Discuss

discuss@lists.surbl.org

1 participants
1864 discussions

domain "w" listed, causing problems
by John DeMillion 24 Jan '06

24 Jan '06

Not sure when this happened, but a plain "w" somehow got listed in the SURBL, at least in the text list version. I've perused the website and the list removal section, but haven't found a way of determining what the source of the "w" is, since the query tools do domain format checking and won't let me query on a plain "w". The "w" shows up in this list: http://www.surbl.org/dns-queries.blocklist.counts.txt It's in the section preceeded by the number "2". The effect of this is that domains that have a "w" in certain places generate false positives. It might be a good idea to run new domains through a simple domain format parsing check to make sure that they're basically valid before adding them to the SURBL. John DeMillion Director of Information Technology Chester County Intermediate Unit

4 3

Fw: [sniffer] Watch out... SURBL & SORBS full of large ISPs and Antispam providres.
by Darrell (support＠invariantsystems.com) 21 Jan '06

21 Jan '06

Jeff/others, Did some issue occur to cause the domains listed below to be populated in SURBL? Darrell ------------------------------------------------------------------------ Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. ----- Original Message ----- From: "Pete McNeil" <madscientist(a)microneil.com> To: <sniffer(a)sortmonster.com> Sent: Tuesday, January 17, 2006 4:27 AM Subject: [sniffer] Watch out... SURBL & SORBS full of large ISPs and Antispam providres. > Hello Sniffer Folks, > > Watch out for false positives. This morning along with the current > spam storm we discovered that SURBL and SORBs are listing a large > number of ISP domains and anti-spam service/software providers. > > As a result, many of these were tagged by our bots due to spam > arriving at our system with those domains and IPs. Most IPs and > domains for these services are coded with "nokens" in our system to > prevent this kind of thing, but a few slipped through. > > We are aggressively hunting any more that might have arrived. > > You may want to temporarily reduce the weight of the experimental IP > and experimental ad-hoc rule groups until we have identified and > removed the bad rules we don't know about yet. > > Please also do your best to report any false positives that you do > identify so that we can remove any bad rules. I don't expect that > there will be too many, but I do want to clear them out quickly if > they are there. > > Please also, if you haven't already, review the false positive > procedures: > http://www.sortmonster.com/MessageSniffer/Help/FalsePositivesHelp.html > > Pay special attention to the rule-panic procedure and feature in > case you are one of the services hit by these bad entries. > > An example of some that we've found in SURBL for example are > declude.com, usinternet.com, and w3.org > > It's not clear yet how large the problem is, but I'm sure it will be > resolved soon. > > Hope this helps, > > Thanks, > _M > > Pete McNeil (Madscientist) > President, MicroNeil Research Corporation > Chief SortMonster (www.sortmonster.com) > Chief Scientist (www.armresearch.com) > > > This E-Mail came from the Message Sniffer mailing list. For information > and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html >

11 13

Subscription questions
by martin.dibble＠altohiway.com 16 Jan '06

16 Jan '06

Hi All, Just wondering if anyone has details about subscription times to surbl. We completed the forms back mid december and got redirected to a page which confirmed the subscription request had been passed through but it may take a couple of weeks to approve. As yet I havn't heard anything since so just wondering what the normal time scales are or if there are any contact addresses I can try and contact at least to confirm the request has been received? thanks in advance, -Martin Dibble Internal Network Engineer altoHiway Ltd The content of this email and any attachments is confidential,and is intended only for the addressees. If you are not the intended recipient you may not use, distribute, disclose or copy the contents. If you have been sent this email in error please forward it to notify(a)altohiway.com and destroy the original. Any opinions expressed within this email are those of the sender and do not necessarily represent the opinion of altoHiway Ltd. Any prices quoted in this email and any attachments are subject to VAT, valid for 30 days and subject to altohiways standard Terms and Conditions of business. E and OE. This email has been checked for virus content by the altoHiway Mailcontroller service. However, it is the responsibility of the recipient to ensure that the contents of this email are virus free. altoHiway Ltd. accept no liability for any loss or damage arising from the contents of this email.

1 0

RE: Google search as spam URI
by Chris Santerre 10 Jan '06

10 Jan '06

> -----Original Message----- > From: Dhawal Doshy [mailto:dhawal@netmagicsolutions.com] > Sent: Wednesday, January 04, 2006 3:01 PM > To: Dallas L. Engelken > Cc: Jeff Chan; SpamAssassin Users; SURBL Discuss > Subject: Re: Google search as spam URI > > > Dallas L. Engelken writes: > > > adding a redirector_pattern will catch this. > > > > redirector_pattern > > > /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9 > \-\.]+)$/I > > better write a rule for google translate as well.. i see it > being abused > soon. > > http://translate.google.com/translate?u=www.domain.tld&langpai r=en%7Cen&hl=e n Hah! Am I reading that right? Translate English to English! I give them 1 point for coming up with that one. --Chris

2 1

RE: Google search as spam URI
by Dallas L. Engelken 04 Jan '06

04 Jan '06

adding a redirector_pattern will catch this. redirector_pattern /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9\-\.]+)$/I dbg: uri: parsed uri found, http://www.google.com/search?q=site:bluevallet.com dbg: uri: cleaned parsed uri, http://bluevallet.com dbg: uri: cleaned parsed uri, http://www.google.com/search?q=site:bluevallet.com dbg: uri: cleaned parsed uri, bluevallet.com dbg: uri: parsed domain, google.com dbg: uri: parsed domain, bluevallet.com dbg: uridnsbl: domain google.com in skip list dbg: uridnsbl: domains to query: bluevallet.com dbg: uri: running uri tests; score so far=-0.001 dbg: rules: ran uri rule __LOCAL_PP_NONPPURL ======> got hit: "http://bluevallet.com" dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: domain "bluevallet.com" listed (URIBL_BLACK): 127.0.0.2 dbg: uridnsbl: query for bluevallet.com took 1 seconds to look up (multi.uribl.com.:bluevallet.com) dbg: uridnsbl: queries completed: 1 started: 0 dbg: uridnsbl: queries active: DNSBL=1 NS=1 at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: domain "bluevallet.com" listed (URIBL_SC_SURBL): 127.0.0.2 dbg: uridnsbl: query for bluevallet.com took 1 seconds to look up (multi.surbl.org.:bluevallet.com) dbg: uridnsbl: queries completed: 1 started: 0 dbg: uridnsbl: queries active: NS=1 at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: waiting 2 seconds for URIDNSBL lookups to complete dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: queries completed: 1 started: 2 dbg: uridnsbl: queries active: at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: queries completed: 1 started: 1 dbg: uridnsbl: queries active: A=1 at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: queries completed: 1 started: 1 dbg: uridnsbl: queries active: DNSBL=1 at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: domain "bluevallet.com" listed (URIBL_SBL): "http://www.spamhaus.org/SBL/sbl.lasso?query=SBL36468" dbg: uridnsbl: domain "bluevallet.com" listed (URIBL_SBL): "http://www.spamhaus.org/SBL/sbl.lasso?query=SBL36335" dbg: uridnsbl: query for bluevallet.com took 1 seconds to look up (sbl.spamhaus.org.:17.160.20.58) dbg: uridnsbl: queries completed: 1 started: 0 dbg: uridnsbl: queries active: DNSBL=1 at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: domain "bluevallet.com" listed (URIBL_SBL): "http://www.spamhaus.org/SBL/sbl.lasso?query=SBL36470" dbg: uridnsbl: query for bluevallet.com took 1 seconds to look up (sbl.spamhaus.org.:7.134.11.221) dbg: uridnsbl: queries completed: 1 started: 0 dbg: uridnsbl: queries active: at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: done waiting for URIDNSBL lookups to complete dbg: uri: running uri tests; score so far=9.972 dbg: uri: running uri tests; score so far=7.11254545454546 Thanks, Dallas > -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Wednesday, January 04, 2006 3:56 AM > To: SpamAssassin Users; SURBL Discuss > Subject: Google search as spam URI > > This drug spam message body seems problematic, since the URI is > google, being used to search for the spammer's. Naturally the > actual spammer domain bluevallet.com is blacklisted. This > showed up Tue, 03 Jan 2006 14:45:48 +0100 > > __ > > > Proecia > Xana > Pail > VALIM from $1.21 > IAGRA from $3.33 > IALIS from $3.75 > eridia > Abien > Soa > Levtra > =20 > http://www.google.com/search?q=3Dsite:bluevallet.com > <http://www.google.com/search?q=3Dsite:bluevallet.com>=20 > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 > Transitional//EN"> <HTML><HEAD> <META > http-equiv=3DContent-Type content=3D"text/html; = > charset=3Dus-ascii"> <META content=3D"MSHTML 6.00.2800.1106" > name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY > bgColor=3D#ffffff> <DIV><FONT face=3DArial size=3D3>Pro<IMG = > src=3D"cid:000101c6106b$c54633bd$66c5a8c0@printingmachine">eci a</FONT></DIV> > <DIV><FONT face=3DArial size=3D3>Xana<IMG = > src=3D"cid:000201c6106b$c54633bd$66c5a8c0@printingmachine"></F ONT></DIV> > <DIV><FONT face=3DArial size=3D3>Pa<IMG = > src=3D"cid:000201c6106b$c54633bd$66c5a8c0@printingmachine">il< /FONT></DIV> > <DIV><FONT face=3DArial size=3D3>VALI<IMG = > src=3D"cid:000301c6106b$c54633bd$66c5a8c0@printingmachine">M > <STRONG>from = $1.21</STRONG></FONT></DIV> <DIV><FONT > face=3DArial size=3D3><IMG = > src=3D"cid:000401c6106b$c54633bd$66c5a8c0@printingmachine">IAG RA <STRONG>from = $3.33</STRONG></FONT></DIV> <DIV><FONT face=> 3DArial size=3D3><IMG = > src=3D"cid:000501c6106b$c54633bd$66c5a8c0@printingmachine">IAL IS <STRONG>from = $3.75</STRONG></FONT></DIV> <DIV><FONT face=> 3DArial size=3D3><IMG = > src=3D"cid:000601c6106b$c54633bd$66c5a8c0@printingmachine">eri dia</FONT></DIV> > <DIV><FONT face=3DArial size=3D3>A<IMG = > src=3D"cid:000701c6106b$c54633bd$66c5a8c0@printingmachine">bie n</FONT></DIV> > <DIV><FONT face=3DArial size=3D3>So<IMG = > src=3D"cid:000701c6106b$c54633bd$66c5a8c0@printingmachine">a</ FONT></DIV> > <DIV><FONT face=3DArial size=3D3>Lev<IMG = > src=3D"cid:000801c6106b$c54633bd$66c5a8c0@printingmachine">tra </FONT></DIV> > <DIV><FONT face=3DArial size=3D3></FONT> </DIV> > <DIV><FONT face=3DArial size=3D3><A = > href=3D"http://www.google.com/search?q=3Dsite:bluevallet.com"> <FONT = face=3DArial = size=3D3>http://www.google.com/search?q=> 3Dsite:bluevallet.com</FONT></A><= > /FONT></DIV></BODY></HTML> > R0lGODdhDQAMAOMAAP///wUTCMDEwWJrZCQwJt/h4KGmooKJg0NORQAAAAAAAA > AAAAAAAAAAAAAA > AAAAACwAAAAADQAMAAAEMRBIMUggo8htiNFFp0kFMW4Hsg3HtoWb6c5SQNP27c > q6xN6GF4/TQnlA > KZoAEbgUJREAOw== > R0lGODdhDgAZAOMAAP///wUCDkNBSqGgpN/f4CQhLIKAhmJgaMC/wgAAAAAAAA > AAAAAAAAAAAAAA > AAAAACwAAAAADgAZAAAESxDISau9OOvNu/9gKHLCcA3CFAhERRSBOhiVYcRSXF > QFgQOxg0kyOABV > AERKIkAcc5Jecvd8GowHWhX36kK/gIPACP4hAs4yhfyNAAA7 > R0lGODdhDQAXAMIAAP///wANER8rLt/g4V9nar/Cw5+kpQAAACwAAAAADQAXAA ADMgi63P4wykmr > vRiGt1dvHxB6zKiEplhyq4Oyi+AM8kIUjUEwtDEAA4PgxyMIAgICUZEAADs= > R0lGODdhDAAVAOMAAP///wgOEMHCwyYsLYOGh2RoaeDg4aKkpUVKSwAAAAAAAA > AAAAAAAAAAAAAA > AAAAACwAAAAADAAVAAAENhDISau9OOvNu5/CcA2CRFbhRBRVQUyGSAUGVRzTga > C7hJSVQS12IbyM > F6IQg9BlDgNcRkaJAAA7 > R0lGODdhBQANAIAAAP///w0KDywAAAAABQANAAACDIQfp2uJ6hqcr0pTAAA7 > R0lGODdhDgANAMIAAP///xIJC6aioy8nKcPBwk1GSOHg4IiEhSwAAAAADgANAA > ADJwi63P4wShXE > CIPYUFcoBnB8oRB4hBdSHnO2LBwD70zLt1zn8+4rCQA7 > R0lGODdhCgAVAOMAAP///xMPD6alpTAtLcTDw2tpaeHh4YmHh05LSwAAAAAAAA > AAAAAAAAAAAAAA > AAAAACwAAAAACgAVAAAELRDISau9OOvNu/9AIAzBQFCBCBDmpEpC4RqTMbhVMN > e39AIxV4tF8x1I > iCIgAgA7 > R0lGODdhCQAVAMIAAP///wQKA2JlYaCjoN/g3yMoIgAAAAAAACwAAAAACQAVAA > ADJQi63P4wykmr > XWKsIRQpBPCFCgdkjaA6REAyaseYqAeK96mVcgIAOw== > > __ > > SpamAssassin 3.0.1 did not catch this one, though the sender > IP was on the SpamCop BL (that was all it caught). > > Jeff C. > -- > Don't harm innocent bystanders. > >

3 2

RE: Google search as spam URI
by Matthew.van.Eerde＠hbinc.com 04 Jan '06

04 Jan '06

Dallas L. Engelken wrote: >> From: Dallas L. Engelken [mailto:dallase@nmgi.com] >> >> /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9 >> \-\.]+)$/I >> > > Notice the 'I' at the end should be 'i'. > Damn outlook, Agreed. > I know what I want to say! Have you configured Outlook to use Word as the email editor? If so that might explain the AutoCorrect you are experiencing. -- Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer

2 1

RE: Google search as spam URI
by Dallas L. Engelken 04 Jan '06

04 Jan '06

> -----Original Message----- > From: Martin Hepworth [mailto:martinh@solid-state-logic.com] > Sent: Wednesday, January 04, 2006 10:36 AM > To: Dallas L. Engelken; 'Jeff Chan'; 'SpamAssassin Users'; > 'SURBL Discuss' > Subject: RE: Google search as spam URI > > Dallas > > Small change required for my to lint cleanly... > > redirector_pattern > /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9 > \-\.]+)$/i > > (lower case letter I at the end, not uppercase/capitol I) > Arghhhh.. Did you miss this? >> Notice the 'I' at the end should be 'i'. Damn outlook, I know what I want to say! >> D Or am I the one that's missing something?? D

1 0

RE: Google search as spam URI
by Dallas L. Engelken 04 Jan '06

04 Jan '06

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Wednesday, January 04, 2006 3:56 AM > To: SpamAssassin Users; SURBL Discuss > Subject: Google search as spam URI > > This drug spam message body seems problematic, since the URI is > google, being used to search for the spammer's. Naturally the > actual spammer domain bluevallet.com is blacklisted. This > showed up Tue, 03 Jan 2006 14:45:48 +0100 > > __ Also FWIW, we auto-listed bluevallet.com on black.uribl.com at bluevallet.com Listed: 2006-01-03 06:38:02 CDT (-0500 UTC) What I'm wondering is "how", since this shouldn't be showing up in the dns query stream if people were not using the google redirector pattern.... D

2 1

RE: Google search as spam URI
by Chris Santerre 04 Jan '06

04 Jan '06

> -----Original Message----- > From: Dallas L. Engelken [mailto:dallase@nmgi.com] > Sent: Wednesday, January 04, 2006 9:30 AM > To: Jeff Chan; SpamAssassin Users; SURBL Discuss > Subject: RE: Google search as spam URI > > > adding a redirector_pattern will catch this. > > redirector_pattern > /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9 > \-\.]+)$/I > > > Thanks, > Dallas Should this be a standard redirect added to SA or should SARE add the a rule to 70_Specific.cf? Also I don't know how it got added to URIBL, as the only NANAS hits show them using this redir. --Chris

1 0

RE: Google search as spam URI
by Dallas L. Engelken 04 Jan '06

04 Jan '06

> -----Original Message----- > From: Dallas L. Engelken [mailto:dallase@nmgi.com] > Sent: Wednesday, January 04, 2006 8:30 AM > To: Jeff Chan; SpamAssassin Users; SURBL Discuss > Subject: RE: Google search as spam URI > > adding a redirector_pattern will catch this. > > redirector_pattern > /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9 > \-\.]+)$/I > Notice the 'I' at the end should be 'i'. Damn outlook, I know what I want to say! D

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss