Discuss

discuss@lists.surbl.org

1870 discussions

Please test MailPolice Fraud list
by Jeff Chan 12 Nov '04

12 Nov '04

Please test the MailPolice Fraud list as Bill described earlier (copied below). We would like to include this data in our PH anti-phishing list, but request your help in testing it first. We're particularly interested in any false positives. Jeff C. __ This is a list that MailPolice hosts and I have been running it for a few hours and it has already flagged some phish and fraud e-mails. Here is some info about the list: http://rhs.mailpolice.com/#rhsfraud This is my configuration for SA 2.64 with the SpamCopURI plug-in: uri MP_URI_RBL eval:check_spamcop_uri_rbl('fraud.rhs.mailpolice.com','127.0.0.2') describe MP_URI_RBL URI's domain appears in MailPolice fraud list tflags MP_URI_RBL net score MP_URI_RBL 2.0 And for SA 3.0 with the URIDNSBL plug-in: urirhsbl URIBL_MP fraud.rhs.mailpolice.com. A header URIBL_MP eval:check_uridnsbl('URIBL_MP') describe URIBL_MP URI's domain appears in MailPolice fraud list tflags URIBL_MP net score URIBL_MP 2.0 Bill

5 16

Re: [SURBL-Discuss] Please test MailPolice Fraud list
by Jeff Chan 12 Nov '04

12 Nov '04

On Thursday, November 11, 2004, 7:03:44 PM, Chris wrote: > On Thursday 11 November 2004 07:41 pm, Jeff Chan wrote: >> urirhsbl URIBL_MP fraud.rhs.mailpolice.com. A >> body URIBL_MP eval:check_uridnsbl('URIBL_MP') >> describe URIBL_MP URI's domain appears in MailPolice fraud list >> tflags URIBL_MP net >> score URIBL_MP 2.0 >> >> Jeff C. > Uh, maybe I should have clarified also :( do I just paste the above into my > local.cf? Yes, but be sure to put your local.cf in /etc/mail/spamassassin and not /usr/share/spamassassin. The former directory is for custom rules. The latter directory is for default rules that come with SA and can get overwritten when versions are updated. Jeff C. -- "If it appears in hams, then don't list it."

1 0

Probable new data source: DNS queries hitting spamhaus lists
by Jeff Chan 10 Nov '04

10 Nov '04

At Daniel Quinlan's suggestion, we've started to check a sampling of SURBL name server queries against sbl and xbl.spamhaus.org. His interest is as a potential replacement for the very time consuming NS record lookups done with uridnsbl. We haven't turned these into a SURBL yet, but probably will eventually. So far this has resulted in about 11k SBL domains with about 60% overlap with existing SURBLs. The fun thing is that this catches at a very early stage spams from scumbags like "Media Dreamland" that has been spamming free computer monitors, etc. lately. Some of these type of operations that reuse the same name server IPs, but register and change domains frequently are caught this way, just like uridnsbl does, but with perhaps a few missed due to sampling effects on the DNS queries. This method also features a much lower global DNS overhead since the lookups are done once in a centralized way, and not repeatedly in a gazillion SpamAssassin installations on the same domains in a very distributed and redundant way. The way this works is that we sample DNS queries from SURBL lookups and compare new wild domains (i.e. domains found in general email URIs), against xbl and sbl and build up lists of the matches. (To be more correct, it's the wild domain name server "NS" record resolved ip addresses which are checked against sbl and xbl.) Along with this will need to be expiration runs, which I haven't built yet. (In other words, domains should come off the lists when they no longer resolve or no longer resolve to name servers in sbl or xbl.) The main downside is that domains matching name servers listed in sbl or xbl definitely has more false positives than our other SURBL lists. We'll want to do some testing, but it may be as high as 1%, so they'd need to be used carefully. Some perhaps other interesting stats after about two weeks: unique queries logged so far about 250k (These are reduced to base domains where easy) SBL matches so far about 11k XBL matches so far about 400 SBL are checked for NS records only XBL are checked for NS, www, base domain against XBL (but not MX) Questions? Comments? Suggestions? Jeff C. -- "If it appears in hams, then don't list it."

3 4

False Posititive?
by Matt 09 Nov '04

09 Nov '04

I'm getting mail tagged with this URI: 5.0 WS_URI_RBL URI's domain appears in sa-blacklist at http://www.surbl.org/lists.html [www.allhiphop.com is blacklisted in URI RBL at] [ws.surbl.org] The site looks fairly legit to me, and it is being included in a legit newsletter. Any comments on this?

3 2

Webbi`s kleiner Datentoaster?
by Jeff Chan 09 Nov '04

09 Nov '04

Does anyone know: Webbi`s kleiner Datentoaster or why they are trying to zone transfer surbl.org from the following addresses? 83.129.251.245 83.129.247.209 83.129.221.175 83.129.211.136 There is some evidence they maybe crackers. Does anyone know anything about them? These appear to be dynamic tiscali.de DSL addresses. Jeff C.

2 2

RE: [SURBL-Discuss] LT02.NET
by Chris Santerre 09 Nov '04

09 Nov '04

So what was the outcome? That's right, I'm back! For 2 days anyway. I'm much happier and poorer from my vacation! But I did manage to pickup a BFG 6800 OC video card while I was away ;) WOOOT!!! Fragfest! (Yes I did OC the OC a bit more!) --Chris (I firmly believe if Disney shaped dog poo into the Mickey shape, My wife would want to buy it!) >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, October 28, 2004 8:07 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] LT02.NET > > >On Thursday, October 28, 2004, 1:41:43 PM, Fred Fred wrote: >> Can someone tell me why LT02.NET is whitelisted? (don't >tell me cause it's >> in ham) I would like an example if possible. > >> They use open relays to send their spam, the have 8 nanas >hits, the domain >> is fairly new like 2004-08-06 > >> Hand checked, it does not look like a legit site. (main >page is just a >> remove form.) > >> I played around and found that if you visit: >> http://t.lt02.net/c.asp? >> it will redirect you to www.listrak.com which is also >whitelisted (listrak >> has 31 nanas hits). > >> Their mx record is an open relay, I think this is a very >questionable domain >> to whitelist. > >> http://ordb.org/lookup/?host=66.109.239.150 > >First, we're not an open relay database. Our concern is spam URI >domains. > >Second, lt02.net was whitelisted by Steve Champeon, whose >anti-spam abilities I trust. Steve, would you care to comment >on this one? > >> steve of hesketh.com >> Has whitelisted: lt02.net >> >> Found on SURBL lists: WS OB >> >> Justification is: >> >> 'Found in possibly legit PRNewswire mailing.' >> >> Ticket is: >> >> Timestamp: Tue Sep 14 17:50:25 UTC 2004 > >Regarding listrak.com, I whitelisted it, probably because it >appeared in newsletters from legitimate companies. > >I'm interested in seeing examples of spam and ham mentioning >these domains. > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

Re: [SURBL-Discuss] Possible fps
by Jeff Chan 08 Nov '04

08 Nov '04

On Sunday, November 7, 2004, 8:54:28 AM, Tastings Journal wrote: > I run www.TastingsJournal.com and saw your letter on the internet. Our > messages do go out to a large base of people that have been members @ > PartySlave.com or PartyPolice.com > I send out just HTML text only messages and then direct people to the site. > Even though they have subscribed I still put an unsubscribe link in each > mail. I am not sure if this message means since I am not that familiar > with FP's or SURBL (black lists?) > Etc etc. If I am listed, I would like to know what measures I can take with > you to have the stigma taken off the Domain. > Thanks > James James, Please add confirmations to your subscriptions. Otherwise anyone can subscribe john(a)johnkerry.com, for example. Looks like this domain is on the Outblaze list. Outblaze, Please consider removing this domain. It has no NANAS, is not on RBLs, appears to have legitimate uses. Jeff C. -- "If it appears in hams, then don't list it."

1 0

C version of SURBL client?
by Andrew 07 Nov '04

07 Nov '04

Hi All, Does anyone know if there is an open-source client written in c to perform URL searches in message bodies, and then lookups against a SURBL ? (This is not for use with SA) Cheers, Andrew

4 7

Another program that uses SURBL
by Bret Miller 06 Nov '04

06 Nov '04

Just ran across this today. Doug's content filter for Merak, Exchange and Communigate Pro now supports SURBL too. http://www.2150.com/regexfilter/ Bret ---------- Send your spam to: bretmiller(a)wcg.org <mailto:bretmiller@wcg.org> Thanks for keeping the internet spam-free!

2 1

Virginia Law is used for first time for felony SPAM convictions
by Kevin A. McGrail 05 Nov '04

05 Nov '04

Pre-Face: We run the public nameserver d3.surbl.org and it is located in Virginia as is our company. I wonder whether things like surbl (I can definitely see Razor) could be extrapolated to increase the venue of this type of law? At the very worst, I think this is a definite "spammer beware". Anyway, after staying up till the wee hours after the election, I missed this news article about 2 spammers being convicted of 3 felony's each in Virginia this week. One sentenced to 9 years in jail, one got $7500 fine. However, one particularly interesting note. This case only accounted for SPAM sent for less than a month and 3 days of email over 10K each day were the reason for the 3 felony convictions. Important to note, these were extraditions from North Carolina where they SPAMmed users at AOL. It looks like using or sending to Virginia-based servers will be enough for felony convictions. Regards, KAM Some sparse info here: http://www.washingtonpost.com/wp-dyn/articles/A23622-2004Nov3.html More sentencing info here: http://www.computerweekly.com/articles/article.asp?liArticleID=134815&liArt…

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss