Discuss May 2005

discuss@lists.surbl.org

34 participants
64 discussions

Start a nNew thread

RE: [SURBL-Discuss] Re: embedded image spams
by List Mail User 01 Jun '05

01 Jun '05

thouljthou1. com - multitrade group, now omnicorporation New name and address though. Paul Shupak track(a)plectere.com

1 0

Re: embedded image spams
by Sean Sowell 31 May '05

31 May '05

On Tuesday, May 31, 2005 1030, I wrote: >>> Yes, please, if you could mention the ones over the past couple >>> days we'll look into them. Some of the ones you mentioned >>> earlier are already blacklisted, so we'd like to analyze the >>> unlisted recent ones to see how we can list them sooner. >> By the way, just to sanity check things, these are the domains in >> message body URIs and not headers, right? I ask because it's >> somewhat unusual to have two sets of domains in a given spam, >> and SURBLs are meant to operate on message body URIs and not >> headers. > Yes, in the body only. Frequently, these things include an image of a text > disclaimer/opt-out notice at the bottom. Rolling over the image shows the > hyperlinked URI, but the text within the image itself shows a different > domain. OK, here is the updated list. Thanks again: Sun, 29 May 2005 12:22:12 -0700 dayepencilseof.com and myfreecomputer.net Sun, 29 May 2005 20:44:52 GMT yourexclusivesource.com and exclusivesforyou.com Sun, 29 May 2005 20:47:52 GMT airinsider.com and insideroffers.com Sun, 29 May 2005 22:49:59 GMT smartshoppings.com and shoppingsmarts.net Sun, 29 May 2005 22:49:59 GMT smartsclub.com and shoppingsmarts.net Sun, 29 May 2005 23:55:15 -0700 travelocityofhelp.com and consumersurveygroup.com Mon, 30 May 2005 02:06:55 -0700 planetandsunshine.com Mon, 30 May 2005 02:40:41 -0500 undershow.com 30 May 2005 09:49:13 -0400 farcommail.com Mon, 30 May 2005 08:09:57 -0700 travelocityofhelp.com and consumersurveygroup.com Mon, 30 May 2005 21:32:54 +0400 (MSD) eanum.biz Mon, 30 May 2005 10:09:21 -0700 clearcutsavings.com and nyclearcut.com Mon, 30 May 2005 20:47:06 GMT ccgpc.com Mon, 30 May 2005 21:17:05 GMT iasem.com and yourgiftcards.com Mon, 30 May 2005 14:11:10 -0500 undershow.com Mon, 30 May 2005 21:46:58 GMT prcmx.com Mon, 30 May 2005 23:22:10 GMT aiear.com Tue, 31 May 2005 05:56:39 +0400 (MSD) marketingtherightway.com Mon, 30 May 2005 19:41:12 -0700 padlernestedman.com and producttestpanel.com Mon, 30 May 2005 17:26:07 -0700 clrctsvg.com and tickle.com 31 May 2005 03:42:49 -0400 besaway.com and esioffers.com Tue, 31 May 2005 00:58:17 -0500 undershow.com Tue, 31 May 2005 01:40:10 -0700 datdir.com and emarketresearchgroup.com and rocketoffers.com Tue, 31 May 2005 08:44:20 +0000 (GMT) globalsucess.com and zzinc.info Tue, 31 May 2005 08:46:01 +0000 (GMT) globalsucess.com and zzinc.info Tue, 31 May 2005 06:16:26 -0700 datdir.com and fcdsoft.com and rocketoffers.com Tue, 31 May 2005 14:43:27 GMT ibringbargains.com and everyfreegift.com and bringonbargains.com Tue, 31 May 2005 14:45:26 GMT activeselfshopper.com and americanplatinum.com

1 0

RE: [SURBL-Discuss] Re: embedded image spams
by Bjurstrom, Eric 31 May '05

31 May '05

pardon me if this has already been posted, but I am getting some embedded ones through that appear to take advantage of some IE "features" <font></font><A href="ht tp:/ /qeepluq.com&ljeabfhtqemxctry4ts73e%2E tho uljth ou1%2Ecom/"> If I have firefox up, this link goes nowhere. IE will actually turn the %2E to a "." and load it up. I have both the exim perl plugin by erik mugele and spamassassin plugin and neither catch it. -----Original Message----- From: Sean Sowell [mailto:sean@twin-dad.com] Sent: Tuesday, May 31, 2005 1:31 PM To: discuss(a)lists.surbl.org Subject: [SURBL-Discuss] Re: embedded image spams On Tuesday, May 31, 2005 0300, Jeff C. wrote: >> Yes, please, if you could mention the ones over the past couple >> days we'll look into them. Some of the ones you mentioned >> earlier are already blacklisted, so we'd like to analyze the >> unlisted recent ones to see how we can list them sooner. > By the way, just to sanity check things, these are the domains in > message body URIs and not headers, right? I ask because it's > somewhat unusual to have two sets of domains in a given spam, > and SURBLs are meant to operate on message body URIs and not > headers. Yes, in the body only. Frequently, these things include an image of a text disclaimer/opt-out notice at the bottom. Rolling over the image shows the hyperlinked URI, but the text within the image itself shows a different domain. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

Re: embedded image spams
by Sean Sowell 31 May '05

31 May '05

On Tuesday, May 31, 2005 0300, Jeff C. wrote: >> Yes, please, if you could mention the ones over the past couple >> days we'll look into them. Some of the ones you mentioned >> earlier are already blacklisted, so we'd like to analyze the >> unlisted recent ones to see how we can list them sooner. > By the way, just to sanity check things, these are the domains in > message body URIs and not headers, right? I ask because it's > somewhat unusual to have two sets of domains in a given spam, > and SURBLs are meant to operate on message body URIs and not > headers. Yes, in the body only. Frequently, these things include an image of a text disclaimer/opt-out notice at the bottom. Rolling over the image shows the hyperlinked URI, but the text within the image itself shows a different domain.

1 0

RE: Blogger attacks SURBL
by Chris Santerre 31 May '05

31 May '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, May 30, 2005 8:57 PM >To: SURBL Discuss; SpamAssassin Users >Subject: Blogger attacks SURBL > > >Pardon the dramatic title, but hopefully it got your attention. > >This guy's domain got listed by Outblaze, we removed it, and as >thanks this guy paints us as irresponsible. Please help us >straighten him out, gently: > >http://blog.holtz.com/index.php/weblog/comments/blacklisting_blogs/ > >I gave it my shot. > >Jeff C. Thanks for the link. I shot him a 'nice' reply. Some people just don't understand. --Chris (Yeah I thought abuot listing his site just for fun ;)

1 0

Blogger attacks SURBL
by Jeff Chan 31 May '05

31 May '05

Pardon the dramatic title, but hopefully it got your attention. This guy's domain got listed by Outblaze, we removed it, and as thanks this guy paints us as irresponsible. Please help us straighten him out, gently: http://blog.holtz.com/index.php/weblog/comments/blacklisting_blogs/ I gave it my shot. Jeff C. -- Don't harm innocent bystanders.

4 4

Re: embedded image spams
by Sean Sowell 31 May '05

31 May '05

Rakesh Pal wrote: > I have been bugged a lot by embedded image spams recently, although some > of these spams got trapped due URI checks, some managed to pass as well > as the url wasn't yet blocked in the SURBLs. and Jeff Chan wrote: > Please provide the URI and the timestamp it was first seen. > We can use that information to see if we can get them into SURBLs > sooner. Hello --- I've been diligently sending full message sources of similar spam to submit.[code](a)spam.spamcop.net these past several days. My account there is set up as a mole to minimze the chance of being joe-jobbed. My understanding is that spamcop adds a point for that URI in spamcop's database, until it exceeds the threshold needed for inclusion in sc.surbl. Then, by way of the URIBL_SC_SURBL rule in SA 3.0.3, more of these things will be caught as spam, since SA assigns >= 3.8 points to each such spam. Am new to these tools, so I hope I've understood the docs and faq pages correctly ... Jeff, I can send you a zip file with a bunch of these recent message sources (my email client is OE6). Or, do you just need a bunch of Date: / Message-ID: / Content-ID: triplets? Sean S. www.twin-dad.com

2 8

belgischelotto.be
by Jeff Chan 31 May '05

31 May '05

belgischelotto.be appeared in a 419 scam. Anyone (especially in Europe) know if this is a legitimate domain? Jeff C. -- Don't harm innocent bystanders.

2 1

Re: Blogger attacks SURBL
by List Mail User 31 May '05

31 May '05

>... > >Jeff Chan wrote: > >> Pardon the dramatic title, but hopefully it got your attention. >> >> This guy's domain got listed by Outblaze, we removed it, and as >> thanks this guy paints us as irresponsible. Please help us >> straighten him out, gently: >> >> http://blog.holtz.com/index.php/weblog/comments/blacklisting_blogs/ >> >> I gave it my shot. >> >> Jeff C. >> -- >> Don't harm innocent bystanders. > >The way I read his response is that he stands against >SPAM and in favor of anti SPAM measures ... > >*provided* he is not inconvenienced. > > I guess its a good thing he didn't try my servers - Seems we have another user of midphase. com (i.e. his FORIMMEDIATERELEASE. BIZ domain), and since midphase seems to condone spamming - he would never had made it through my servers anyway. Also, while he is unlikely a "criminal" spammer, his "newletters", if uninvited, contain lots of questionable commercial hype. SURBL or not, my machines won't accept his email newletter. Seems consistant - if you use midphase, you just don't "get it". If he doesn't understand that he doesn't even "own" the domain, he probably can't understand any explaination either. Paul Shupak track(a)plectere.com P.S. For anyone who cares, www.openrbl.org is back up as of a few hours ago.

1 0

Help please - SA 3.0.2 and surbl
by roger-surbl-discuss＠rope.net 27 May '05

27 May '05

I am trying to use SURBL with spamassassin 3.0.2 but, even though there seems to be an otherwise unusual length of time to process a message, it is definitely not picking up the http://surbl-org-permanent-test-point.com/ or http://127.0.0.2/ test URLs that I put into a test message. I use a local caching nameserver (djbdns). I invoke spamd with "-d -m5 -s local4 -u smtpd -x" and I have restarted the daemon. My /etc/mail/spamassassin/init.pre contains this line: loadplugin Mail::SpamAssassin::Plugin::URIDNSBL My /etc/mail/spamassassin/local.cf contains the following, with explanations afterwards: ========================================================================= required_score 12 # new #fold_headers 0 allow_user_rules 0 report_safe 0 use_auto_whitelist 0 auto_whitelist_factor 0 use_dcc 0 use_pyzor 0 use_razor2 0 use_bayes 0 use_bayes_rules 0 bayes_auto_learn 0 skip_rbl_checks 0 # normally 1 check_mx_attempts 0 dns_available yes # normally no # URIDNSBL - We don't want the standard URIDNSBLs to be used ifplugin Mail::SpamAssassin::Plugin::URIDNSBL score URIBL_AB_SURBL 13 score URIBL_OB_SURBL 13 score URIBL_PH_SURBL 13 score URIBL_SBL 13 score URIBL_SC_SURBL 13 score URIBL_WS_SURBL 13 #uridnsbl URIBL_MULTI multi-surbl.org. TXT #body URIBL_MULTI eval:check_uridnsbl('URIBL_MULTI') #describe URIBL_MULTI Contains URL In MULTI Blocklist #tflags URIBL_MULTI net #score URIBL_MULTI 13 endif # Mail::SpamAssassin::Plugin::URIDNSBL ========================================================================= Explanation: I am not using any of the features in the first part of the list as you can tell by the "0". In addition, I normally do not use any of the network features, so I have explicitly turned off all of the DNSBL checks by setting the scores to "0" for each of them. All I want to do is run SURBL and do some specific filtering. I have tried the URIDNSBL stuff two different ways. First, I had set the included tests to score "0" and used my own definition, then I changed it to what you see now, to use the stock definitions. Questions: Do I have something defined incorrectly? Have I missed a definition? Anything else? Thanks for any help.

6 17

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss May 2005