Discuss October 2005

discuss@lists.surbl.org

15 participants
9 discussions

okay to talk about sorbs here?
by George Georgalis 02 Nov '05

02 Nov '05

Before I started using spam.dnsbl.sorbs.net I tested a corpus of spam and ham and determined the best way to implement. But in the past 48 hours, mail relays from road runner, and cablevision have been added. http://www.us.sorbs.net/using.shtml spam.dnsbl.sorbs.net - List of hosts that have been noted as sending spam/UCE/UBE to the admins of SORBS. This zone also contains netblocks of spam supporting service providers, including those who provide websites, DNS or drop boxes for a spammer. Spam supporters are added on a 'third strike and you are out' basis, where the third spam will cause the supporter to be added to the list. While I appreciate sending the message to lame ISPs about controlling their users, adding these relays to the blacklist causes a lot of false positives. Has sorbs been reasonable in their judgment to add them, how often does it take 30 million (or whatever) random subscribers to produce 3 spams, and what is reasonable for an ISP to do about it? I have filled out their (sorbs) complex web support forms before, on behalf of a 3rd party, and never got a response. Now, since I'm complaining about relays being added that aren't mine, I cannot even get through the questions to a dialog I can enter my observation (when I properly answer the questions). Unfortunately for me this is 2 strikes and you're out, sorbs. Is there a good alternative for spam.dnsbl.sorbs.net? // George -- George Georgalis, systems architect, administrator <IXOYE>< http://galis.org/ cell:646-331-2027 mailto:george@galis.org

4 6

New engine, sc2 ready
by Jeff Chan 29 Oct '05

29 Oct '05

After everyone's help testing the revised SC2 data and my writing some code, the new SURBL engine and SC2 data are ready to roll out. SC2 will become the production SC SpamCop-based list. It will catch significantly more spam than the older version. New new engine also features a faster cycle time, more uniform handling of all the data, etc. Unless there are objections, I think I'll probably just start rolling it out and announcing the change when it's done. The process should be seamless and invisible to end users and DNS admins, aside from a higher SC detection rate and some minor improvements elsewhere. Questions? Comments? Jeff C. -- Don't harm innocent bystanders.

1 0

domain "domain" blacklisted
by Jose Marcio Martins da Cruz 28 Oct '05

28 Oct '05

Hi, The domain "domain" 8-) is listed at jp and generated a false positive (at one of our users). Can you whitelist it please ? domain :127.0.0.64:Blocked, domain on lists [jp], See: http://www.surbl.org/lists.html Regards, Jose-Marcio -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

2 2

uk DOT geocities DOT com
by Frank Ellermann 13 Oct '05

13 Oct '05

Hi, please remove uk. geocities .com from all white lists and/or add it manually to local URIBLs, it's a black hat. Bye, Frank <news://news.spamcop.net/43456728.12D5@xyzzy.claranet.de>

10 32

use of surbl to check non-body content?
by Steven Champeon 12 Oct '05

12 Oct '05

I've noticed that SURBL (and URIBL, who I will contact later) lists several domains that have appeared in spam header contents as well as in body contents. I'd like to use SURBL (probably multi) as an optional domains BL check against headers known to contain domains, such as the Message-ID, From, and Reply-To headers, a la Message-Id: <200510020442.j924gBkv021479(a)expoactive.net> From: ExpoActive <advertising(a)expoactive.net> Reply-To: advertising(a)expoactive.net From: "Steven McGuire" <stevenmcguire(a)aaaaa2.com> List-Unsubscribe: <mailto:leave-2005_1-6m_optin-10289508G@aaaaa2.com> Message-Id: <LYRIS-10289508-169-2005.10.03-20.50.13--{vic#tim}(a)aaaaa2.com> From: "iMarketing Sales Leads" <julieandrews(a)imailzone.info> Reply-To: "OAG" <club(a)reachmail.net> From: TuneUp Software Newsletter <newsletter(a)tune-up.com> Reply-To: newsletter4v2-reply(a)newsletter.tune-up.com From: "Solutions" <info(a)disklesspc.com> Reply-To: info(a)disklesspc.com From: "Millionaires Concierge" <info(a)millionaires-concierges1.com> Reply-To: info(a)millionaires-concierges1.com Message-Id: <200510020442.j924gBkv021479(a)expoactive.net> From: ExpoActive <advertising(a)expoactive.net> Reply-To: advertising(a)expoactive.net As I've only received 23 spams not otherwise classifiable as worth blocking using other means (e.g., 419 scams which can be blocked by injection IP) this /month/, having successfully blocked all the rest, I'd really like to take advantage of the realtime nature of SURBLs. I could see immediate results in the form of blocking literally 1/3 of the remaining spam I allow in here. Comments? This would be an optional configuration for my enemieslist package, which I intend to have more widespread distribution eventually but which would not represent a crushing query load at present. -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com antispam news, solutions for sendmail, exim, postfix: http://enemieslist.com/

4 10

Re: [SURBL-Discuss] use of surbl to check non-body content?
by Jeff Chan 12 Oct '05

12 Oct '05

[Rob confirmed he meant to send his reply below to the list. Here's my reply to his (unintentionally) private reply.] On Wednesday, October 12, 2005, 7:14:51 AM, Rob McEwen wrote: >>Were you resolving SURBL domains >>then checking resolved IPs against header IPs? > No, I wasn't. Even though IPs on SURBL are rare, when they do occur, they > are prime candidates for FPs if/when checking headers. > Of course, SURBL FPs on the body of the message are already extremely > rare... But, even so, because we've been constantly making improvements in > that area as well, it is entirely possible that SURBL FPs when checking > against headers might be MORE rare now than in previous months... again, > this being due to our steady and constant across-the-board improvements. While it's true that many of the IPs that appear on SURBLs are probably zombies and those zombies could be used as senders, this is straying pretty far from the original purpose of the lists. Probably something like CBL or XBL would be much better general compromised sender lists to check against message headers. Even something like a Dynamic IP list like dynablock.njabl.org may be a better indicator of zombie-ness. I have not done any research, but far more of the zombies are probably on those lists than as IPs on SURBLs. BTW you sent your reply privately. May I post this? Jeff C. -- Don't harm innocent bystanders.

1 0

Geocities ( and other free/anon hosts...) treated as virtual TLDs
by Eric Montréal 10 Oct '05

10 Oct '05

Hi, I'm new here, so sorry if this have been previously debated. I have seen your discussion about blacklisting geocities. This would create so many FP it's clearly impossible, but I wonder if treating these domains as 3rd / 4th level TLD could be the way to go ... Example: This (-munged) real spammy address http://uk.geocities-munged.com/Gonzalo_Freehling/ could be translated into gonzalo_freehling.uk.geocities-munged.com and then queried ... The translation would require some specific code for these 'virtual TLD' domains in URIDNSBL.pm (for SA3) but would allow catching otherwise undetected URI, while having no FP for non spammy geocities sites. For it to work, the 'virtual TLD' domains should be flagged, either by setting a specific bit in the returned data (during normal queries to the domain) or maintaining a downloadable list. Does it make sense ?

3 2

uk.geocities-munged-.com
by Kevin A. McGrail 10 Oct '05

10 Oct '05

As a follow-up to the UK geocities issue, I fear that this may be related to spyware or a virus. Over the past few weeks, I've identified a few patterns. For example the email below contains 5 email addresses, 4 of which are quite unique. You will also note they are not indicative of a dictionary attack yet they were all email in one single SPAM. Further, at least one of the people on this list passed away over a year ago. Additionally, what I have been seeing is VERY VERY unique emails getting hammered with SPAM and I believe it must be a virus/spyware that is getting the address books off of machines because the emails are too unique to guess. I don't know what to do with this information other than put out my $0.02 that I think people are targeting address books and I can't prove it :-( Regards, KAM > ----- Original Message ----- > From: "parker hair" <lyric(a)bowiewonderworld.com> > To: "Carson Magruder" <payne(a)summerconsultants.com> > Cc: <nance(a)summerconsultants.com>; <hoffman(a)summerconsultants.com>; > <ward(a)summerconsultants.com>; <mail(a)summerconsultants.com> > Sent: Thursday, October 06, 2005 10:06 AM > Subject: bon In a relaxing ishopping mall, nail down quick alleviators. bus > > > > > > Cutback costs for real remedies. > > > > Fast effects antibiotics to allay your fever. > > It's our value that fulfils efficient shipping. > > Ours affordable because of lessen operating cost. > > > > Let our expert review your meddical profiles at zero charge. > > Thanks for facilitating gratis online consultation. Ben J --CA. > > > > http://uk.geocities-munged-.com/windsnarlgreatb/?owgroclo > >

2 1

New redirector: www.nate.com
by Richard Grabowski 07 Oct '05

07 Oct '05

Dear David, I am an attorney in California. Our firm represent ISPs and have begun to actively pursue SPAMMERS under the California fraud laws and the Federal Can SPAM act. I have been following yours and your colleague's messages on [SURBL-Discuss]. Our primary problem is identifying SPAMMERS in a way that we can start a federal action against them. "Redirect" problems add to our other problems of identifying SPAMMERS. Currently we are trying to Identify defendant's by tracking them to the retail site they represent. We then include the owner of the retail site, the registrar of the domain (in almost every case this is YES NICK LTD), and any technicians we identify along the way. Ignore the arguments you have heard about what can and cannot be brought under the current law - I really think this has been produced by attorneys who are defending SPAMMERS to get ISP's and federal/State prosecutors not to bring actions, or to set up some kind of future defense. I am looking for any help you or your associates might be able to provide. I realize you must be skeptical. Therefore you can check my credentials at the CA State Bar site (look it up on google) by doing an attorney search on my name - Richard Grabowski. I am located in Eureka, CA. In addition to being an attorney I have over 30 years experience as a technician in the IT and Telecommunications industry. I worked for GTE, DMR and BusinessEdge as a senior enterprise architect. I am looking for tools, freeware or paid, that help track domains, email servers, senders, etc. Anything that will help identify the actual source of the SPAM in a quick and efficient manner. I am working with high end technicians that have extensive experience in this area, but I am always looking for more help. We will bring actions against SPAMMERS in foreign countries. We do not actually expect them to respond to a federal complaint, so we will end up with default judgments. These are relatively cheap to pursue. We will then try to make a deal with the legal agencies in the foreign country, a percentage, to try and recover on the judgment. This may eventually make it too expensive for the SPAMMERS to continue, or it may incent the local legal agencies to actually pursue the SPAMMERS, rather than protect them. As I have said we are actively pursuing this tactic now. I am hoping that you and your colleagues will want to help. The enforcement of SPAM laws is currently being left to the FTC and State prosecutors. These agencies have little or no budget to pursue these activities. I unfortunately believe that the laws were set up limiting enforcement primarily to the FTC in order to prevent any real prosecutions. This is a tactic of some politicians to support their contributors without actually having to oppose legislation. In this case it has made enforcement of the SPAM laws very unlikely. The only case I know of is a joint action by the FTC and CA State Atty Gnl.: FTC and People of CA v. Optin Global, Inc. and Vision Media Limited, Corp. You can find the federal filing at: http://www.ftc.gov/os/caselist/0423172/050413comp0423172.pdf We are using this filing as the template for our filings. If you can help I would really like to hear from you. Thanks, Richard Grabowski rgrabows(a)pacbell.net W - 707 441-1487 C - 707 771-9585

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss October 2005