Discuss

discuss@lists.surbl.org

1862 discussions

whitelist senderbase top domains?
by Jeff Chan 15 Sep '04

15 Sep '04

Looks like senderbase.org has a database of the domains and IPs used to send the most mail. Normally that would not be too interesting to us since we care about message body URIs, i.e. content, and not senders or their ISP addresses, but I'm thinking about whitelisting all the legitimate NSPs, ISPs and telcos in their top domains list: http://www.senderbase.org/search?page=domains we would exclude the few that appear to be spammers according to spamhaus: imgmailer.com TAM Network stocksntalk.com iMedia Networks Inc. havagreatday.com But I'd like to whitelist all the rest which are obviously large ISPs, etc. In essence we're just using it as a list of some of the top ISPs in the world. Does anyone have any comments on this? Note that this won't have a major effect on bad guys since spammers would not have much incentive to advertise their ISPs, and we don't "whiten" spams for mentioning non-spam domains anyway. It also does not mean that we're whitelisting the ISP address space, senders, or anything like that, just mail that mentions these large ISP URIs. Jeff C.

6 24

Re: [SURBL-Discuss] important reduce wrise renkles & skin spots ( fwd)
by Jeff Chan 15 Sep '04

15 Sep '04

On Wednesday, September 15, 2004, 5:36:51 AM, Anti-Spam Anti-Spam wrote: > From: "Jeff Chan" <jeffc(a)surbl.org> >> On Wednesday, September 15, 2004, 12:46:00 AM, Alex Broens wrote: >> > Jeff Chan wrote: >> >> What is your expiration algorithm? >> >> > None so far. As its all very new, I'm still "collecting". >> > On my local IP RBL I have 30 days, dunno yet what to use on URIs, I >> > assume that using 6 months at least would be safe. >> >> 6 months sounds reasonable to me. 3 months could work also. >> >> The way the sc data works is that it's refreshed by new reports >> or the records fall off the list after some number of days. In >> other words it's report-driven. > which makes sense when autromatically listing IPs as a zombie may be fixed > real fast. Not sure how that's relevant since we're doing URI domains, not zombie IPs. IOW we're doing destination URIs, not source IPs. To me they're not too connected. The hosting of the URI and the sending of spam are relatively de-coupled (not connected). > my thought is that as domains are usually paid for a year or more, their > owners have to get their ROI together, so keep them in there for at least as > long as the dom is paid for...:) Most hard core spammers use a domain for a couple days then abandon it. These spammers don't use their domains a year; they treat them as disposable. Jeff C.

1 0

RE: Start an IP list to block?
by Chris Santerre 15 Sep '04

15 Sep '04

>-----Original Message----- >From: jm(a)jmason.org [mailto:jm@jmason.org] >Sent: Friday, September 10, 2004 1:05 PM >To: Jeff Chan >Cc: SURBL Discussion list (E-mail); Spamassassin-Talk (E-mail) >Subject: Re: Start an IP list to block? > > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >Jeff Chan writes: >> On Friday, September 10, 2004, 7:27:06 AM, Chris Santerre wrote: >> > WOW! I think this would hit more FPs then listing the IP! >Am I wrong there! >> > I would never list the name server, as they may be hosting >for much more >> > then just a spammer. That number is sure to be greater >then a virtual hosts >> > number for an IP. Maybe I'm missing something key? >> >> SBL lists some spammer name server (and web server) IPs. >> Hopefully they're careful about it, since you're right listing >> name servers could affect a lot more than just the virtual hosts >> on a web server IP. > >SBL is also *very* manually-driven, and has a high level of certainty >required before anything is listed. There's some serious human vetting >going on for every IP that gets added, and they (generally) >spot the cases >where ns1.bigisp.com would be listed, and don't list them ;) > >- --j. 1) Sounds familiar...the vetting that is ;) 2) HOw the hell do you keep up on your email? I'm convinced JM is actually a machine of some sort. Possibly an old PDP11 in a university basement someone left on and forgot. It somehow became self aware. --Chris

2 1

[OT] FUN: Something to send your family members!
by Chris Santerre 15 Sep '04

15 Sep '04

I lost my freakin mind last night. I was about to drive to someone's house and stick the phone someplace they didn't want it ;) Rather then just rant about it, I figured I would take my anger and put it towards something constructive. So for anyone who knows what I'm talking about on this page, feel free to spam it to all your friends and family! ;) http://www.rulesemporium.com/rant.html Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

RE: [SURBL-Discuss] important reduce wrise renkles & skin spots ( fwd)
by Chris Santerre 14 Sep '04

14 Sep '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Tuesday, September 14, 2004 3:16 PM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] important reduce wrise renkles & >skin spots >( fwd) > > >on Tue, Sep 14, 2004 at 02:40:32PM -0400, Chris Santerre wrote: >> Not all of these are listed in SURBL: > >Neither are these: > >92sell3323serve.biz >ball5552drugs.biz >cheapest5145tabs.biz >cheapestt216655tabs.biz >extra3535pills.biz >global2000hosting.net >hide5056tabs.biz >myprog3205pillys.biz >odevide2003drugs.biz >optin9987free.net >serenajones2000netscape.net >stored78778pillllls.biz >vgeorge7098drugs.biz >your1511pills.biz >your2512pills.biz > >FYI. > Actually I did another search and came up with over 650+ WOW! --Chris

2 1

RE: [SURBL-Discuss] important reduce wrise renkles & skin spots ( fwd)
by Chris Santerre 14 Sep '04

14 Sep '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Friday, September 10, 2004 8:48 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] important reduce wrise renkles & skin spots >(fwd) > > >Hi! > >Our favorite pill spammers also try to get around SURBL now. > >I dont want to end up making SA rulesets for this, any suggestions ? > >ns3.airmaramba.biz >ns3.avk29.biz > >The same crap... But, with less SA hits now, since its not touched by >SURBL. Bah. > >---------- Forwarded message ---------- >Date: Sat, 11 Sep 2004 01:50:29 +0100 >From: kenneth clakley <auroraschorn(a)rfc.every1.net> >To: wilfredo moote <reyes(a)prolocation.net> >Subject: important reduce wrise renkles & skin spots > >suc-oneonta sony-steo lettery > > >>From inside to outside, from w^eig_ht l`o^ss to skin care. From mental >relief to physical relief, from antidepressant to muscle >relaxant. The care >inside out. > >you can copy > >wjq.s.adjuster6370pinn.com/56/ > >to your browser > I wrote this for SARE: >> uri ANUMA /\.[a-z]{4,}\d{4,}[a-z]{4,}\.(?:com|net|biz|info|org)/i >> describe ANUMA Domain with ALPHAs NUMBERs APLHAs >> score ANUMA 1.0 >> >> to catch tons of this: >> stiffed5912tads.com >> unawares6248pinn.com >> snoozed2548rneds.com >> 585paperwork970tads.com >> congener1455rneds.com --Chris

3 2

RE: [SURBL-Discuss] Whitelist Please
by Chris Santerre 14 Sep '04

14 Sep '04

>-----Original Message----- >From: Frank Ellermann [mailto:nobody@xyzzy.claranet.de] >Sent: Thursday, September 09, 2004 10:01 PM >To: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] Whitelist Please > > >Jeff Chan wrote: > >> Chris and Ryan and Raymond, don't even think about proposing >> a subdomain list. LOL! ;-) > >What's the problem with this idea ? It would be only one level >above the real host, so for say claranet.de you would have to >consider www.claranet.de and xyzzy.claranet.de, but you would >ignore www.xyzzy.claranet.de or more.levels.xyzzy.claranet.de > >Then if I start to spamvertize my site you catch me without >hitting any other user.claranet.de (let alone www.claranet.de) > >Assuming that my ISP doesn't neeed weeks to cancel my account >after I started to spam the xyzzy entry will expire soon. > >> It's about time ICANN cracked down on rogue registrars. > >I'll believe it when I see it. These registrars pay ICANN's >budget, don't they ? > >> There will always be disagreement about that optimization >> point. That is natural. (It's also a PITA.) > >Sometimes your criteria appear to be a bit obscure for me. >Of course some people may love a "joke of the day" mail - >that's okay, if they like it they won't report it as spam. > >But others don't like any unsolicited jokes, and they would >report it as spam. In that case the joke-of-the-day site >_is_ spamming, and it's okay to list them. Even if they >also have some real fans with a "legit" interest in their >joke of the day. In that case you can't avoid a collateral >damage, whatever you do. > Bye, Frank > hmmm.... can't we treat these like we treat com.ar tld? or co.uk? Like Frank said, just checking the subdomain one more level up for these guys. I don't see the harm in that. Or am I missing something again? I think what Jeff meant was another SURBL list entirely ;) No, I think we have enough as well. --Chris

4 6

RE: [SURBL-Discuss] Large ham corpus hits against SURBLs
by Chris Santerre 14 Sep '04

14 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, September 10, 2004 2:40 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] Large ham corpus hits against SURBLs > > >I've extracted the plaintext * URI domains from a 14 GB ham corpus, >taken the top 70th and 85th percentiles of the most frequently >occurring domains and compared them against all SURBL domains, >the master list of which can be found at: > > http://spamcheck.freeapp.net/multi.domains.sort > >At the 70th percentile level, there were only two matches: > > automotivedigest.com > processrequest.com > >At the 85th percentile there were a few more: > > automotivedigest.com > chartshop.com > ct002.com > dakotaairparts.com > hallogram.com > infoaeroplan.ca > investorsinsight.com > processrequest.com > sitepronews.com > topachat.com > >These are arguably false positives. What do we know about them. >Should we whitelist or not whitelist any? > > >* looking at plaintext has advantages and disadvantages: > >1. quick and easy >2. does not "double or triple count" messages which also >have BASE 64 or quoted printable encoded versions of the same URIs >3. misses some such encoded URIs which don't have plaintext >equivalents in a different part of the message > >Nonetheless the data are still probably generally useful. > Nice work. I got none of these marked as spammers. I think sitepronews has caught my eye a few times, but not enough to be marked. Site pro also has: * 1: allbusinessnews.com * 2: exactseek.com * 3: ezinehub.com * 4: goarticles.com * 5: novicenews.com * 6: sitepronews.com * 7: submitexpress.com * 8: zinehub.com Chartshop linked to: * 1: astrology.com * 2: astronet.com * 3: chartshop.com * 4: kweb.com ct002 linked to (raises an eyebrow): * 1: 123banners.com * 2: 123greetings-inc.com * 3: 123greetings.com * 4: 123greetings.info * 5: ct002.com dakotaairports.com linked to: * 1: a250support.com * 2: avsupport.com * 3: dakotaairparts.com * 4: partslogistics.com investorsinsight.com not linked to anyone, but on more then a few peoples lists. However NANAS reports would have me believe they should NOT be listed. (Odd huh?) processrequest.com linked to: * 1: e2communications.com * 2: processrequest.com * 3: prq0.com Check http://tinyurl.com/4ds43 Just going to their website screams to me to watch them closely! If they are legit, they should be using SURBL to watch their own customers. They are a member of the evil empire DMA as well. In my jaded mind, thats an automatic block here at my company. Obviously different for SURBL. This one needs to be contacted and watched, IMHO. topachat.com linked to: * 1: topachat-clust.com * 2: topachat.com They appear clean and possibly Joe Jobbed. Keep in mind, these lists are just good info. They shouldn't be used soely to determine their spammyness on their own. These lists are just to see who they are linkd to, and sometimes those links speak volumes. Like ct002 might need further investigation. HTH someone. --Chris

3 5

FP on WS
by Bill Landry 14 Sep '04

14 Sep '04

Found orchardbank-MUNGED-.com is listed on WS. Probably doesn't need much justification for removal, but the domain was registered on May 30, 1997. Found two old NANAS listing, one from 11/02 and one from 2/03. Bill

2 2

OFF-TOPIC: CBS Forgery Scam
by Rob McEwen 14 Sep '04

14 Sep '04

OFF-TOPIC: CBS Forgery Scam (forgive me Jeff) I've studied this thoroughly. I can say 100% beyond a shadow of a doubt that this is a forgery propagated by CBS. Has anyone been following this? Does anyone doubt what I just said? Rob McEwen

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss