Discuss March 2005

discuss@lists.surbl.org

31 participants
58 discussions

Fw: TKO Notice: Urgent Fraud Investigation
by Kevin A. McGrail 14 Mar '05

14 Mar '05

Is ebay running an open relay now???? See this phish below and look at this url! http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&Doma… Regards, KAM ----- Original Message ----- From: eBay(a)reply3.ebay.com To: kmcgrail(a)peregrinehw.com Sent: Wednesday, February 16, 2005 8:44 PM Subject: TKO Notice: Urgent Fraud Investigation Place or Update Credit Card on File Dear Kmcgrail(a)peregrinehw.com , This is your final warning about the safety of your eBay account. If you do not update your billing informations your access on eBay will be restricted and the user deleted. This might be due to either following reasons: - A recent change in your personal information (i.e. change of address) - Submiting invalid information during the initial sign up process. - An inability to accurately verify your selected option of payment due an internal error within our processors. Your credit card on file with eBay Card number: XXXX-XXXX-XXXX-4322 (Not shown for security purposes) Expiration date: 11/05 Please sign in to your eBay account and update your billing information: https://signin.ebay.com/saw-cgi/eBayISAPI.dll?SignIn&UsingSSL=1 If your account information is not updated, your ability to sell or bid on eBay will become restricted. Thank you, eBay Billing Department -------------------------------------------------------------------- eBay treats your personal information with the utmost care, and our Privacy Policy is designed to protect you and your information. eBay will never ask their users for personal information, such as bank account numbers, credit card numbers, pin numbers, passwords, or Social Security numbers in an email. For more information on how to protect your eBay password and your account, please visit User Account Protection. This eBay notice was sent to you based on your eBay account preferences and in accordance with our Privacy Policy. To change your notification preferences, click here. If you would like to receive this email in text format, click here. Copyright © 2005 eBay Inc. All Rights Reserved. Designated trademarks and brands are the property of their respective owners. eBay and the eBay logo are trademarks of eBay Inc.

5 5

[Slight OT] Dansguardian+SURBL
by RD 14 Mar '05

14 Mar '05

Hello SURBL Team, Anyone aware of dansguardian patch to support SURBL ? Thanks, RD

1 0

List of spamvertised sites sent via zombies, open proxies, etc.?
by Jeff Chan 13 Mar '05

13 Mar '05

Does anyone have or know about a list of spam-advertised URIs where the spam they appeared in was sent through open relays, zombies, open proxies, etc. In other words does anyone know of a list of spamvertised web sites or their domains that's been cross referenced to exploited hosts? We could use that information as a valuable tool for getting more records into SURBLs. Please let me know here or off list. :-) Cheers, Jeff C. -- "If it appears in hams, then don't list it."

3 9

RE: [SURBL-Discuss] Re: Was: List of spamvertised sites sent viazombies, open proxies, etc.?
by Matthew Wilson 13 Mar '05

13 Mar '05

Jeff, I'm confused... Why are you looking for historical snapshot or summary data when the nature of the message stream is to change continually? Surely any statistics that would correlate domains and XBL'ed hosts would only be good for a day or two at the most?? Matthew

2 1

RE: [SPAM-TAG] Re: [SURBL-Discuss] A list of spammers urls
by Matthew.van.Eerde＠hbinc.com 12 Mar '05

12 Mar '05

Jeff Chan wrote: > On Friday, March 11, 2005, 4:33:45 AM, Chris Edwards wrote: >> I wonder if there'd be much mileage in a SpamAssaassin feature to >> award points for any URLs that don't resolve ? > > In principle it's something that could be done, but the timeouts > encountered trying to resolve non-existent domains could make it > impractical. Aren't the name resolution attempts done in parallel? Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer perl -e"map{y/a-z/l-za-k/;print}shift" "Jjhi pcdiwtg Ptga wprztg,"

2 1

JP on rulesemporium
by Matthew Wilson 12 Mar '05

12 Mar '05

I'm curious as to why JP isn't queried on the rulesemporium.com SURBL checker?

2 1

A list of spammers urls
by Rakesh 11 Mar '05

11 Mar '05

Here is a list of urls that i compiled from spams. I queried sc.surbl.org, using them but didnt find them listed. Some of the domains are the randomly generated ones and might have became invalid as of now. However some of them are still working. I didnt knew where to report this list to, so I am posting it to this list and Jeff. http://get-internet-software.com/cgi-bin/rd.cgi?poKzgADTMS <http://get-internet-software.com/cgi-bin/rd.cgi?poKzgADTMS> http://surfer-support.com/w30/pikapika.html <http://surfer-support.com/w30/pikapika.html> http://sanguozhi10.com/tp/default.asp <http://sanguozhi10.com/tp/default.asp> http://pinghetang.com/ http://get-internet-software.com/w30/pikapika.html <http://get-internet-software.com/w30/pikapika.html> http://tempole.com http://bma.net.mypillsvalues.com <http://bma.net.mypillsvalues.com> http://rckksa.a6.defenses8093biz.us <http://rckksa.a6.defenses8093biz.us> http://pj.decatur9854rx.us http://nht.p.aye3054biz.us http://i.p.aye3054biz.us http://rd.a6.defenses8093biz.us <http://rd.a6.defenses8093biz.us> http://rem.decatur9854rx.us http://xanb.su.aye3054biz.us http://pd.abk.crucify8156pi11.us <http://pd.abk.crucify8156pi11.us> opp.dacemhad.us <http://opp.dacemhad.us> images.dacemhad.us <http://images.dacemhad.us> http://q.m.crucify8156pi11.us http://popupblocker-software.com/w30/pikapika.html <http://popupblocker-software.com/w30/pikapika.html> http://history-cleaner-software.com <http://history-cleaner-software.com> http://www.spyware-killer-software.com <http://www.spyware-killer-software.com> http://images.NCatalpa2m.biz/ http://Passionvin.biz -- Regards, Rakesh B. Pal Emergic CleanMail Team. Netcore Solutions Pvt. Ltd. ======================================================================== It doesn't matter who you are, it's what you do that takes you far ======================================================================== ---------------------------------------------------------- Netcore Solutions Pvt. Ltd. Website: http://www.netcore.co.in Spamtraps: http://cleanmail.netcore.co.in/directory.html ----------------------------------------------------------

4 15

RE: [SURBL-Discuss] Spam Honeypot identification through SURBL
by Chris Santerre 10 Mar '05

10 Mar '05

>-----Original Message----- >From: Matthew Wilson [mailto:matthew@boomer.com] >Sent: Thursday, March 10, 2005 12:01 PM >To: Jeff Chan; SURBL Discussion list >Subject: [SURBL-Discuss] Spam Honeypot identification through SURBL > > >Jeff (and list), > >I'm worried that spammers can use SURBL to identify honeypot email >servers by using unique subdomains. A spammer must merely >send a unique >subdomain URL to every address on their list, and if that unique >subdomain is blacklisted in SURBL, they have identified a potential >honeypot and will no longer send spam to that address/server. > >It is therefore my humble opinion that only the second-to-top domain >name should be listed in SURBL, and not any of the subdomains. > >Thoughts? > >-Matthew Wilson I make it a point to not list subdomains. Only the main domains get listed by me. If one got in, it was an oversight. When some submissions come in from certain projects, I will purposely delay their addition to SURBL, so that spammers can't time them with spam runs. But frankly the domains come from so many different sources, it doesn't matter much. --Chris

1 0

RE: [SURBL-Discuss] RFC: Updated list removal statement
by Chris Santerre 08 Mar '05

08 Mar '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, March 08, 2005 4:35 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] RFC: Updated list removal statement > > >On a related note, I've updated the list removal statement on the >SURBL web site to include: >__ > > http://www.surbl.org/lists.html > >List Removal > >All of the data in SURBL lists come from external data sources. >None of the SURBL lists come from data created here, so generally >speaking to get a record off a list you should contact that data >source as described earlier under each list. However, for the sc >and ab lists you may send a removal request to whitelist at surbl >dot org. > > Note: Before reporting false positives, please check that > they are actually on SURBL lists. This can be done for > example with a name resolution or by using the SURBL+ > checker tool. There is an intermittent bug with SpamAssassin > that appears to show FPs when none actually exist. (See > SpamAssassin Bugzilla id=3997.) > >When sending a removal request, please include: > > 1. Full and complete contact information for your organization > including street address and telephone numbers, > 2. Information about your sending servers such as IP addresses, > 3. A sample message with full, sent headers and full message > body including URIs, > 4. A brief description of your organization or a link to one, > 5. Your organization's published mail practices, especially > its published anti-spam policies, or links to them. > >If your organization does not publish and actually practice an >anti-spam policy, it should. Please send your request from your >organization's domain. Requests sent from Hotmail, Yahoo, gmail, >etc. accounts may not be considered. >__ > >How does this look to everyone? Too strict? Not strict enough? >Too little info? Too much? How about: "Be prepaired to explain any UBE that is found to contain your domain." "Understand that you ARE responsible for the actions of your affiliates." "If you purchased a list which contains harvested addresses and use them in a mailing, then you are commiting a crime." "'Just unsubscribe!', is NOT a valid response!" --Chris

1 0

RE: [SURBL-Discuss] Spammer Anti-SURBL tactic
by Chris Santerre 08 Mar '05

08 Mar '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, March 08, 2005 2:22 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Spammer Anti-SURBL tactic > > >On Monday, March 7, 2005, 9:07:37 PM, Steven Champeon wrote: > >> Speaking of anti-SURBL tactics, I got this turdlet today (snippet >> of HTML email below): > >> <DIV>We are giving out Free Import / Export / Wholesales/ >Distributers / >> Retailers  Contact Database</DIV> >> <DIV> </DIV> >> <DIV>If You interested Pls get at Following URL</DIV> >> <DIV> </DIV> >> <DIV><A >onmouseover="window.status='http://www.impexp-data.com';return true;" >> onmouseout="window.status=' ';return true;" >> href="http://indigisys.com/chawla1/open.htm" target=_blank>Business = >> Database</A> </DIV> >> <DIV> </DIV> >> <DIV>Free Business / Marketing Tools ( Free SMS to All >over world Unl= >> imited ) </DIV> >> <DIV><A >> >onmouseover="window.status='http://www.impexp-data.com/sms';ret >urn true;" >> onmouseout="window.status=' ';return true;" >> href="http://indigisys.com/chawla1/open.htm" >target=_blank>FREE SMS = Tools >> </A></DIV> > >> It *looks* like whoever owns indigisys.com wants to hide the fact >> that they're actually indigisys.com by pretending to be >impexp-data.com, >> which doesn't exist. Does SURBL's lookup code catch this? > >SpamAssassin 2.64 running SpamCopURI seems to check both domains: > >debug: checking url: http://indigisys.com/chawla1/open.htm >debug: returning cached data : indigisys.com.multi.surbl.org >-> ARRAY(0x9351f4c) >debug: Receieved match prefix: 127.0.0 >debug: Receieved mask: 32 >debug: no match > >debug: checking url: http://www.impexp-data.com';return >debug: returning cached data : >impexp-data.com.multi.surbl.org -> ARRAY(0x9386f58) >debug: Receieved match prefix: 127.0.0 >debug: Receieved mask: 32 > >As does SpamAssassin 3.0.1: > >debug: URIDNSBL: query for indigisys.com took 0 seconds to >look up (multi.surbl.org.:indigisys.com) >debug: URIDNSBL: query for impexp-data.com took 0 seconds to >look up (multi.surbl.org.:impexp-data.com) > > >Those are the only SURBL applications I have easy access to, so I >don't know how others may handle them. SpamAssassin does the >right thing. :-) > Not only that, but the SARE rules look for this trick as well. Everytime they try to get around something, spammers end up painting themselves in a corner. --Chris

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss March 2005