hits on issip iadb
by Jeff Chan 12 Sep '04

12 Sep '04

I checked all the SURBL blocklist records against iadb and got no hits. http://www.isipp.com/iadb.php (This is with checking domains against iddb, then taking the IP addresses resolved by iddb and checking those against iadb.) http://spamcheck.freeapp.net/iadb-check Against the entire whitelist (but excluding the .us geographic parent domains), I got one hit: > thisistrue.com: 127.0.0.2 > thisistrue.com: 127.0.1.255 > thisistrue.com: 127.3.100.10 > thisistrue.com: 127.0.0.1 Due to the low hit rates iadb may not be useful for us yet in checking for fps. Perhaps when it has more records, it will be. Or perhaps there isn't much overlap between our spammers, our whitelists and iadb, which is also a reasonable answer. Jeff C.

1 0

Software spam with recently registered (fake?) sender domains
by Joe Wein 12 Sep '04

12 Sep '04

In recent days I've seen a lot of pirate software advertised in spam that uses a sender address of the form "Firstname1 Lastname1" Firstname2Lastname2@suspectdomain where suspectdomain is a very recently registered domain (late August-early September). Previously software spammers used all kinds of fake sender domains, but non they had registered themselves and not specifically recently registered ones. Has anyone else noticed this and has any thoughts about it? I wonder if spammers are buying lists of recently registered domain names off registrars in order to poison domain blacklists? Joe -- http://www.joewein.de/sw/jwSpamSpy/

4 5

important reduce wrise renkles & skin spots (fwd)
by Raymond Dijkxhoorn 11 Sep '04

11 Sep '04

Hi! Our favorite pill spammers also try to get around SURBL now. I dont want to end up making SA rulesets for this, any suggestions ? ns3.airmaramba.biz ns3.avk29.biz The same crap... But, with less SA hits now, since its not touched by SURBL. Bah. ---------- Forwarded message ---------- Date: Sat, 11 Sep 2004 01:50:29 +0100 From: kenneth clakley <auroraschorn(a)rfc.every1.net> To: wilfredo moote <reyes(a)prolocation.net> Subject: important reduce wrise renkles & skin spots suc-oneonta sony-steo lettery >From inside to outside, from w^eig_ht l`o^ss to skin care. From mental relief to physical relief, from antidepressant to muscle relaxant. The care inside out. you can copy wjq.s.adjuster6370pinn.com/56/ to your browser Licks his lips. And then his greed gets the better of him and penetr'a_te13 wlozyly 05 revolutionibuswdrazaniem wypocin

3 5

Re: [SURBL-Zones] Lowering TTLs
by Jeff Chan 11 Sep '04

11 Sep '04

On Friday, August 20, 2004, 9:24:10 AM, Mike Atkinson wrote: > On 8/19/2004 at 4:20 PM, Jeff Chan wrote: >> Does anyone mind if we try this out and see what effect it has >> on traffic? > Go for it! OK I'm changing the TTLs on all tue SURBL lists to 25 minutes which is a midway point between the 20 minutes I was going to try for SC and the 30 minutes we proposed for the rest of the lists. 25 minutes is also a good sampling frequency to capture data that has a 1 hour characteristic frequency. This is mainly an experiment to see what effect it has on DNS traffic. If the traffic on SC is not a lot lower, I'll change it back to 10 minutes. If the traffic on the other lists is not a lot higher, I'll leave it at 25 minutes. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 5

RE: Start an IP list to block?
by Chris Santerre 10 Sep '04

10 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, September 09, 2004 8:44 PM >To: Jeff Chan >Cc: Pete McNeil; SURBL Discussion list; Spamassassin-Talk >Subject: Re: Start an IP list to block? > > >On Thursday, September 9, 2004, 5:34:05 PM, Jeff Chan wrote: >> My first pass at cleaning the resolved IP data would be to take >> the to 70th percentile of IP addresses and only use those to >> check domain resolved IPs to. It's not perfect, but it should >> cut down on the uncertainty. > >I should add that this mostly applies to data where we have a >constant feed of actual spam reports such as from SpamCop. It >does not apply as strongly to data sources where we only have a >unitary list of domains, for example where each domain appears >once over the whole list. Though even there, it applies weakly, >for example a dozen domains that all resolve to the same network >probably could be used to bias future domains appearing in the >same network towards list inclusion. > >But when you have a stream of reports about the *same domain*, >then you can get better statistics about that domain or it's >resolved IP. There simply more data to work with in more >meaningful ways. > Holy confusion! I can't tell where you are on this subject now Jeff :) Are you saying , that if we get really good data like what was in my original post, and we keep the data in the 90th percentile area, then we might possibly be able to list the IP hosts and have SURBL check against it? If so..I'm up for that. Granted it would take a little more research then just a domain listing, but I think the benefits are very good. Especially if we keep it only high ranking IP offenders. I mean, we may add less then 50 IPs a year? Just the really nasty spammers. Anyway, its been a great discussion. If we've learned anything in the last 24 hours, its that the Patriots defense needs some work against the run game ;) --Chris (Go Tom Brady!)

3 5

Whitelist all Bonded Senders?
by Anne P. Mitchell, Esq. 10 Sep '04

10 Sep '04

> Since you're checking out Bonded Sender, can you request a zone > transfer or rsync from these guys too so we can check their data? > Note that the Bonded Sender status of a sender (are they or aren't they) is incorporated into the IADB data. The same for Habeas status, and whether they publish SPF records, among many other things (the complete list of information one can glean from an IADB lookup is available here: http://www.isipp.com/iadbcodes.php) As Jeff notes, you can sign up to query here: http://iadb.isipp.com/iadb_query_sign_up.php If you have any questions, or suggestions, please feel free to contact me personally. Anne Anne P. Mitchell, Esq. President/CEO Institute for Spam and Internet Public Policy Professor of Law, Lincoln Law School of SJ Committee Member, Asilomar Microcomputer Workshop

4 10

RE: Start an IP list to block?
by Chris Santerre 10 Sep '04

10 Sep '04

>-----Original Message----- >From: Matt Kettler [mailto:mkettler@evi-inc.com] >Sent: Thursday, September 09, 2004 5:53 PM >To: Chris Santerre; SURBL Discussion list (E-mail) >Cc: Spamassassin-Talk (E-mail) >Subject: RE: Start an IP list to block? > > >At 05:23 PM 9/9/2004, Chris Santerre wrote: >>OOOOOOHHHHH yeah! I didn't know that! Are we sure this is >actually what it >>means and not just a miss-syntaxed paragraph? It actually >resolves the IP >>against the RBL lookup? >> >>If so....well then...problem solved, and devs get a cookie :) > >Actually, upon closer read it checks the IP of the NS record.. So it's >essentially blacklisting the IP's of the DNS servers that >spammers are using. > >So, for http://www.merchantsoverseas.com, it would look at >your NS records: > > MerchantsOverseas.com. 18185 IN NS >auth20.ns.wcom.com. > MerchantsOverseas.com. 18185 IN NS >auth10.ns.wcom.com. > >And would check the IPs 198.6.100.37 (auth20.ns.wcom.com) and >198.6.100.21 (auth10.ns.wcom.com) WOW! I think this would hit more FPs then listing the IP! Am I wrong there! I would never list the name server, as they may be hosting for much more then just a spammer. That number is sure to be greater then a virtual hosts number for an IP. Maybe I'm missing something key? You won't see me ever add an NS IP to SURBL. Now that I've had time to think of it. --Chris

3 2

RE: [SURBL-Discuss] more FPs
by Chris Santerre 10 Sep '04

10 Sep '04

>-----Original Message----- >From: Joe Wein [mailto:joewein@pobox.com] >Sent: Thursday, September 09, 2004 10:47 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] more FPs > > >John Lundin wrote: >> emailfactory .com and emf0 .com (apparently same folks), >> being used as a web bug and unsub address, respectively. >> 183 and 22 NANAS, created oct '98 and feb '03. >> "Precision opt-in email marketing tools." > >emf1.com goes with those two. I've got emf0.com and emf1.com >listed because >of two spams sent to two spamtraps on Aug 25 and 28, 2004 >originating from >servers ice.emf0.com and bernard.emf1.com, advertising URLs with the >emf0.com and emf1.com domains. Both domains were less than a >year old, with >the name server listed on SBL. > >Whether or not we whitelist them for WS, they'll stay on my >local blacklist >:-) > Can you email either ryan or myself a copy of the spam? I'd still like to have it to list them in UC. Ryan have you listed these guys? I'm still forming my own list here. It grows very very slowly. I think I have less then ten domains to add to UC. --Chris

2 1

← Newer
1
...
8
9
10
11
12
13
14
...
23
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss September 2004