Discuss March 2013

discuss@lists.surbl.org

3 participants
4 discussions

Re: [SURBL-Discuss] Heads-up: m.surbl.org
by Steve Freegard 14 Mar '13

14 Mar '13

Hi Jeff, On 14/03/13 12:36, Jeff Chan wrote: > > Thanks much Steve, > I can duplicate the results, but it's actually for m4.surbl.org and > related nameservers. We've undelegated those until they can be fixed. > > Just got another report of this: [root@mx1 ~]# host -a msft.net.multi.surbl.org m.surbl.org. Trying "msft.net.multi.surbl.org" Using domain server: Name: m.surbl.org. Address: 216.143.70.135#53 Aliases: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31832 ;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;msft.net.multi.surbl.org. IN ANY ;; ANSWER SECTION: msft.net.multi.surbl.org. 180 IN A 127.0.0.4 msft.net.multi.surbl.org. 180 IN TXT "on lists [jp], See: http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http:// http://www" Received 325 bytes from 216.143.70.135#53 in 46 ms I'm still seeing m.surbl.org in the NS list - I also note that the TTL means that it would take 24 hours for a change to be reflected anyway: [root@mx1 ~]# dig +trace multi.surbl.org ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> +trace multi.surbl.org ;; global options: printcmd . 6936 IN NS b.root-servers.net. . 6936 IN NS c.root-servers.net. . 6936 IN NS d.root-servers.net. . 6936 IN NS e.root-servers.net. . 6936 IN NS f.root-servers.net. . 6936 IN NS g.root-servers.net. . 6936 IN NS h.root-servers.net. . 6936 IN NS i.root-servers.net. . 6936 IN NS j.root-servers.net. . 6936 IN NS k.root-servers.net. . 6936 IN NS l.root-servers.net. . 6936 IN NS m.root-servers.net. . 6936 IN NS a.root-servers.net. ;; Received 332 bytes from 127.0.0.1#53(127.0.0.1) in 1 ms org. 172800 IN NS b2.org.afilias-nst.org. org. 172800 IN NS d0.org.afilias-nst.org. org. 172800 IN NS b0.org.afilias-nst.org. org. 172800 IN NS a0.org.afilias-nst.info. org. 172800 IN NS a2.org.afilias-nst.info. org. 172800 IN NS c0.org.afilias-nst.info. ;; Received 435 bytes from 192.228.79.201#53(b.root-servers.net) in 43 ms surbl.org. 86400 IN NS ns100.surbl.org. surbl.org. 86400 IN NS ns101.surbl.org. surbl.org. 86400 IN NS ns200.surbl.org. surbl.org. 86400 IN NS ns201.surbl.org. surbl.org. 86400 IN NS ns300.surbl.org. surbl.org. 86400 IN NS ns301.surbl.org. surbl.org. 86400 IN NS ns302.surbl.org. ;; Received 341 bytes from 199.249.120.1#53(b2.org.afilias-nst.org) in 23 ms multi.surbl.org. 86400 IN NS l.surbl.org. multi.surbl.org. 86400 IN NS h.surbl.org. multi.surbl.org. 86400 IN NS b.surbl.org. multi.surbl.org. 86400 IN NS c.surbl.org. multi.surbl.org. 86400 IN NS k.surbl.org. multi.surbl.org. 86400 IN NS f.surbl.org. multi.surbl.org. 86400 IN NS a.surbl.org. multi.surbl.org. 86400 IN NS i.surbl.org. multi.surbl.org. 86400 IN NS n.surbl.org. multi.surbl.org. 86400 IN NS g.surbl.org. multi.surbl.org. 86400 IN NS m.surbl.org. multi.surbl.org. 86400 IN NS j.surbl.org. multi.surbl.org. 86400 IN NS e.surbl.org. multi.surbl.org. 86400 IN NS d.surbl.org. ;; Received 481 bytes from 94.228.131.210#53(ns100.surbl.org) in 123 ms multi.surbl.org. 180 IN SOA dev.null. zone.surbl.org. 1363274558 180 180 604800 180 ;; Received 82 bytes from 211.29.132.122#53(l.surbl.org) in 190 ms I also notice the zone serial is different across some of the mirrors (not sure if this is normal or not): [root@mx1 ~]# for i in `echo a b c d e f g h i j k l m n`; do echo -en "$i.surbl.org: "; host -t SOA multi.surbl.org $i.surbl.org | tail -n1; done a.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275315 180 180 604800 180 b.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275171 180 180 604800 180 c.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275139 180 180 604800 180 d.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275315 180 180 604800 180 e.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275315 180 180 604800 180 f.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275139 180 180 604800 180 g.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275171 180 180 604800 180 h.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275171 180 180 604800 180 i.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275171 180 180 604800 180 j.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275139 180 180 604800 180 k.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275105 180 180 604800 180 l.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275139 180 180 604800 180 m.surbl.org: Host multi.surbl.org not found: 5(REFUSED) n.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. 1363275171 180 180 604800 180 Cheers, Steve.

2 2

Re: [SURBL-Discuss] Heads-up: m.surbl.org
by Steve Freegard 14 Mar '13

14 Mar '13

Jeff, After I hit send on the last message - I suddenly realised what you meant by m4.surbl.org: [root@mx1 ~]# host m.surbl.org m.surbl.org has address 64.73.0.23 m.surbl.org has address 64.73.128.55 m.surbl.org has address 188.40.23.68 m.surbl.org has address 216.143.70.135 m4 being the 4th host 216.143.70.135 and I can see it's no longer being sent: [root@mx1 ~]# host m.surbl.org ns100.surbl.org Using domain server: Name: ns100.surbl.org Address: 94.228.131.210#53 Aliases: m.surbl.org has address 188.40.23.68 m.surbl.org has address 64.73.0.23 m.surbl.org has address 64.73.128.55 But it's still in my cache due to the 1 day TTL on the record, so I've had to restart the cache to prevent the false positives. Sorry for the noise. Cheers, Steve. On 14/03/13 15:39, Steve Freegard wrote: > Hi Jeff, > > On 14/03/13 12:36, Jeff Chan wrote: >> >> Thanks much Steve, >> I can duplicate the results, but it's actually for m4.surbl.org and >> related nameservers. We've undelegated those until they can be fixed. >> >> > > Just got another report of this: > > [root@mx1 ~]# host -a msft.net.multi.surbl.org m.surbl.org. > Trying "msft.net.multi.surbl.org" > Using domain server: > Name: m.surbl.org. > Address: 216.143.70.135#53 > Aliases: > > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31832 > ;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 > > ;; QUESTION SECTION: > ;msft.net.multi.surbl.org. IN ANY > > ;; ANSWER SECTION: > msft.net.multi.surbl.org. 180 IN A 127.0.0.4 > msft.net.multi.surbl.org. 180 IN TXT "on lists [jp], See: > http:// http:// http:// http:// http:// http:// http:// http:// > http:// http:// http:// http:// http:// http:// http:// http:// > http:// http:// http:// http:// http:// http:// http:// http:// > http:// http:// http:// http:// http://www" > > Received 325 bytes from 216.143.70.135#53 in 46 ms > > I'm still seeing m.surbl.org in the NS list - I also note that the TTL > means that it would take 24 hours for a change to be reflected anyway: > > [root@mx1 ~]# dig +trace multi.surbl.org > > ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> +trace > multi.surbl.org > ;; global options: printcmd > . 6936 IN NS b.root-servers.net. > . 6936 IN NS c.root-servers.net. > . 6936 IN NS d.root-servers.net. > . 6936 IN NS e.root-servers.net. > . 6936 IN NS f.root-servers.net. > . 6936 IN NS g.root-servers.net. > . 6936 IN NS h.root-servers.net. > . 6936 IN NS i.root-servers.net. > . 6936 IN NS j.root-servers.net. > . 6936 IN NS k.root-servers.net. > . 6936 IN NS l.root-servers.net. > . 6936 IN NS m.root-servers.net. > . 6936 IN NS a.root-servers.net. > ;; Received 332 bytes from 127.0.0.1#53(127.0.0.1) in 1 ms > > org. 172800 IN NS b2.org.afilias-nst.org. > org. 172800 IN NS d0.org.afilias-nst.org. > org. 172800 IN NS b0.org.afilias-nst.org. > org. 172800 IN NS a0.org.afilias-nst.info. > org. 172800 IN NS a2.org.afilias-nst.info. > org. 172800 IN NS c0.org.afilias-nst.info. > ;; Received 435 bytes from 192.228.79.201#53(b.root-servers.net) in 43 ms > > surbl.org. 86400 IN NS ns100.surbl.org. > surbl.org. 86400 IN NS ns101.surbl.org. > surbl.org. 86400 IN NS ns200.surbl.org. > surbl.org. 86400 IN NS ns201.surbl.org. > surbl.org. 86400 IN NS ns300.surbl.org. > surbl.org. 86400 IN NS ns301.surbl.org. > surbl.org. 86400 IN NS ns302.surbl.org. > ;; Received 341 bytes from 199.249.120.1#53(b2.org.afilias-nst.org) in > 23 ms > > multi.surbl.org. 86400 IN NS l.surbl.org. > multi.surbl.org. 86400 IN NS h.surbl.org. > multi.surbl.org. 86400 IN NS b.surbl.org. > multi.surbl.org. 86400 IN NS c.surbl.org. > multi.surbl.org. 86400 IN NS k.surbl.org. > multi.surbl.org. 86400 IN NS f.surbl.org. > multi.surbl.org. 86400 IN NS a.surbl.org. > multi.surbl.org. 86400 IN NS i.surbl.org. > multi.surbl.org. 86400 IN NS n.surbl.org. > multi.surbl.org. 86400 IN NS g.surbl.org. > multi.surbl.org. 86400 IN NS m.surbl.org. > multi.surbl.org. 86400 IN NS j.surbl.org. > multi.surbl.org. 86400 IN NS e.surbl.org. > multi.surbl.org. 86400 IN NS d.surbl.org. > ;; Received 481 bytes from 94.228.131.210#53(ns100.surbl.org) in 123 ms > > multi.surbl.org. 180 IN SOA dev.null. zone.surbl.org. > 1363274558 180 180 604800 180 > ;; Received 82 bytes from 211.29.132.122#53(l.surbl.org) in 190 ms > > I also notice the zone serial is different across some of the mirrors > (not sure if this is normal or not): > > [root@mx1 ~]# for i in `echo a b c d e f g h i j k l m n`; do echo > -en "$i.surbl.org: "; host -t SOA multi.surbl.org $i.surbl.org | tail > -n1; done > a.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275315 180 180 604800 180 > b.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275171 180 180 604800 180 > c.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275139 180 180 604800 180 > d.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275315 180 180 604800 180 > e.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275315 180 180 604800 180 > f.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275139 180 180 604800 180 > g.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275171 180 180 604800 180 > h.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275171 180 180 604800 180 > i.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275171 180 180 604800 180 > j.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275139 180 180 604800 180 > k.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275105 180 180 604800 180 > l.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275139 180 180 604800 180 > m.surbl.org: Host multi.surbl.org not found: 5(REFUSED) > n.surbl.org: multi.surbl.org has SOA record dev.null. zone.surbl.org. > 1363275171 180 180 604800 180 > > Cheers, > Steve.

1 0

Heads-up: m.surbl.org
by Steve Freegard 14 Mar '13

14 Mar '13

Quick heads up for the admins here - m.surbl.org mirror appears to serving incorrect data: [root@mx1 ~]# host -t TXT com.multi.surbl.org a.surbl.org Using domain server: Name: a.surbl.org Address: 208.201.249.252#53 Aliases: Host com.multi.surbl.org not found: 3(NXDOMAIN) [root@mx1 ~]# host -t TXT com.multi.surbl.org m.surbl.org Using domain server: Name: m.surbl.org Address: 216.143.70.135#53 Aliases: com.multi.surbl.org descriptive text "Blocked, allmydomain . com on lists [jp], See: http://www.surbl.org/lists.html" com.multi.surbl.org descriptive text "Blocked, carlosmake . com on lists [ws], See: http://www.surbl.org/lists.html" com.multi.surbl.org descriptive text "on lists [ws], See: http://www.surbl.org/lists.html" Cheers, Steve.

2 1

Yahoo Single-Link spam
by Dan Mahoney, System Admin 11 Mar '13

11 Mar '13

Hey all, I'm getting a lot of single-link spam from Yahoo -- seems to be via compromised accounts, mostly (as in, via an account that my address would be in the addressbook of). It's coming through legitimately via the Yahoo servers, with DKIM signatures intact and all. As the message body is purely a link (at least, the text-plain portion is), this is an ideal job for SURBL and pretty hard for most other content matching. One such example (spaces added by me): http://dark turn ip.com/sxduvb/dgemdczfcmc/lzuc.php Yahoo seem to be absolutely braindead about spam reporting on these compromised accounts. So much so that I wrote a blog about it: http://gushi.livejournal.com/588829.html I could easily create a SpamAssassin or Procmail rule to block these messages, but I think it makes sense to make better use of this data. I often report things that get through SpamAssassin to SpamCop, which I understand feeds SURBL, but as SpamCop has to wait for me to go hit their webpage, this introduces a lag that need not be present, ergo I'm happy to feed traps directly from my system procmailrc -- where I have a couple hundred friends-and-family domains. Anyone interested? -Dan -- --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org ---------------------------

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss March 2013