Discuss

discuss@lists.surbl.org

1870 discussions

New slogan
by Ryan Thompson 20 Jul '04

20 Jul '04

Save a parse tree. Get SURBL. ;-) - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

2 1

Heads up, Bill out next week
by William Stearns 20 Jul '04

20 Jul '04

Good day, all, I'll be away teaching Perimeter Security all next week (Sun 7/25 - Sun 8/1, possibly another day). If you have any requests for spamgate or my end of ws.surbl.org, please let me know beforehand. I'll do my best to check in evenings for email and IM. Cheers, - Bill --------------------------------------------------------------------------- "After 3 weeks of intense cryptanalysis, the Naval codebreakers were still baffled by the messages. They called the Navajo language a 'wierd succession of gutteral, nasal, tongue-twisting sounds... we couldn't even transcribe it, much less crack it.'" - The Code Book, Simon Singh. -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

1 0

RE: 6dos data into ds.surbl.org
by Chris Santerre 20 Jul '04

20 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Sunday, July 18, 2004 5:07 PM >To: SURBL Discuss; SpamAssassin Users >Subject: 6dos data into ds.surbl.org > > >Chris Santerre asked on the spamassassin-users list whether >ds.surbl.org was being updated with the 6dos data. The answer is >no, it's static now based on that snapshot Chris gave me a couple >weeks ago. To be honest, the 6dos data seems too over-inclusive >to me for production use, but perhaps Chris or Rich could help me >figure out something closer to a live feed as we beta test it. > >Jeff C. LOL, I don't remember half the stuff I ask :) Actually the initial data that was used wasn't even the freshest from the source. This data is used in a much different way and is quite large! Well beyond a simple list of domains. I'm actually thinking it should not be used. It does contain a vast amount of info. I'm hoping instead, that this data source could be used for SURBL research in the future. When and if we get a nicer interface to it. So my official recomendation is for ds.surbl.org to go away. --Chris

3 2

Re: [SURBL-Discuss] test
by Jeff Chan 19 Jul '04

19 Jul '04

On Monday, July 19, 2004, 7:23:44 AM, William Stearns wrote: > Good morning, Ramond, Chris, > On Mon, 19 Jul 2004, Raymond Dijkxhoorn wrote: >> > Sorry, it said I was disabled. Just checking. >> >> If you can read this its working just fine :) > The list claimed I had been booted as well. Any idea why? The only change we made recently was to add a third round robin MXer for lists.surbl.org, as mentioned on the announcement list: > We've added another round robin primary MXer for lists.surbl.org, > where the SURBL mailing lists are coming from: > > vmx03.prolocation.net > > In case anyone is somehow authenticating sending servers, you may > need to add this new server to any mail server whitelists, etc. > > The prolocation addresses and servers are generally not on RBLs, > but it has been mentioned that some of their IPs may be listed > in SPEWs (which is being checked and corrected if so). > > We mention this mainly because some people have gotten bounce > (delivery failure) notifications from our Mailman (mailing list > manager program) lately, and had their mail automatically > disabled. To re-enable it, follow the instructions in the > notification or visit the lists web site: > > http://lists.surbl.org/ > > This could also perhaps have been caused an intermittent problem > while the new MXer was propagating in the DNS. > > lists.surbl.org preference = 10, mail exchanger = vmx01.prolocation.net > lists.surbl.org preference = 10, mail exchanger = vmx02.prolocation.net > lists.surbl.org preference = 10, mail exchanger = vmx03.prolocation.net > lists.surbl.org preference = 100, mail exchanger = mx03.prolocation.net > lists.surbl.org preference = 200, mail exchanger = mx01.prolocation.net > lists.surbl.org preference = 300, mail exchanger = mx02.prolocation.net > lists.surbl.org preference = 500, mail exchanger = mx04.prolocation.net > > vmx01.prolocation.net internet address = 212.127.254.132 > vmx02.prolocation.net internet address = 212.127.254.133 > vmx03.prolocation.net internet address = 81.23.230.33 > mx03.prolocation.net internet address = 194.171.240.23 > > mx01.prolocation.net 213.73.255.243 > mx02.prolocation.net 213.197.29.6 > mx04.prolocation.net 213.206.89.181 Jeff C.

1 0

RE: [SURBL-Discuss] exacttarget-MUNGED.com
by Chris Santerre 19 Jul '04

19 Jul '04

>-----Original Message----- >From: William Stearns [mailto:wstearns@pobox.com] >Sent: Monday, July 19, 2004 11:32 AM >To: rob(a)pvsys.com; SURBL Discussion list >Subject: Re: [SURBL-Discuss] exacttarget-MUNGED.com > > >Good morning, Rob, > >On Mon, 19 Jul 2004, Rob McEwen wrote: > >> First, I love SURBL... I have integrated it into my server's mail > > Excellent! Glad to hear it. > >> The purpose of THIS e-mail is to ask about a situation where a >> legitimate opt-in newsletter has been blocked. This was a NewsMax.com >> newsletter that I, in fact, specifically requested. >> >> The offending domain found in this newsletter is the following: >> >> exacttarget-MUNGED.com >> >> Maybe exacttarget-MUNGED.com plays clean sometimes (as the >case of this >> particular newsletter) and plays dirty other times. If that >is the case, >> then I don't have a problem with this domain name getting >blocked... but >> if not please double check this and consider whitelisting them. > > Thanks for the report. We've removed that domain as of >the 11:31 >list. > Cheers, > - Bill These guys apear to be shammers (Spam and ham). NANAS has a bunch of posts. I believe they were added due to a Home Depot spam run to a bunch of harvested addresses. They are NOT white. --Chris

2 1

Fwd: RE: More on SpamCopURI busting tests
by Jeff Chan 19 Jul '04

19 Jul '04

This is a forwarded message From: SRH-Lists <giermo(a)333tech.com> To: Jeff Chan <jeffc(a)surbl.org> Date: Monday, July 19, 2004, 1:19:36 PM Subject: More on SpamCopURI busting tests ===8<==============Original message text=============== > Hmm. I disagree. For three of the machines, I _know_ there is no > port 80 blocking. > > > It might be useful if you could show us which tests are failing, > > but I assume it's the same redirection-handling ones that other > > people have mentioned. > > Yup. Same set: > > t/blacklist........ok > t/dnsrbl...........ok > t/extract_urls.....ok > t/mailto...........ok > t/open_redirect....# Failed test (t/open_redirect.t at line 37) > t/open_redirect....NOK 1# Failed test (t/open_redirect.t > at line 44) > t/open_redirect....NOK 2# Failed test (t/open_redirect.t > at line 52) > t/open_redirect....ok 4/5# Looks like you failed 3 tests of 5. > t/open_redirect....dubious > Test returned status 3 (wstat 768, 0x300) > Scalar found where operator expected at (eval 152) line 1, > near "'int' $__val" > (Missing operator before $__val?) > DIED. FAILED tests 1-3 > Failed 3/5 tests, 40.00% okay > t/spamcopuri.......ok > t/whitelist........ok Just adding my "I get the exact same failed tests, no, port 80 is not blocked and, yes, it seems to work if I force install it" -steve ===8<===========End of original message text===========

2 1

Fwd: Re: More on SpamCopURI busting tests
by Jeff Chan 19 Jul '04

19 Jul '04

This is a forwarded message From: Bob McClure Jr <robertmcclure(a)earthlink.net> To: Jeff Chan <jeffc(a)surbl.org> Date: Monday, July 19, 2004, 1:15:27 PM Subject: More on SpamCopURI busting tests ===8<==============Original message text=============== On Mon, Jul 19, 2004 at 01:06:48PM -0700, Jeff Chan wrote: > On Monday, July 19, 2004, 12:53:57 PM, Bob Jr wrote: > > I have just posted this on the SourceForge page for SpamCopURI: > > > Here's another data point. About a month ago I installed it on my > > workstation and it passed all tests. URI version is 1.28. > > > Today, I tried installing it on three other machines, and all required > > a new URI and got v1.31, and SpamCopURI busted the same three tests. > > > Just to test the relavance of that, I upgraded URI on my workstation via CPAN, and then > > manually did the "perl Makefile.PL", "make", and "make test" on > > SpamCopURI, and sure enough, the three tests busted. So apparently > > something happened in URI between v1.28 and v.131 that's causing > > SpamCopURI to bust the tests. > > Thanks for the additional data Bob. Eric Kolve is aware of some > of the net tests failing during installation and is working on > a SpamCopURI install that will skip those tests if appropriate. > (He mentions outbound port 80 being blocked as the source of the > issue.) Hmm. I disagree. For three of the machines, I _know_ there is no port 80 blocking. > It might be useful if you could show us which tests are failing, > but I assume it's the same redirection-handling ones that other > people have mentioned. Yup. Same set: t/blacklist........ok t/dnsrbl...........ok t/extract_urls.....ok t/mailto...........ok t/open_redirect....# Failed test (t/open_redirect.t at line 37) t/open_redirect....NOK 1# Failed test (t/open_redirect.t at line 44) t/open_redirect....NOK 2# Failed test (t/open_redirect.t at line 52) t/open_redirect....ok 4/5# Looks like you failed 3 tests of 5. t/open_redirect....dubious Test returned status 3 (wstat 768, 0x300) Scalar found where operator expected at (eval 152) line 1, near "'int' $__val" (Missing operator before $__val?) DIED. FAILED tests 1-3 Failed 3/5 tests, 40.00% okay t/spamcopuri.......ok t/whitelist........ok > Jeff C. > -- > Jeff Chan > mailto:jeffc@surbl.org > http://www.surbl.org/ Cheers, -- Bob McClure, Jr. Bobcat Open Systems, Inc. robertmcclure(a)earthlink.net http://www.bobcatos.com People we like the least need our love the most. ===8<===========End of original message text===========

