Discuss

discuss@lists.surbl.org

1 participants
1864 discussions

Program comments: surblhost
by Christian Stigen Larsen 16 Aug '06

16 Aug '06

Hi, I've made a simple C commandline program to query multi.surbl.org I'd be very happy to receive comments. The program is available from http://surblhost.sourceforge.net (source only). Thanks! -- Christian Stigen Larsen, http://csl.sublevel3.org

2 3

Re: Spam in progress bit ...
by opencomputing＠gmail.com 11 Aug '06

11 Aug '06

>>The idea was that data mining in surbl logs (or other RBL / URI services >>by a large number of servers) might enhance accuracy by allowing >>accurate realtime detection of spams in progress. I might be wrong, or >>maybe it's not surbl's role to do such analysis. >> >> > >We allready do.... > > Does that mean that you use this query patterns for a particular URI to delist it, if it is never queried too often from geographically diverse IPs? Or something similar? Also, do you use the site/URI related info like its contents, how often the SSL gets changed, info like whether the site SSL pretends to be for paypal.com while signed by some russian authority or korean one etc? I assume at least the PH list uses this criteria. Using this technique for other lists also could help to find whether the URI is spammy. -- cheers, Skar.

1 0

Spam in progress bit ...
by Eric Montréal 10 Aug '06

10 Aug '06

Just an idea, I don't know if this have ever been discussed. In the course of operating the surbl lists the realtime amount of requests for each listed domain (and each not listed domain as well) and the IP of servers using surbl to do the tests is known. I don't have the data, but I suppose a spam run in progress should be easy to identify by the high number of requests for the spamvertized domain in a short period of time coming from a large number of geographically diverse mail servers. Using that data, it should be possible to add an activity bit triggered when activity for the queried domain crosses a predefined threshold (the exact recipe would need extensive tweaking). If such an activity bit is present, it should be possible to slightly lower the score for the other tests, using it as a 'score booster'. That way, the effect of a false positive, or a site generating so few tests they don't constitute a 'real' spam run would be lower, but detection score for an actively spamvertized site would increase. also, since most legitimate mailing lists are to recipients in close geographic proximity, the geographic diversity of such lists should be very different when compared to a typical spam run. Such location pattern analysis could also be used (internally) as a warning for possible false positives. One step further, a 'spammy' query pattern on an unlisted domain might signal it should be investigated/listed. Does it make sense ?

6 7

Re: Spam in progress bit ...
by opencomputing＠gmail.com 10 Aug '06

10 Aug '06

>When was the last time Microsoft got listed in surbl ? > >Smaller lists might end up being sent from a false positive domain and >the idea is that surbl test pattern >(queries/minutes, burst/continuous, historical comparisons, geolocation >and perhaps other metrics) should >allow to differentiate between such a list and a spam run. > > Spammers could add some fake URIs like yahoo.com, gmail.com, microsoft.com to their spam runs so that their mails get a hammy score(if surbl gives a negative score using some whitelisted URIs). Also, spammers could use a badly configured good intentioned mailing list like sourceforge.net or through services like yahoo.com, gmail.com etc could reduce the accuracy. Having a grey +ve score for URIs queried from MTAs with patterns matching a spam run is a nice idea though. -- Skar.

4 3

TLD "fakeouts" - in, at, it, is, to, so
by Rob McEwen (PowerView Systems) 10 Aug '06

10 Aug '06

I've noticed more and more that whenever a fully qualified domain ends in a two letter combo that is actually an english word, this create a problem because often people will start a new sentence with one of these short words and forget to put a space after the last period and before the new "sentence.Like" this! (is that example, if "like" were a TLD, then "sentence.Like" might get picked up by a spam filter for SURBL checking. The problem here is that MANY domains, for example, that end in ".to" are listed in SURBL. I don't want my solution to be merely to only check domains within e-mails which start with "http://" because this would miss many spams. But the only solution I can think of at the moment is ignore any potential domains within the message that end in these particular TLDs unless the "http://" is really there. Any suggestions? Rob McEwen PowerView Systems rob(a)PowerViewSystems.com

3 2

dns2.registerly.com listed on Spamhaus
by Joe Wein 09 Aug '06

09 Aug '06

I noticed today that the IP range for one of the default name servers for registerfly domains is now listed on SBL http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45242 This includes dns2.registerfly.com but not dns1.registerfly.com. If any of you use SBL listings of name servers for making decisions whether to blacklist suspect domains, be careful not to cause false positives! In any case I hope registerfly will get the message soon and kick off the spammers who've been registering masses of domains through them which are spammed via botnets. Joe Wein -- joewein.de LLC 6-30 Sumiyoshidai, Aoba-ku, Yokohama, 227-0035, Japan E-Mail: joewein(a)pobox.com WWW: http://www.joewein.net

4 3

RE: [SURBL-Discuss] dns2.registerly.com listed on Spamhaus
by Chris Santerre 09 Aug '06

09 Aug '06

> -----Original Message----- > From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] > Sent: Wednesday, August 09, 2006 10:43 AM > To: Jeff Chan; SURBL Discussion list > Subject: Re: [SURBL-Discuss] dns2.registerly.com listed on Spamhaus > > > Hi! > > >> http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45242 > > > >> This includes dns2.registerfly.com but not > dns1.registerfly.com. If any of > >> you use SBL listings of name servers for making decisions > whether to > >> blacklist suspect domains, be careful not to cause false positives! > > >> In any case I hope registerfly will get the message soon > and kick off the > >> spammers who've been registering masses of domains through > them which are > >> spammed via botnets. > > > I let SpamHaus know. Obviously this would cause too many FPs. > > Most likely on purpose. Registerfly should stop this crap. There is > thousands of spamdomains on their nemaeservers. If they dont > listen to > abuse reports they perhaps listen to actions like this. Its > not like this > is going on for days there, its months. I agree with Jeff and Raymond :) Too many FPs, but I think it needed to be listed somewhere to draw attention to how awful they are. Thanks for the heads up on this. --Chris

1 0

Mutogen.be does _not_ appear to be a free hosting site
by William Stearns 02 Aug '06

02 Aug '06

Good afternoon, all, Click on the "Register" link. Am I missing something, or are the spammers setting up fake free hosts now? Cheers, - Bill --------------------------------------------------------------------------- /* * Leonard, I'll tie you, draw around you a pentagram * and read this file. Aloud. */ - from kernel 2.3.40-pre6's drivers/block/DAC960.c -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

2 1

RE: [SURBL-Discuss] Rolex spam on hijacked domains
by Chris Santerre 30 Jun '06

30 Jun '06

> -----Original Message----- > From: Joe Wein [mailto:joewein@pobox.com] > Sent: Friday, June 30, 2006 10:13 AM > To: SURBL Discussion list > Subject: [SURBL-Discuss] Rolex spam on hijacked domains > > > I've seen at least two cases today of domains used in fake > Rolex etc. spams > that were untypically old. The oldest was > > Domain Name: ALLREDMETAL.COM > Registrar: ENOM, INC. > Whois Server: whois.enom.com > Referral URL: http://www.enom.com > Name Server: NS2.ALLREDMETAL.COM > Name Server: NS1.ALLREDMETAL.COM > Status: REGISTRAR-LOCK > EPP Status: clientDeleteProhibited > EPP Status: clientUpdateProhibited > EPP Status: clientTransferProhibited > Updated Date: 29-Jun-2006 > Creation Date: 03-Apr-1997 > Expiration Date: 04-Apr-2010 > Open Dir browsing: http://allredmetal.com/d1/ I'm going thru it now. Looks like they grabbed the domain or hijacked it. --Chris

2 1

Rolex spam on hijacked domains
by Joe Wein 30 Jun '06

30 Jun '06

I've seen at least two cases today of domains used in fake Rolex etc. spams that were untypically old. The oldest was Domain Name: ALLREDMETAL.COM Registrar: ENOM, INC. Whois Server: whois.enom.com Referral URL: http://www.enom.com Name Server: NS2.ALLREDMETAL.COM Name Server: NS1.ALLREDMETAL.COM Status: REGISTRAR-LOCK EPP Status: clientDeleteProhibited EPP Status: clientUpdateProhibited EPP Status: clientTransferProhibited Updated Date: 29-Jun-2006 Creation Date: 03-Apr-1997 Expiration Date: 04-Apr-2010 It is currently hosted in Russia even though it was the domain of a company in North Carolina. It was registered years ago and paid a few years in a advance. This does not look like a spammer domain at all. Here are the contact details of the owner obtained via archive.org: Allred Metal Stamping Works 1305 Thomasville Rd. High Point, NC 27260 M-F, 9 AM-5 PM EST 800.299.7421 336.886.5221 Fax: 336.841.6201 It almost looks like the domain registration was hijacked, because the domain was updated yesterday. Here is the corresponding spam: ===== Received: by mx0.webpack.hosteurope.de (theta.mc1.hosteurope.de) running EXperimental Internet Mailer (even more power) using esmtp from 86-63-112-191.asta-net.com.pl ([86.63.112.191] helo=BABY) id 1FwEsI-0004E4-U8 for MYEMAILACCOUNT; Fri, 30 Jun 2006 11:01:19 +0200 Message-Id: <00d301c69c1b$88371880$343d3681@vjyssa> From: "saunder mason" <wilmeraguilar(a)purinmail.com> To: "garald mckenna" <MYEMAILACCOUNT> Subject: Luxury Date: Fri, 30 Jun 2006 08:04:44 +0000 TOP BRANDS - LOW LOW PRICES Jewelry * Handbags * Pens * Watches * Neckties * Clutches * Wallets Leather, silk and white gold sound good? Visit our site for real photos. Everything comes with a certificate, tags and all the extras, plus a warranty. http://allredmetal.com/luxury/ salt prairie fly frame fresh-fallen corn shocker kettle net soul-imitating vacuum vessel snow hut chlorine azide sad-seeming feed store weight-lifting hermit warbler drift bottle wife-bound game bird trip catch bore meal key desk blue-glimmering gathering coal magnifying glass tone painting ten-hour blood baptism cotton plugger jack block ===== These hijacked domains all contain several folders, with mortgage spam sites, gambling sites, fake rolex sites, etc. The oldest folder on this site almost exactly matches the site renewal date. Here's another one: Domain Name: MINIEXAMINER.COM Registrar: ENOM, INC. Whois Server: whois.enom.com Referral URL: http://www.enom.com Name Server: NS2.MINIEXAMINER.COM Name Server: NS1.MINIEXAMINER.COM Status: ACTIVE EPP Status: ok Updated Date: 26-Jun-2006 Creation Date: 05-Apr-2001 Expiration Date: 05-Apr-2008 and ==== TOP BRANDS - LOW LOW PRICES Jewelry * Handbags * Pens * Watches * Neckties * Clutches * Wallets Leather, silk and white gold sound good? Visit our site for real photos. Everything comes with a certificate, tags and all the extras, plus a warranty. http://miniexaminer.com/luxury/ pig hutch integral cover fuzzy-legged para red terra orellana rub-dub rock basin lavender grass willow acacia singing master tariff treaty grid leak Nonintercourse act slow-contact single-hung gopher plum queer-tempered transmission bands cloth doubler long-stroke ginger root big bluestem Non-egyptologist plague-smitten sab-cat vice-librarian wheat thief ==== The month/day of expiration (ignoring the year) of both domains is almost the same. Both now point to the same server in Russia. And take a look at this - "domain pending transfer": ===== Registrant Contact: DICK HUSSEY ENTERPRISES NA NA (NA) NA Fax: PO BOX 500280 MALABAR, FL 32950-0280 US Administrative Contact: RegisterFly.com, inc. Domain Pending Transfer (transfers(a)registerfly.com) +1.9737362545 Fax: +1.9737361355 404 Main Street 4th Floor Boonton, NJ 07005 US Technical Contact: NA LLC Network Solutions (customerservice(a)networksolutions.com) +1.8886429675 Fax: +1.5714344620 13200 Woodland Park Drive Herndon, CO 20171-3025 US ===== Anybody else noticed anything like this? Joe Wein

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss