Discuss

discuss@lists.surbl.org

1 participants
1864 discussions

{Spam?} RE: [SURBL-Discuss] RE: Pesky Pron Spam
by Rob McEwen 11 Aug '04

11 Aug '04

Raymond said: >>But obviously is doesn't work.... The ones you >>mentioned are listed in 3 SURBL lists... you >>should be able to catch them up pretty easily. Yes, I am able to catch these easily now! Whenever I try to RESEND this through my filter, YES YES YES, they ARE easily caught by my SURBL filtering. My SURBL filter is working GREAT and the fact that these are NOW caught by SURBL is completely irrelevant to my original question. The problem is that this particular spammer is very, very proliferate and I keep getting the razer's edge of his first new spams using new domains that are not yet blocked by SURBL. These particular spams are also very sneaky about not allowing "pron keywords" into the body of the message. The fact that they are blocked by SURBL soon afterwards is besides the point. I'm simply looking for any suggestions or pointers for rules-based filtering which might catch this particular "series" of spam. Rob McEwen

1 0

RE: [SURBL-Discuss] RE: Pesky Pron Spam
by Rob McEwen 11 Aug '04

11 Aug '04

(I sent this again because I discovered that my original message when only to Raymond and not to the list) Raymond, Recall that I mentioned that I'm NOT a SpamAssassin user. Also, I am currently NOT using any Bayesian filtering... (although I do have plans to eventually add this as an additional layer of filtering). (Before you laugh, I would say that the filtering that I do use is very comparable to SpamAssassin when looking at what how effective it is against those e-mails which make it past SURBL and RBL.) Nevertheless, I can't answer your two questions because they are not applicable. Thanks for trying to help! :) Any other thoughts/suggestions? Rob McEwen PowerView Systems rob(a)PowerViewSystems.com (478) 475-9032 -----Original Message----- From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] Sent: Wednesday, August 11, 2004 9:08 AM To: rob(a)pvsys.com; SURBL Discussion list Subject: Re: [SURBL-Discuss] RE: Pesky Pron Spam Importance: High Hi! > I have noticed some patterns in the e-mails. For example, they all > have three images stacked vertically. Therefore, I think that I should > be able to catch these with the right formulation of rules within my > linguistic filter. > > You can find the raw contents of my most recent two of these as > follows: > > http://www.pvsys.com/pn01.txt > > http://www.pvsys.com/pn02.txt What are the SA scores you got on these? Might tell much more. Could be your bayesian filters are doing this. Bye, Raymond.

2 1

RE: [SURBL-Discuss] RE: Pesky Pron Spam
by Raymond Dijkxhoorn 11 Aug '04

11 Aug '04

Hi! > Recall that I mentioned that I'm NOT a SpamAssassin user. Also, I am > currently NOT using any Bayesian filtering... (although I do have plans to > eventually add this as an additional layer of filtering). Ok, i overlooked that i think. :) > (Before you laugh, I would say that the filtering that I do use is very > comparable to SpamAssassin when looking at what how effective it is against > those e-mails which make it past SURBL and RBL.) But obviously is doesnt work. I have a lot of those, with different txt, but the same URLs. The ones you mentioned are listed in 3 SURBL lists, do you should be able to catch them up pretty easilly. > > http://www.pvsys.com/pn01.txt > > http://www.pvsys.com/pn02.txt We only provide the lists, i guess you have to look on the 'thing' you are using whats going wrong. ;) Bye, Raymond.

1 0

RE: [SURBL-Discuss] mimedefang + spamcopuri = "timeout before dataread" in syslog
by Jason M. Burnett 11 Aug '04

11 Aug '04

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > > > My hunch is that it could be intermittent DNS timeouts. > > We're trying to get all the public name servers switched > over to rbldnsd, since it's much faster than BIND. That > may help. > > Can someone look through the sources and see how this > message comes up: "timeout before data read" ? I *think* it happens when a scanner run by Mimedefang (spamassassin, in this case) takes too long to return. I get the impression from the man page that this timeout is ten seconds, but I'm not sure. Anyone confirm? I took a shot at bumping that to 30, so I'll know in a couple days if that fixed it. -- Jason This email and any attachments thereto may contain private, confidential, and privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.

1 0

[SURBL-Discuss] mimedefang + spamcopuri = "timeout before data read" in syslog
by Jason M. Burnett 11 Aug '04

11 Aug '04

Every time that happens (it's not every email, but 100 to 300 a day out of a total of 10,000), the email goes on to be delivered without being tagged by spamassassin. I wasn't getting that message in syslog at all before setting up spamcopuri. Is there a known fix to this weirdness? -- Jason This email and any attachments thereto may contain private, confidential, and privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.

2 1

bravejournal.com FP on OB.
by Patrik Nilsson 10 Aug '04

10 Aug '04

bravejournal.com is listed on OB. One single NANAS report that mention bravejournal.com found when searching Google Groups. 399 non-NANAS postings that mention bravejournal.com found when searching Google Groups... bravejournal.com is blogging/journaling community run by bravenet.com which claims millions of members. bravenet.com mail servers send out a newsletter with a monthly senderbase magnitued of 5.4. Those servers are not listed on any major RBL. Patrik

2 1

Questionable listing?
by Bill Landry 10 Aug '04

10 Aug '04

Found this URI listed in a lockergnome list mail: www.desktoppipeline.com and it was tagged by OB. However, it seems like a legit TechWeb site that provides newsletter services. Bill

2 1

RFC: Lowering TTLs
by Jeff Chan 10 Aug '04

10 Aug '04

We would like to drop the TTL on the SURBL zone files that had 6 and 8 hour TTLs down to 1 hour in order to get new entries active sooner. We have not tested this to see what effect it would have on name server traffic. Does anyone have any comments or concerns about this? One hour would still be longer than the default 35 minute TTL that rbldnsd uses. (We would still like to separately experiment with range of different TTLs to see where lowering them causes traffic to increase a lot. We would then pick values longer than that. That optimization can probably be done independently.) Comments? Jeff C.

1 0

SA 2.64 and SURBL issues...
by Robert Leonard 10 Aug '04

10 Aug '04

Since upgrading my spamcopuri to version .22 I haven't seen any spam's getting tagged by it.. SA 2.63 lints fine... But when I try to 'upgrade' to 2.64 I get the following, which makes me think something isn't right, either with SA or with spamcopuri.. -------Here is what I get.. And I get it many times... Syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule WS_URI_RBL, line 6, near ") )") t/rule_tests.....ok 44/62Failed to com;ile URI SpamAssassin tests, skipping:(syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule OB_URI_RBL, line 1, near "eval:" -------------- and so on.. Any idea what might be causing this? I've tried re-install spamcopuri and restarting SA.. I still see nothing getting caught by the URI tests.. And everytime I try to install/upgrade SA 2.64 I get the above errros during the installation... Thanks!!!!!!1 -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Monday, August 09, 2004 1:42 PM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] your-tradetool dot com On Monday, August 9, 2004, 1:16:47 PM, Lindsay Snider wrote: > Looking into it further, I found this link on google > http://216.239.39.104/search?q=cache:EzOFwrN5SrYJ:www.wholesale411.com > /bbs/search.php%3Fsearch_author%3DFeye+your-tradetool&hl=en > The domains listed have the same bogus yahoo information. Unless I > hear otherwise, I'll blacklist them in ws for now. Multiple domains with the same fake yahoo or hotmail address or frequently occurring fake postal address can be a good indicator of fraudsters/spammers. However the best evidence of spamming is a spam. Has anyone gotten one with these domains? Jeff C. > On Monday 09 August 2004 03:57 pm, Lindsay Snider wrote: >> We received what looks to be a phishing scam involving your-tradetool >> dot com. Their site is newly registered and various things don't match up. >> Although their domain is so new, they claim to have been in business >> since 1997-2004. The whois records show what looks to be fake yahoo information. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

your-tradetool dot com
by Lindsay Snider 09 Aug '04

09 Aug '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We received what looks to be a phishing scam involving your-tradetool dot com. Their site is newly registered and various things don't match up. Although their domain is so new, they claim to have been in business since 1997-2004. The whois records show what looks to be fake yahoo information. Any thoughts on this one? - -lindsay -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBF9cVNWvCHVPDSuERAoKYAJ0aFIsHGLWKYQ02SR9NTLrUVlvuXQCeIblr Ls/mca02E28MOIoU6ew5HLI= =eUJ7 -----END PGP SIGNATURE-----

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss