Discuss September 2004

discuss@lists.surbl.org

62 participants
229 discussions

postmaster@corp.mailsecurity.net.au
by Mariano Absatz 07 Sep '04

07 Sep '04

Hi, I just got a couple of phishing attempts that were not found by ph. I already reported to SpamCop and Bill via web... as I didn't find a way to report to mailsecurity, I'm Cc-ing the postmaster address supposedly used to report FPs (though this is actually a FN). The phishing URL is http://68.94.232.23:87/cit/index.htm (http://%36%38%2E%39%34%2E%32%33%32%2E%32%33:%38%37/%63%69%74/%69%6E%64%65%78%2E%68%74%6D within the message, and hidden behind https://web.da-us.citibank.com/signin/scripts/login/user_setup.jsp). SpamCop correctly found it and decoded it OK. I just went to the site and it's definitively up & phishing. Below my signature is the full message with headers. Regards. -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com Received: from [200.48.93.178] ([200.48.93.178]:26122 "HELO 200.68.65.130") by homero.pert.com.ar with SMTP id <S147789AbUIFXyz>; Mon, 6 Sep 2004 20:54:55 -0300 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 FCC: mailbox://supprefnum6@citibank.com/Sent X-Identity-Key: id1 Date: Mon, 06 Sep 2004 22:54:10 -0200 From: CitiBank <supprefnum6(a)citibank.com> X-Mozilla-Draft-Info: internal/draft; vcard=0; receipt=0; uuencode=0 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 To: interesting-people(a)lists.com.ar Subject: CitiBank - Urgent Security Notification Content-Type: multipart/related; boundary="------------030400000009010506060006" Message-Id: <20040906235501Z147789-995+5845(a)homero.pert.com.ar> This is a multi-part message in MIME format. --------------030400000009010506060006 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit <html><A hREF="https://web.da-us.citibank.com/signin/scripts/login/user_setup.jsp"><map name="FPMap0"><area coords="0, 0, 610, 395" shape="rect" href="http://%36%38%2E%39%34%2E%32%33%32%2E%32%33:%38%37/%63%69%74/%69%6E%64%65%78%2E%68%74%6D"></map><img SRC="cid:part1.06060509.02080307@supprefnum022662506680@citibank.com" border="0" usemap="#FPMap0"></A></a>MIR in 1955 Let me do it date of birth not at all Justin Timberlake Dragonball in 2003 Excite what do you do? Angelia Jolie we need to get That's definetly not you. Mad Cow Disease Huffington blasts Las Vegas In short. gossip Open your Denisse Richards I wonder what if... Shopping Romeo Classified Mother's Day </html> --------------030400000009010506060006 Content-Type: image/gif; name="politicking.GIF" Content-Transfer-Encoding: base64 Content-ID: <part1.06060509.02080307@supprefnum022662506680@citibank.com> Content-Disposition: inline; filename="politicking.GIF" R0lGODlhawKSAfR3AAABAAAAgMDAwMDcwKbK8AAAQOAgQAAggEBAgEBggGBggOBggICAgOCAgICA wKCgwOCgwKDAwP/78P8AAAAA/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAQA AAAALAAAAABiAosBAAX/YCWOZGmeowQ1S2u0bSOhdG3feK7vfO//wKBwSCwaj8ikcslsHiULw2RK rU5eEKd2y+16v+CweEwum2tQq1ptyJ7f8Lh8Tq/b73CVdC3drxczeIKDhIWGh4iJO2lWBg0QgSIq UY1uipeYmZqbnJ0ojFQLliMEkRINflOWEgQPEQOesbKztLW2PqBXo5IPBwQluRNuAggJCAq3ycrL zM13uYAmDwgFBb8mDVZZBAoJ3bDO4eLj5OU/UDDRwNTV1yYQ6Q0VAgkRDwmR5vr7/P22EgADnhjA zhqNgAArSHigQIEAfxAjSpzISULBh4vyUdzIsaPHIBIGCGCowEGpEgMI/wwYECgkAWLVCjxQ6a5C ypUfc+rcyRMFtwMxYx5wEAloNWQVCARdWi3CiIJOe0qdSpWfBAdMlyIAV9CBCAFGsxaIajFm1Kpo 06qlJUGBWK2wwnpN+rapJKhr8+rdi+jB0gMlHSgIi2BGV0kOEodNkNjkXbN8I0uefGZA2AJEUwxw W1iE3HUxaz62S7m06dNL/MacC+wBxgqHSZRtZ2L2WNS4c+vmUbDzjc+yC4pWiHe38ePIwz7IETuF 8NrFkUufXjrocBTAnYeGDpm69+95hYK70Xy0QdCkwatfz9N6juzmh9s+y76+/Ylh6dcoT3w7+tv3 BSjgPgnEhA8O8PVH2/9/+g3o4IPJYNWdCQKMx59tr2mXHoQcdhiLAEs9kM9CBSgQSILzjcCSggB6 6OKLl1y1VAKu2FOQibCt9h8CBLSCgFMpwijkkITYVtcBcelYgltBAeULiw0SKeWUZ7RVVwEHYMRf UpcdZV6UVIYp5hfTiKWAOwmKoFpQy0E55ptweiGBAA4YU4xJ+RAQwZ7XzaMAAgg4NoIAe0agUZyI Jqrooow26uijkEYq6aSUVmrppZhm+kYAnHbq6aeghirqqKSWauqpqKaq6qqsturqq7DGKuustNZq 66245qrrrrymqumvwAYr7LDEFmvsscgmq+yyzDbr7LPQRivttNRWa+3/tdhmq+223Hbr7bfghivu uOSuBcC56ALgRLrqjtBuCe+yi+4P75ZrLxj1ipDvEfnuW4G/+/qLg8D83mswCQArkTC8JyzMA8FG QHwwuALXOy+8F//7b782tJuuxvo2jHDG6pLMsAkmu+suySxbvLHH52LscswTC1uxyiHjnDPNJ9MQ r84BIyz0xji7jHLRQxsNcs5L8+w00CvXTOzNS+98MtU+Q62vvEMj7XXVOncNMtYcV2102RJLXSnV ZY/sMQoS/8x00CjTfDbTPYv9tsh4j61333urHSzbXG+9N9Zwaw323Hbj/TbPeYcdb8ZNX/33yx8v LjimbCeetOdZzx32/9dWFx242JLzXfnnqWvu+uZrq4625aCzvrrmp/v9tcOX9yw36XfbDnumdCtu ce6R/6780Y6f7rzsjDve+u1mGz/8r/ICDDnmuvucOeMlr8yuzOFXD7b2x5fPvfjsT2825G1fLz9H ac9vfzn136///vz37///AAygAAdIwAIa8IAITKACF8jABjrwgRCMoAQnSMEKWvCCGMygBjfIwQ56 8IMgDKEIR0jCEprwhChMoQOzF4b8Ma8JLgxCDLcwwzjU0Afbe90NI4fDHuTwIzuE2/dwJ77x9fBh L1zX6GqgNCYEcQdPVNglojgwH9JLdTdoYhX7lsUlIiGGVOyYFFHHxf/F7bCGvHOiF2sXRjFqoY0R m+IbrXhEHoaujExc4x3hWLsuwjAJaSRiEnWARixSznAyE1rLyhe/9ZVse5R7ZPsSd8jMte2Qiswh JiP5MiZisnlPc1rM0pc1TiLtYibbJCSJVrfJaTKRpFTZIsc2r/hZspNuc5sRWwmzwuFSlnYLpSiD +cPvGZOVnYwl92YGyVEOknkf+53eUvk0Mj7zdkpb3tasd74kVhOb2fSe4jQ2Ozx+k3rKk2bvuna2 bGqzbuOEWdR2Js16km2N7jTeO98JuJFxU3RsBKhAkVnNb9bTkEnLp0Dtqc9rsnOc0jMd8Lb4UOGN 7nkA1WJESzdRa5r/r5zdKyNIOUrSNC5spCMV5EAxStKQUg91yBuoS1m6TzI2MXf8hOlCfXc5kKZN nSxtaeBu2k87VrRpvuzmR/VIPlOS7qIbrak3LRpU12kUlU81aVFR2rFitnKjQkVoRImq1Ev2MaYv xWlU47lEspoVj7nEJk9b51M/JtJ8WV0pVR36z+LFNXgu1CILcVe4cO50qqYzYvqG2DushsyVjN1q YQvrUcf6rnF4pecuGyu84CX2mFh0KUR7ecu+HtV9pE2ZDjGbzl26lXaGQ5xjBRtby77Wpm6U6wtn +7kfnrWyoZ3eQWVrUfflMa+PZSpUrRrQQZ4UtmWlKDrBqlYd/pa5/1ttrm5lKdaWnlan20VsWLE7 144+la3I9ahpoQldeb4ueeDVKl6Hq92ZgpW89k1uUeEb3c6G9rn+3at4PbtUAeNXtDKtrmHTqtIC /5O/OT0ochE32vsqGLX7teZQITpez+bPrxLe7oJnVl+pcpiu/lyuVUM8Yg2nuL3VJSg+j4rZsbJY vTkVrolFzDDetfjE79MrdRP6YIcdb78GRe9CKWzi4h3Zwe/1ojIniUgdqw+uln3fVX0b1VralMuP DJgm4VdZL+/WzGK+8iep68zMPm7MjbyrOWEZ1y6rz6l3vekqq0w+WoaZym5+LPyIWTFCi9bMfE7m OhHNS3feOanLHP+rUQXBR91U2iOXnkOm6biETUPE03zRqGlA/QZS15cIotYLl+0T2dKsuhOmFuKr 6bVmFdr61rjOta4HZOpY49DXx+0QHIHdwiub6w69BoKniR1scTAbDqnuIx6e7QxqE3KOV+x0qfE3 jmgHF9mYPidkYwvoP/8y0ZJcX27NLetMsm/K6S4ioHXZZ3Wr8s7TFOa7/1vu3qKvX80EuC2BSdpm O7qUrvwqRn82TFm/WeAF5++5o13JVaIS0ZI095ovuWerzRrbIV34aUXZ1xDvUZ0NBdo+iSvSka9V 5cIlMsydK2R6arfJGN6md8XbvUK7XOceXnDeknze7Na8vAzl6OT/5iljmk9XombwccuR3NP2IvG+ Rs/6zhN8zboamMAhtyPYJczkqUtc6Gi13OHEHl+rP13KVS+upAPM9p/zk6xDp3rRWyhWI5cXymGH onG1ntK0A5WvVT68UjObePDuVu9b/+u33yrk+j1uvHkXsIcdv+ivWrfDLna6g02earlRHsF8H7Bq T99OxdZ73aE3r2ZLCz0NR5K1Rczy23mr4rmyHsu47/rfyV5FhtfWq7mvcUlXCukhN/7z+RW1fEef 8zljHuxjkDp7IQ94Pf508P3VOo57zzevi37sFi6lirEvfrPXnP1HM36UsU74o98R8Gkn53Klz++5 v53xirR+cpd6/5kHW783YfcHOvxHd6CngJPWgOFXeW7nfQzmfxA2ecOHYl0kf3HGeBe2O5yXcynV Y/sXe463ec6HZRXYfdm3OyKnZPMFg99Hf+GFVA9WgNr3ZGjHdEsXZIsHZjE4c7KFc+9HfNIVhOfH TkO1Yd8lgikGMWqWco93dEwYaBS4g0BnQ4P2aA2XaFaIbq9HXhRHZnRGZQTTMt6zhYwkZ/vWhpFm Rm0mbfeGem/ohRWXZk+nWhLnhV+GhwlXhfPWPo7GSEDIhorWbnXmf6SnXnDoh3BVLs9mbS0IbYkg iV9gidHibWrUDJj4gHbQiVwAis/SausiiuRgijnwcZqgirvWiv+u+IqwGItxNASBhGq0qFyyKClh BGxxI3i5iD22GIq5dYS/aCnsJm+CdngMF3CrpWbDNG5LxorFOCbiJnOB14PgpIA7hoKaOI1wUniK iF4dCI4VaHreGDt9OHdYOI7QhWC29YjnqCgct3antI5191lZxntIJY3xKCXk2E6HhXltV3sgiHj9 KCb/aDt3l2ElqJAG+G0H+SZEl4UddWM6d2brRZGBF5GJcoxviH6kF4cKl4gX12at1Y0cKS2omJLa gpIsWUCk+JIyOZM0WZM2eZM4mZM6uZM82ZM++ZNAGZRCOZREWZRGeZRImZRKuZRM2ZRO+ZRQGZVS OZVUWZVWaYz/2RNTKylDNpQJILaVnDaLvih82VYLYDkLfuVqdkUHUFgEmNiLV1eW87eWZ5mK0tYT YGSQqraWmtZsXEkGcDmWdTSXw1iXxAiPQCSYySg5n3SM8TaHiahuksmYvqVxAbeMAqdl0DhxRNOB YeiRjDZ78ceMyGiInFSSBDd0zzhvoRloEcdumNkwWHWHCJeZr/eYl1ma5Bab59ab69dxflOZtBmZ eMabk5mATWdyF4mNu1dkWKecy7mQTWeDL7dk5Kd6UghkE1l6JceDy0ljMTdznZd0PYdyPliD3kmF Fxle5pmN3ylTWedWZwieAcliOeaX1OeXVaWV7QiP7dl5EfiB/zcYVIEpgbhlfdeHgQwYYwJKjmqn dHEHgFbIjgjIgKh3T84XZ+hngRdIluYldHyZnwm4n+7njrBXmOmIf55Xjn/XVUbYVjOWXrXIVTIa n+34XPQ4oeB3W3CXXoI4kA4lnQKpNQdoecrXox/ahPhJYK1Go0U3WJLZpPTWXfu4fD9YY4p3eoj4 olzUnhvaYA3JoaZHWccXYwGoX4v4fyLYfB/lS/qIObMUo/+XWsiXXyz4o2Baf9VJjPCXliSapwoK XDwnoNGHdP1pbP2noi2qgScmXzyaUQ6YqGeqf3NqfxkqXWjlpMGGoTpafAK4dxGIpFaKhHw6gH6a fmA6o0FKpf+ESqg1iDyImoQ+Cp9iKqphqqiFKn4Jw4FOSH+P2mCu+qeLGpC4SoLcZ3j9map7+p/B hYJdGmHhyZ7PuaMRykoj5jwWaUbz92RI+EoIKq0EKaS0FK3ZSp2y2qkSindeSp8+SHkg6pw3OKm7 h6zpyWPWuachyqSNyZmG2Jt3uFiGtHGNhWb5to9caIaSSm8hiajrSpn96q9kKGmVRJJdmEtlBz7h KGXKN2UFCLEmuaLkxppxiHe+yUNzmH/RRJyk6YYHJwaGyYmeqA8vKyAzu4re4Zn9ULP3obOYwLNm 6bPb1iz8eJVEW7RGe7Qb4WsU9o1IC5GA9EV3iZxNixtKC7X/Tnu1U7sPlglxDElOcJaGr1WcXxuy pdmYaJhJvZSabIib+qahxVm2vjmxt3dOnFlr00hyeuW20cpZUGevxMq3OPhiBZWtETuuDGmPfYt2 5pik7xmRvxqFTqehzVVOI4igknusmjeBo6qtfdd/RUqQm9uPJPt8yrp4cpqrlSuGJvuptRqqeMph LOeoGahSmiq6A5ujjsqmQ7ShdJqpkQqjZdqrFYqnWkq286WHfgZa4AOtEuqNj8tdnhuXvPutgmq6 tHqpmXur+rWpoZe66cp1zXu31Vo5F4uzBuo1qcupXcq6ilq7sLqt1Bqq0Nlzmmu7jCpjPoev1RlM GYme+kuq//JJrtO0vtpHnQC5rAH2Y4gpi+rKaPMJmbLJjA9XsGs7tiX7SxOLYhB8PgTLV4yFcdSE h7cLVIXrkjRZl0AbtWO0wlnrlp+4Cby4iS1Mi2c5tHUQazZ8bTO8wzzcwz78w0AcxEI8xERcxEZ8 xEicxEq8xEzcxE78xFAcxVI8xVRcxVZ8xVicxVo8P1nJs8wmkoOwWX53i56wi7gYomqTwoTpwpV4 j4yow2F8mDH7xnJ8w46ixsSGx82KtXZJCJaHxlIbl3HcKOgDtv36tl7bb9ZrhxZnaMu4mCU7j5kX b8pVcMYJt8j7b6a5smtVkoUMb3EKTl6VwXy4u8PZbhxbtv+FOyRO1l2Ea415uLrEWlDiSVAoZ35t qsL1maa0LKpEWKnvSTbiyo1fJsD3e5/m2rDXy8p7WKK+K3urc1WJ6qwDB7wJCqqBybw0ap6VO32I 26EDCqn6Obw7d7mzCr5h0khp2X4W6K7WfIIOmWELaKfwF2U71ojqmEVH6sx7y59fF8HiPKLnrHtd 66DfpcYdoc4RDFkE3c5uCrvTHM+mO88MOoD2HM7PdzdgFnxu3JxPejUPTbwqV6cZ5aZYukibdKOg u8YQotDHtbTtfH+x6s0SXc1zpnh3etF/26oaCaQm6NHlnKzgy82yerFC7dO0O8fC1szbt3dMmoGq ancVBn7/lPqDFi1I98zTL8XONC2O0cuuEPpMb2XQA63SU3jGSz2sCixiFZ06nMrLU02DkHu8/mmo 0cN8Ma2aGWmf96uESqaD0DydfmutYO3X1/uu/gjQDnfIEvysLo2IihzWEz1+jL2GLhqxGOexlj2k deixlZ2HxSSSw5myoryrwPmvBvuwbnjBGLzKE4PQCJ0bKAxBsG0spmjCAJTDZaDbd6yFvL3FwB3c wj3cxF3cxn3cyJ3cyr3czN3czv3c0B3d0j3d1F3d1n3d2J3d2r3d3I1BFNAE3y0C4a0D420D5e0E 510B4Z3eOcDeSeDe7o0C8S3ePjDfN/Dd9l0C9p3feMDf/+CS3uPt3zQQ4Dzg3wJuBAD+AwcOBAuu 4EiQ3/h9BA3+3geU4PTN4CPQ4AYOBhbeAxNe4Fvw4TWw3xdOBCIu4RWu3utNAfjN4vTt4hkO4+pN AgRO4BfO4jUO3xEu3jKu3xke4zqe4+v94uWN4z8u4zau3z1u5ETO4zQO5D/u5EOO5E0e5Spe5FS+ 4y3O4wG+5CXO5FJ+4yr+5DP+5Uvu5fEN5lfO5V9+5Ozd5Tn+30Ne5nQO43NO52Q+40m+42Vu5yaw 4m3+51Ge5FY+5zbu53Xu5H1e4nl+54A+5oke6Yb+6JMe6Ic+6JW+6IGu6ZcO6ZQ+6KAu5mY+4KGu 6ZHu6f+CLul3zi2dfuqrnuqJHuGOvumFDuuNzui2LuqmbuGXDt+wPuu6zuulbujDnuuSXuw+HuyW vuzMfuu4nuzOvue1nuwdfuLJ0urSzua/fuR6zuWIjuebjuMtnu1rbuzAvudMfug9nufTnu1Yju3M 3urlDu7HruvzDu/1ju91juTibuXyze/pPu2nXuhU/uzZou+E/uzSLusK7+/N/uYOT+/Cruz1zukn UO3hbvDETvHnfvENz/EeX/EdL/IR/+oGH/IYn/HQjuzdgvAbD+4JT+7AHu2KDu0z3+4Pf+MjD/Eg 3+ZFHuqfLuo1TvMc//JDj+xBf/Q57+ojjvQC/+1Ib/L/B4/pir7lUE7xAn/vYP7uXU7v3n71eL71 Vf/1Mb7rzT7v917r5y32YZ7v3E7jZ+7ukD73AU/wWG7xL67kAA/3Pz/icV/2ZK/nMp/l1o4thT8g h1/f6N0J853m4iLukB/5kj/5lF/5ln/5mJ/5mr/5nN/5nv/5oB/6oj/6pF/6pl/5apP49aHmX6D6 es/hkY/g/9703V37tn/7uJ/7ur/7vN/7vv/7wB/8wj/8xF/8xn/8yJ/8yr/8zN/8zv/8TdvFCzyM XvDbe9GJtWgLM/iXl4jD/LK7sgOlgkzHfUz+1C+METFDzHr+QqD+5q9t0w//HSuX6H8IFCrLYfn+ 509F/9QW238EApU4kmUFjKi5rir7wi5MyvJ846Zr5/3Nn2g+FnBoLBqTyqCu6SwhY8QltAm4Qq+7 E1Zk431T3ZQwO9YKx96qV81cB91xNepM56rQa31bjt9pBYqF6Ql+udXJCfYRFeKRDRYl5iEWBvLx 7QEtah7W6Thm/pFhspVBPp6+9QESgp1y1qQOrsK9UGJtPY12osJF+YDprlJCyu4yDRO3wIoxlykf +3Gh3tnaGUdPVftG62rbUoeHK6ueXas6t3Ebd3dLwg4DPq+jZ7f75ue55y+Tw+P7RUOeunRPCJry d85frSWvAgoMCDAiu3H2IJobBw5JGIYUFZraFLLixf9kJN8ca2bQ4z6Lu6SxQXhSH7+OCWFCy+kS pEqL5cplbMhSI7KD1S6l/NjSI5WHPrvgjPJtZD+UMW9h3IhVJ9GhtYCaqWgTp9WeDX/S4yn0pkFH JcvGWPhRaFJhS02utTe2Lc2daoPOdboNrmBaPG1SORuvJcxpeqm6RJt3qtm7CfF2rdt1rVvCSGue BGeWbtAaovhdg3oRKVhGcDFHBuy2sdSsqENXJRfptuXCRt+mZpwTUeJ+ZJXWqy2Z6VvLVZYfv3y3 o+avVfcCB9389vaXXC/rtk14KzKtK6tTh+Y8TV/m0MmT9orY7+rrmdWHLy64d/jWe9onhVtecQD4 nXT/+SEnXnxiFShRgz61Bxhs55V2VXecQTahSNpBtJRyDyq2GUcUygdefDJtmJ6DuR3hHTHTIfhc ZQXJxiKBJM0zmUz11SSaOTv66OGMxo3GW0kb9jfQkdy9g1qObHUII3OkDClOjSzmeFxKTx7IY4gv JmmjEvvtJuV8bSmSS1qzDHhWmp9MxqZdEu4jymmG0IIJcdnAaRiTenKkWpTTVDcKLrPYeQsaQaoJ ipSGhomlo5MWlqiifcZCZ6MtcILSpqyZAWd06xVXaoumlgqMQ6gOxqqrr8Iaq6yz0ipmrbe2iauu u+ag6q6+JgHsqrwSW6yxxxIrLLKn0ress7U6lqyy/0NMy+yz12KbLbbRanvEad2CG66445Jbrrnn opuuuuuy266778Ibr7zz0luvvffim6+++/Lbr7//AhywwAMTXLDBByOcsMILM9ywww9DHLHEE1Nc scUXY5yxxhtz3LHHH4Mcssgjk1yyySejnLLKK7PcsssvwxyzzDPTXLPNN+Ocs84789yzzz8DHbTQ QxNdtNFHI5200ksz3bTTT0MdtdGdSl211e9eQuKUEw1LLWukKvoD1a3OUO3VZ+d7pmJ4mpgr2c2+ rWyAEb7dNtp3C4wkkeL4BnfdZvcNn95iAmM23ofLWzgreH2y36ZyIrro4mpDaKcduVga15ZpSD6Q K/+mcYu46Msq/thnkMn1JIp0o8lgjDauvuKRlPk9uu2/lu16bNbxvrmXA5LZ+0qupSOk7NjNdbvy z5b+2tiB3ae773Eb+OilfZn3mvO1L989tLlntxV1p08vWm1QgjrlNiqq9d5RoXsf/6vN+/cM+1CO x54U6LcqLH/b5w9Ha5IfAWWVopns736wiR2V9leh7wwOegDcEQDtVsALmgp59fuNlYCku/840EkC XFP5jrIkBFkPgypkVdbe57Z39AlyLmzF8PgCwx9tYmyZAF0yHscmhjxvhUJ0mOGGaMQhFvGISiQg /JboxCdCMYpSnCIVq2jFK2Ixi1rcIhe76MUvgjH/jGIcIxnLaMYzohFVDFjjGsPFgFi9sQRxrFUc 57gEO5oAj+rSY3H4mEcR+DGN9LJjIJVQyB4cEpA5mGMi6ahGfTVykTiIpCDhhUdKTrJUjYwkI52F yRl8Ml2hfMEmK9mvS46AjSt4YxtJoMoKvNKVsARkK2dZyzqmUo63rGUqW8nKTtLSj7H8JS1deUtF 5pGXsZTlMpEJS14as5PQdCYuj+lLQlpTmrsk5CyfeUlWrvKY3fRmNE3JLlSOU4++zCUy+bjOduKy m8CUJTX/WEx51lOO7LxmO/fpTHbi85/9tOc8AVrHeNJTnvHkZ0AVOtB5MhKhwJzmRAfa0FGaE1no /yxoPtMp0I5KtJ7uNKg9PdrQVfqzoyktJEJROk56clKl+azoTFMaUIiSFKQwWChBM9qujQI0pyYd aTDfedGXClWdOY2oO9kYUmq+sqW93KZLiUrOcBpVqRZ96lGHqlOoDjOoU+VpUafqU1Hq06QJxSlS ZepVRVqVo2qValu1+tabltSuNk2oWO9q16eylaZ4/Wpb1brUrZb0rOTiplvZetKk3rOlwhQqZLu6 1q8e1KL75OpebarVrOa1pqLtKlcd69jNPjSyfVUsuJz6zbiW8558Das4PyrbZqp2q9MMZmWfOVhd pnO3mU3rVZNp2WgCNqm1XShTZwtNp4bzt21sLv9rN3ZIjFY3uw27rna727FA7ta74h0vectr3vOi N73qXS972+ve98I3vvKdL33ra9/7ogsB+t3VfmGlXwTMoL8kEDB+u/tf/gL4VQR+gYATvOACs3a/ D5bVhItTYQYnGMLilXCGBwzgAxP4vxnm8IdHXGIPN/jAJRCxCFi8YhWT+MQtlrGLXVyB/uJYxhp+ IodXAOIe39jBQi4xjYGc4xn7WMhIfjGSjxzkJjv5yVJ28o937MQUm4DKSp7ylrW85Ch7+MsdXvII vMxlMpvZzFY+IpaZfOYg17jLcp5xnJMs5iyPOc1zvvObwbxmIYpYxWHu85gJzecHT1jNZc7zntX/ rGc+/xnQjHbzow0NZ0snes+DNvKcYWziO3tax5FW4YJLrWkbPzrEgq4wqgsN5y0/GctgtnGslXzh UeOaCrfGwa5z7esefFrXrv41sX1AayX0utjKXjazm+3sZ0P7BrjtIymT4NqmbpOpVk0mY/ka7QvK VVZ6dam3uWnuck/2o9j9Nt7Q6UjiVjWqpERlt2VbbnizG4PgzSZkwVnMah4UvC/1N0rPHVSCezuX 8uatWeEK13XnO2fpdqhl3zlci4Ny3Mzc+MELm27BAjaito240SZe2oF7drQFTyxMOa7y1ZI2tCgf OcmJZnKQuju5mv2jwYnb87smHLF13Wu4a27zZrSCXOGX9SvNFWrUjhsTpq5lOVkfC/SiG31ops2t QGkK2sImfNw/1zhmU351uma9aM2krbtxTtrrTl2X0PWmtsnNbamDNbYoD2/aozbxTEoM4n0/ut1Z gHWFCX7wQlMnJ/m+MDuGAAAh/nR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0 dHR0dHR0dHR0dHR0a2lldnB3aGpsdHlwcGZ6c2pmb3JtZXRnbmVrc3FvZ3lobmhpa2V6cXdwcWtx c3hieQA7 --------------030400000009010506060006--

