Discuss September 2004

discuss@lists.surbl.org

62 participants
229 discussions

Most often "hit" SURBL domains
by Rob McEwen 01 Oct '04

01 Oct '04

RE: Most often "hit" SURBL domains >From time to time, ideas float around about how we can take some pressure off of the SURBL name servers. Recently, most commonly queried URIs that are NOT (and should not) be blocked were mentioned in the hopes that people would "whitelist" these locally so their mail servers would stop querying SURBL for stuff like microsoft.com, ebay.com, etc. I have a similar idea. Would it be possible to have a running list of the top 20 (or so... 50? 100?) most often queried URI's that are blocked by SURBL (and which should be blocked)? This way, we could take additional pressure off SURBL DNS servers by blacklisting these domains locally BEFORE doing SURBL checking on such messages? I have a feeling that this has already been requested and implemented?? Rob McEwen

7 14

Blogs still using SURBL?
by Chris Santerre 30 Sep '04

30 Sep '04

I remember there was some excitement that blogers had code to check links posted against SURBL. Is that still being used? I figured that would be bigger news. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 3

FW: SURBL+ Checker Submission
by Chris Santerre 30 Sep '04

30 Sep '04

Somone who understand spanish check this for me please :) >-----Original Message----- >From: SURBL+ Checker [mailto:surbl@rulesemporium.com] >Sent: Thursday, September 30, 2004 8:45 AM >To: csanterre(a)MerchantsOverseas.com >Subject: SURBL+ Checker Submission > > >Date: Thu Sep 30 07:44:54 2004 >Reporter IP: MUNGED > >Applicable List: URIBL:ws.surbl.org >Reported URI/IP: directal.com.ar >Rating: Black - 100% spam > >Email Source: >---------------------------------------- > >From elsmtpfunciona(a)yahoo.com.ar Thu Sep 30 08:58:24 2004 >Message-ID: <41408-220049524173729270(a)infobae.com> >From: computacion <elsmtpfunciona(a)yahoo.com.ar> >To: Enterese antes que salga <elsmtpfunciona(a)yahoo.com.ar> >Subject: Enterese antes que salga...Directal.(8) >Date: Fri, 24 Sep 2004 14:37:29 -0300 >MIME-Version: 1.0 >x-fib-al-from: elsmtpfunciona(a)yahoo.com.ar >x-fib-al-ps: AAA >x-fib-al-sa: ham, Al-SA-2.63 (punt=3.365, req 8, ALE_MENS_OFER >1.00,MIME_BASE64_LATIN 1.10, MIME_BASE64_TEXT >1.10,MIME_BOUND_NEXTPART 0.16) >x-fib-al: lmp >x-fib-al-mxid: 65f376f369eeeb6a2e105730a55415e1 >x-fib-al-info: Al >x-return-path: elsmtpfunciona(a)yahoo.com.ar >x-mdremoteip: 192.168.0.11 >x-spam-processed: microsoft.com, Fri, 24 Sep 2004 19:39:28 >+0200(not processed: message from trusted or authenticated source) >Content-Type: text/plain; > charset="iso-8859-1" >Content-Transfer-Encoding: quoted-printable >Status: RO > > <http://www.directal.com.ar/news/23_9_04/Directal.jpg> =09 > > >Los precios pueden variar sin previo aviso. El costo del env=EDo es a >cargo del cliente >Ofertas sujetas a stock. Precios en dolares estadounidenses con IVA >incluido >12 Meses de Garantia >Si desea suscribirse al envio de ofertas persione aqui ><mailto:suscribir@directal.com.ar?Subject=3Dsuscribir> .=20 >Si no desea recibir , por favor presione aqui ><mailto:remover@directal.com.ar?Subject=3DRemover> =20 > >(realmente damos de baja, no modifique subjet / asunto por que se >procesa autom=E1ticamente en 96hs. )=20 >Gracias y disculpe las molestias=20 > > <http://www.directal.com.ar/news/pieMEJOR2.jpg>=20 > >=20 > >=20 > > > >---------------------------------------- >

2 1

RE: [SURBL-Discuss] Most often "hit" SURBL domains
by Chris Santerre 30 Sep '04

30 Sep '04

>-----Original Message----- >From: Rob McEwen [mailto:rob@powerviewsystems.com] >Sent: Wednesday, September 29, 2004 7:42 PM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] Most often "hit" SURBL domains > > >RE: Most often "hit" SURBL domains > >>From time to time, ideas float around about how we can take >some pressure >off of the SURBL name servers. Recently, most commonly queried >URIs that are >NOT (and should not) be blocked were mentioned in the hopes that people >would "whitelist" these locally so their mail servers would >stop querying >SURBL for stuff like microsoft.com, ebay.com, etc. > >I have a similar idea. Would it be possible to have a running >list of the >top 20 (or so... 50? 100?) most often queried URI's that are blocked by >SURBL (and which should be blocked)? This way, we could take additional >pressure off SURBL DNS servers by blacklisting these domains >locally BEFORE >doing SURBL checking on such messages? > >I have a feeling that this has already been requested and implemented?? > Could this be done in a host file? 0.0.0.0 aol.com.ws.surbl.org Would something like that work? --Chris

1 0

RE: [SURBL-Discuss] Fwd: quickinspirations.com
by Chris Santerre 30 Sep '04

30 Sep '04

>-----Original Message----- >From: David Hooton [mailto:david.hooton@gmail.com] >Sent: Thursday, September 30, 2004 9:23 AM >To: Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] Fwd: quickinspirations.com > > >On Wed, 29 Sep 2004 16:54:22 -0700, Jeff Chan <jeffc(a)surbl.org> wrote: >> This was the original report send to the whitelist(a)surbl.org >> address. Note that it included no examples, no explanation, no >> reasons, etc. >> >> That's why it's nice include some of those, eh? >> >> Jeff C. >> __ >> >> This is a forwarded message >> From: Bitz <bitoy(a)lawin.pinoy.org> >> To: whitelist(a)surbl.org >> Date: Friday, July 30, 2004, 5:17:43 PM >> Subject: quickinspirations.com >> >> ===8<==============Original message text=============== >> quickinspirations.com >> >> ===8<===========End of original message text=========== > >Perhaps people who request domains to be delisted but provide no >evidence should just be permanently lists? :p > LOL. Should we at least rethink this kind of domain? Some people are going to scream "Legit!" because they don't know they were fooled. I'm not asking for this domain to be changed right now. I'm asking more for people to start thinking about these kind of legit looking signup spams. Keep the seed in the back of your mind, as we may see more of this. --Chris

1 0

Fwd: quickinspirations.com
by Jeff Chan 30 Sep '04

30 Sep '04

This was the original report send to the whitelist(a)surbl.org address. Note that it included no examples, no explanation, no reasons, etc. That's why it's nice include some of those, eh? Jeff C. __ This is a forwarded message From: Bitz <bitoy(a)lawin.pinoy.org> To: whitelist(a)surbl.org Date: Friday, July 30, 2004, 5:17:43 PM Subject: quickinspirations.com ===8<==============Original message text=============== quickinspirations.com ===8<===========End of original message text=========== -- Jeff Chan mailto:whitelist@surbl.org http://www.surbl.org/

2 1

RE: [SURBL-Discuss] Help classify quickinspirations.com
by Patrik Nilsson 30 Sep '04

30 Sep '04

At 16:14 2004-09-29 -0400, Chris Santerre wrote: >Did you just create a new term? > >"Fisuf Spam" :-) >Works for me! I think I had a "discussion" about this domain with Jeff >before. Which is why I rang a bell. I think this may be one of the ones that >started the whole UC debate. > >Hmmm.... could more Fisuf Spam be around the corner? In my opinion - apparently (according to some definitions) legitimate emails that people have actually signed up for, that are obviously *only* sent out by known spammers to people tricked into entering their adress, or someone elses on a web site, that have *no* real purpose except to send spam - should be classified as spam, *not ham*. Even if people have signed up for the spam. Patrik

3 5

OB FPs
by Alex Broens 30 Sep '04

30 Sep '04

While I always read how reliable OB should be, of the few WL requests I've triggered, all except 1 were from OB. These were pretty ugly ones indeed, an Adobe child site, a Genuine abused Webmail site, etc, etc. juts wondering.... Alex

5 9

Please test: PailPolice fraud list, jp.surbl.org
by Jeff Chan 30 Sep '04

30 Sep '04

This is a request for folks to please test the MailPolice fraud list and jp.surbl.org: MailPolice Fraud list with SpamCopURI: uri MP_URI_RBL eval:check_spamcop_uri_rbl('fraud.rhs.mailpolice.com','127.0.0.2') describe MP_URI_RBL URI's domain appears in MailPolice fraud list tflags MP_URI_RBL net score MP_URI_RBL 3.0 And for SA 3.0 with the URIDNSBL plug-in: urirhsbl URIBL_MP fraud.rhs.mailpolice.com. A header URIBL_MP eval:check_uridnsbl('URIBL_MP') describe URIBL_MP URI's domain appears in MailPolice fraud list tflags URIBL_MP net score URIBL_MP 3.0 (Note that the above is a separate, external list, so it can't be used like multi.) JP SA 2.63 and 2.64 rule and score using SpamCopURI 0.22 or later: uri JP_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0+64') describe JP_URI_RBL URI's domain appears in JP at http://www.surbl.org/lists.html tflags JP_URI_RBL net score JP_URI_RBL 4.0 JP SA 3.0 rule and score using URIBL's urirhssub: urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 header URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') describe URIBL_JP_SURBL Contains a URL listed in JP at http://www.surbl.org/lists.html tflags URIBL_JP_SURBL net score URIBL_JP_SURBL 4.0 In particular we'd like to hear about any false positives on either list. If the MailPolice fraud data looks good, we'll add it to PH, but we need your help in testing it. You can test these on hand selected test corpora or live mail, but please try not to melt the MailPolice name servers. ;-) Please give these a try and let us know what you find. Note that you'll probably want to remove the MailPolice fraud list after testing as a separate list if we add it to PH. Jeff C. -- "If it appears in hams, then don't list it."

2 3

RE: [SURBL-Discuss] FP in OB g4techtv .com
by Chris Santerre 30 Sep '04

30 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, September 29, 2004 12:32 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] FP in OB g4techtv .com > > >On Wednesday, September 29, 2004, 9:15:56 AM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>On Wednesday, September 29, 2004, 7:58:16 AM, Chris Santerre wrote: >>>> 2.0 URIBL_OB_SURBL Contains an URL listed in the OB >>>SURBL blocklist >>>> [URIs: g4techtv .com] >>> >>>> Ahhhhhhh my game news!!!!!! >>> >>>> --Chris >>> >>>I heard they spam... ;-) >>> >>>Whitelist them with documentation. > >> But it is on OB list, I thought I could only whitelist for WS? > >The SURBL whitelist applies to all SURBLs. > >Jeff C. >-- Done deal. --Chris (I hold in my hand, the first Hot Chocolate of the season!)

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss September 2004