Discuss March 2005

discuss@lists.surbl.org

31 participants
58 discussions

Fw: TKO Notice: Urgent Fraud Investigation
by Kevin A. McGrail 14 Mar '05

14 Mar '05

Is ebay running an open relay now???? See this phish below and look at this url! http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&Doma… Regards, KAM ----- Original Message ----- From: eBay(a)reply3.ebay.com To: kmcgrail(a)peregrinehw.com Sent: Wednesday, February 16, 2005 8:44 PM Subject: TKO Notice: Urgent Fraud Investigation Place or Update Credit Card on File Dear Kmcgrail(a)peregrinehw.com , This is your final warning … [View More]about the safety of your eBay account. If you do not update your billing informations your access on eBay will be restricted and the user deleted. This might be due to either following reasons: - A recent change in your personal information (i.e. change of address) - Submiting invalid information during the initial sign up process. - An inability to accurately verify your selected option of payment due an internal error within our processors. Your credit card on file with eBay Card number: XXXX-XXXX-XXXX-4322 (Not shown for security purposes) Expiration date: 11/05 Please sign in to your eBay account and update your billing information: https://signin.ebay.com/saw-cgi/eBayISAPI.dll?SignIn&UsingSSL=1 If your account information is not updated, your ability to sell or bid on eBay will become restricted. Thank you, eBay Billing Department -------------------------------------------------------------------- eBay treats your personal information with the utmost care, and our Privacy Policy is designed to protect you and your information. eBay will never ask their users for personal information, such as bank account numbers, credit card numbers, pin numbers, passwords, or Social Security numbers in an email. For more information on how to protect your eBay password and your account, please visit User Account Protection. This eBay notice was sent to you based on your eBay account preferences and in accordance with our Privacy Policy. To change your notification preferences, click here. If you would like to receive this email in text format, click here. Copyright © 2005 eBay Inc. All Rights Reserved. Designated trademarks and brands are the property of their respective owners. eBay and the eBay logo are trademarks of eBay Inc. [View Less]

5 5

[Slight OT] Dansguardian+SURBL
by RD 14 Mar '05

14 Mar '05

Hello SURBL Team, Anyone aware of dansguardian patch to support SURBL ? Thanks, RD

1 0

List of spamvertised sites sent via zombies, open proxies, etc.?
by Jeff Chan 13 Mar '05

13 Mar '05

Does anyone have or know about a list of spam-advertised URIs where the spam they appeared in was sent through open relays, zombies, open proxies, etc. In other words does anyone know of a list of spamvertised web sites or their domains that's been cross referenced to exploited hosts? We could use that information as a valuable tool for getting more records into SURBLs. Please let me know here or off list. :-) Cheers, Jeff C. -- "If it appears in hams, then don't list it."

3 9

RE: [SURBL-Discuss] Re: Was: List of spamvertised sites sent viazombies, open proxies, etc.?
by Matthew Wilson 13 Mar '05

13 Mar '05

Jeff, I'm confused... Why are you looking for historical snapshot or summary data when the nature of the message stream is to change continually? Surely any statistics that would correlate domains and XBL'ed hosts would only be good for a day or two at the most?? Matthew

2 1

RE: [SPAM-TAG] Re: [SURBL-Discuss] A list of spammers urls
by Matthew.van.Eerde＠hbinc.com 12 Mar '05

12 Mar '05

Jeff Chan wrote: > On Friday, March 11, 2005, 4:33:45 AM, Chris Edwards wrote: >> I wonder if there'd be much mileage in a SpamAssaassin feature to >> award points for any URLs that don't resolve ? > > In principle it's something that could be done, but the timeouts > encountered trying to resolve non-existent domains could make it > impractical. Aren't the name resolution attempts done in parallel? Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 … [View More]

2 1

JP on rulesemporium
by Matthew Wilson 12 Mar '05

12 Mar '05

I'm curious as to why JP isn't queried on the rulesemporium.com SURBL checker?

2 1

A list of spammers urls
by Rakesh 11 Mar '05

11 Mar '05

Here is a list of urls that i compiled from spams. I queried sc.surbl.org, using them but didnt find them listed. Some of the domains are the randomly generated ones and might have became invalid as of now. However some of them are still working. I didnt knew where to report this list to, so I am posting it to this list and Jeff. http://get-internet-software.com/cgi-bin/rd.cgi?poKzgADTMS <http://get-internet-software.com/cgi-bin/rd.cgi?poKzgADTMS> http://surfer-support.com/w30/… [View More]

4 15

RE: [SURBL-Discuss] Spam Honeypot identification through SURBL
by Chris Santerre 10 Mar '05

10 Mar '05

>-----Original Message----- >From: Matthew Wilson [mailto:matthew@boomer.com] >Sent: Thursday, March 10, 2005 12:01 PM >To: Jeff Chan; SURBL Discussion list >Subject: [SURBL-Discuss] Spam Honeypot identification through SURBL > > >Jeff (and list), > >I'm worried that spammers can use SURBL to identify honeypot email >servers by using unique subdomains. A spammer must merely >send a unique >subdomain URL to every address on their list, and if that unique … [View More]

1 0

RE: [SURBL-Discuss] RFC: Updated list removal statement
by Chris Santerre 08 Mar '05

08 Mar '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, March 08, 2005 4:35 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] RFC: Updated list removal statement > > >On a related note, I've updated the list removal statement on the >SURBL web site to include: >__ > > http://www.surbl.org/lists.html > >List Removal > >All of the data in SURBL lists come from external data sources. >None of the SURBL lists come from … [View More]

1 0

RE: [SURBL-Discuss] Spammer Anti-SURBL tactic
by Chris Santerre 08 Mar '05

08 Mar '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, March 08, 2005 2:22 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Spammer Anti-SURBL tactic > > >On Monday, March 7, 2005, 9:07:37 PM, Steven Champeon wrote: > >> Speaking of anti-SURBL tactics, I got this turdlet today (snippet >> of HTML email below): > >> <DIV>We are giving out Free Import / Export / Wholesales/ >Distributers / >> … [View More]Retailers  Contact Database</DIV> >> <DIV> </DIV> >> <DIV>If You interested Pls get at Following URL</DIV> >> <DIV> </DIV> >> <DIV><A >onmouseover="window.status='http://www.impexp-data.com';return true;" >> onmouseout="window.status=' ';return true;" >> href="http://indigisys.com/chawla1/open.htm" target=_blank>Business = >> Database</A> </DIV> >> <DIV> </DIV> >> <DIV>Free Business / Marketing Tools ( Free SMS to All >over world Unl= >> imited ) </DIV> >> <DIV><A >> >onmouseover="window.status='http://www.impexp-data.com/sms';ret >urn true;" >> onmouseout="window.status=' ';return true;" >> href="http://indigisys.com/chawla1/open.htm" >target=_blank>FREE SMS = Tools >> </A></DIV> > >> It *looks* like whoever owns indigisys.com wants to hide the fact >> that they're actually indigisys.com by pretending to be >impexp-data.com, >> which doesn't exist. Does SURBL's lookup code catch this? > >SpamAssassin 2.64 running SpamCopURI seems to check both domains: > >debug: checking url: http://indigisys.com/chawla1/open.htm >debug: returning cached data : indigisys.com.multi.surbl.org >-> ARRAY(0x9351f4c) >debug: Receieved match prefix: 127.0.0 >debug: Receieved mask: 32 >debug: no match > >debug: checking url: http://www.impexp-data.com';return >debug: returning cached data : >impexp-data.com.multi.surbl.org -> ARRAY(0x9386f58) >debug: Receieved match prefix: 127.0.0 >debug: Receieved mask: 32 > >As does SpamAssassin 3.0.1: > >debug: URIDNSBL: query for indigisys.com took 0 seconds to >look up (multi.surbl.org.:indigisys.com) >debug: URIDNSBL: query for impexp-data.com took 0 seconds to >look up (multi.surbl.org.:impexp-data.com) > > >Those are the only SURBL applications I have easy access to, so I >don't know how others may handle them. SpamAssassin does the >right thing. :-) > Not only that, but the SARE rules look for this trick as well. Everytime they try to get around something, spammers end up painting themselves in a corner. --Chris [View Less]

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss March 2005