3 2

General Questions
by Joey 07 Sep '04

07 Sep '04

OK I needed to review a few things, and was not able to search within the list, but only page through the last few days. I installed the cpan version of surbl plug-in and am running SpamAssassin version 2.64. I copied the /root/.cpan/build/Mail-SpamAssassin-SpamCopURI-0.22/rules/spamcop_uri.cf file to the /etc/mail/spamassassin/ directory. I then restarted spamd so that it would take advantage of the new configuration. I then went to spamcop and grabbed a couple of domain names from the list and emailed them to myself from an outside source, but SpamAssassin did not tag/flag the email with any of the spamcop_uri scores or details within the email. Having said all that, now the question becomes how can I test my configuration to insure that it's working properly? Thanks, Joey

1 1

Re: Need help checking FP list from Theo
by Alden Levy 07 Sep '04

07 Sep '04

>Date: Mon, 6 Sep 2004 20:43:10 -0700 >From: Jeff Chan <jeffc(a)surbl.org> >Subject: [SURBL-Discuss] Need help >checking FP list from Theo >To: SURBL Discuss <discuss(a)lists.surbl.org> >Message-ID: ><352641172.20040906204310(a)supranet.net> >Content-Type: text/plain; charset=us-ascii >Theo got us a list of 112 new false positives >from across all >SURBLs. He showed me the source >messages which are almost >all subscribed newsletters and mailing list >messages, so they >seem quite hammy. >Given the type of source messages and some >spot checking, I'm >inclined to whitelist them all, but I'd like to >ask for some help >checking them first. Can anyone help check >these? 123inkjets.com 1and1.com While these two may also spam, they sell legitimate products. 123inkjets sells ink and toner cartridges and refills, 1and1 is a web hosting firm. Gotomypc.com sells a remote access product Yale.edu is the domain for Yale University Regards, Alden Alden Levy Engine No. 9, Inc. 130 West 57th Street, Suite 12E New York, NY 10019 (212) 981-1122 (212) 725-7202 (fax) www.engineno9inc.com

1 0

RFC: For everyone hand-checking domains
by Ryan Thompson 07 Sep '04

07 Sep '04

Hi All, For those of you hand-checking lists of domains (i.e., from submissions to SURBL lists, either for blocking or whitelisting): would a few of you mind running the new version (1.5) of GetURI (http://ry.ca/geturi/) on one or two of your domain lists? Just export your list of domains to a text file (one domain per line), and run geturi something like so: $ geturi --spamdomains=spamdomains.txt --age > domains.html If you also have lists of domains that appear in ham, even better! Send those to --hamdomains=hamdomains.txt, and you can guard against FPs. Alternatively, if you don't have the time to fiddle with GetURI yourself, then, for a limited time only, you can submit domain lists directly to my email address with "DOMAINS FOR GETURI" in the subject, and I'll run the report for you and post or email the output at your request. I'm curious to know if this is the kind of output you're looking for, and if there'd be anything else that would be a big help to your efforts, without decreasing accuracy. What are you currently doing to hand-check? My main goal is to reduce the effort required to *accurately* hand-check domains so we can focus on the quality of our submissions. Thanks, - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

2 4

Re: SURBL problems
by Jeff Chan 07 Sep '04

07 Sep '04

On Monday, September 6, 2004, 5:57:32 PM, Kai Schaetzl wrote: > Jeff Chan wrote on Mon, 6 Sep 2004 16:56:57 -0700: >> Hang on, that's not a meaningful test since it would be in your >> local resolver cache. >> > First check took 22 msec to get the data from our forwarder. I noticed > that our nscd isn't running, so I restarted it, although I don't think > there should be much difference in the performance. The SA timeout in > MailScanner is 120 secs, that's quite long. Is it possible at all that > URISURBL lookups take that long and aren't killed before that? I assume all programs are subject to some kind of DNS lookup timeouts either in the application or an external resolver. RBL lookups in general should be quite fast and cached. If something is taking longer than 120 seconds it's probably broken. Given that name resolution on RBLs should normally take a few milliseconds, if they're taking more than a few seconds there could definitely be a problem somewhere. nscd is some kind of hostname caching program but I'm not familiar with it. Are things better after you restarted it? Why did it stop? Did it give any error messages? Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Re: SURBL problems
by Jeff Chan 07 Sep '04

07 Sep '04

On Monday, September 6, 2004, 4:20:56 PM, Kai Schaetzl wrote: > I haven't debugged this yet any further since I'm on the brink to leaving > for a vacation. Is it possible that one or more of the SURBL RBLs habe > problems today? I was getting a lot of SA time-outs today and the first > reason which comes to my mind is SURBL lookups. It's the only RBL lookup > we use in SA which is run via MailScanner. If SA times out it gives it a > score of 0.00, tells me the reason (SA timeout) and handles the spam as > clean. For the last hours this happened with about every second incoming > mail (spam and ham likewise, so it's unlikely to be some sort of "bad" > spam). This setup has been running for some weeks now, MailScanner 4.32.x > plus SA3-RC2, without any problems. SA timeout for MailScanner is set to > 120 seconds. There doesn't seem to be a timeout value for SURBL checks - > is this possible? No changes to setup or software during the last days, > machine has low load. What you describe sounds perhaps like a DNS timeout (which SA3 may support through your operating system's resolver). There are currently three SURBL nameservers with problems, but they're all commented out of the authority for the subdomains, so they should not be a problem. If you do: dig test.surbl.org.multi.surbl.org a many times, do you get any delays? Is anyone else seeing problems? Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 3

Open Redirector
by Leonardo Helman 06 Sep '04

06 Sep '04

Hi, lately I'm receiving lots of spam pointing to this open redirector <http://lanzadera.ya.com/> site. This is a spanish site, something like tinyurl. They are hosting for example: www.gueb.de and www.imagenes.de So, the spam points to www.gueb.de/somewhere, and gets redirected from there. How are you people dealing with this? Is this the appropiate list to report this kind of things? Thanks Saludos -- Leonardo Helman Pert Consultores Argentina

3 3

False Positives
by Mariano Absatz 06 Sep '04

06 Sep '04

Hi, browsing my autodetected spam folder, I came across a couple of messages from Randy Cassingham's 'This is True' newsletter (see http://thisistrue.com) that hit on SURBL lists.. Randy uses plain text advertising within is bulletin but he's not a spammer... in fact he wrote and maintains a 'spam primer' page at http://www.spamprimer.com/ The domains that hit this where: REMOVETHIS-JumboJoke.com and REMOVETHIS-BonzerSites.com (in outblaze's list) and REMOVETHIS-HealthYouDeserve.com (in Bill's list). -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com

2 5

fp hsc news dot com
by Jose Marcio Martins da Cruz 06 Sep '04

06 Sep '04

Hello, "hsc - news dot com" is listed at ws and multi.surbl. This a very serious french security consulting group. Surely a false positive. Can you remove it ? They run a list but only subscription is **only** done when **explicitely** asked by recipients - I know as I'm one of their subscribers. Best regards, Jose-Marcio -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

5 8

Domain age
by Ryan Thompson 06 Sep '04

06 Sep '04

Hi all, I added some experimental code to GetURI to automatically determine the age of a domain, which works for about 99.2% of the domains I've seen in SURBL, and, with a little bit of gaussian math, the results are fricken' *amazing* for classification! Unfortunately, I need a way to be able to do this without violating registry whois terms of service, because they don't allow automated queries, "except as reasonably required to register and update domains" or somesuch... Any ideas? - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

3 2

← Newer
1
...
14
15
16
17
18
19
20
...
23
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss September 2004