1 0

Re: include IP lookups in SURBL lists
by Jeff Chan 19 Jul '04

19 Jul '04

OK I'm going to respond to several ideas in this thread in a single reply. It may help to go back and review some of the thread messages. 1. Regarding adding resolved IP addresses to SURBLs: Not gonna happen. FP potential is way too high. A single (false) entry resolving to a legitimate large shared web hosting server could block hundreds or more legitimate sites. 2. However the next version of sc.surbl.org data engine will be a hybrid name/number system where: A. the domains will get resolved internally, B. the resulting IPs will get sorted into (CIDR) bins, C. any fresh domain report that happens to resolve into one of those bins will inherit the count of hits in the bins (perhaps modulo some function), and most likely any fresh spam domains resolving into a well-populated bin will get listed on the first report instead of the tenth as sc does now. We could even raise the threshold to decrease FPs or change to a "top 500" or "top 1000" list. So that should short circuit most the lag in detection for domains resolving to persistent spammer IPs for the sc data. The resulting lists will still be mostly domains. We probably won't let the internal IPs out, at least not in the existing SURBLs. Perhaps we could turn them into a separate list which could be scored lower. But our focus will remain on domains because they are highly specific and don't require the time- consuming step of name resolution. (Name resolution is no problem on a small box, but on big mail systems it can make content checking impractical. Resolved IPs also have some of the potential problems already mentioned, most importantly FPs.) 3. The outblaze data already has a "recentness of domain registration factor" of 90 days. It also includes extensive spam traps. The combination appears to catch many spammer URI domains pretty quickly and with a low FP rate. So it already somewhat incorporates John Hardin's idea of catching recently registered domains, with the added factor that they actually got caught spamming. Outblaze's traps apparently are pretty well engineered, given the relatively low FP rate. BTW, there's a longer discussion of this question in the FAQ: http://www.surbl.org/faq.html#numbered "Are there plans to offer an RBL list with the domain names resolved into IP addresses?" Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 1

[SURBL-Discuss] Re: sex.surbl.org (was: Re: include IP lookups in SURBL lists)
by Jeff Chan 19 Jul '04

19 Jul '04

On Monday, July 12, 2004, 4:06:44 PM, Marc Kool wrote: > Chris Santerre wrote: >>>To start another thread: >>>I am a contributor to the free URL database that can be used >>>by squidguard and dansguardian >>>with a strong focus on sex sites (with 397000 domains). >>>Although not every sex site sends spam, a mail administrator >>>may want to implement >>>a local policy to block emails that refer to sex sites (I would :-) >>>Does anybody wants/needs/likes sex.surbl.org ??? >>>For a list like sex.surbl.org a feature to include IP >>>addresses is a benefit >>>since 57% percent of the sex domains have 10 or more domains >>>resolving to a single IP address. >> Mark this is a GREAT idea. I'm BCC'ing Jeff on it to make sure he sees this. >> --Chris > I received some questions, so for those who don't know it yet: > the free URL database that mainly includes a list of adult domains can be found on > http://cri.univ-tlse1.fr/documentations/cache/squidguard_en.html#contrib > (correction to the above number: 466057 adult domains are listed on July 13 2004). > If you want to pay for it, you may want to go to http://www.urlblacklist.com > -Marc Thanks for sharing this idea and a free list of the relevant domains. I agree it's an interesting idea, though we've been focussed on spammer's URI domains so far, so it's a bit of a tangent. At nearly 500k record we'd definitely want to do this with rbldnsd. BIND is already getting pretty slow with lists approaching 100k records. For comparison, sbl.spamhaus.org has about 5k records, xbl has about 1.7 million records, list.dsbl.org has nearly 4 million records. multi.surbl.org, our largest production list has about 45k records. How does anyone else feel about turning this list of sex sites into a SURBL? Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

4 5

exacttarget-MUNGED.com
by Rob McEwen 19 Jul '04

19 Jul '04

First, I love SURBL... I have integrated it into my server's mail filtering system. (You may recall weeks back my asking for help on this. I found a solution! My previous filter was upgraded by its author to work with SURBL.) The purpose of THIS e-mail is to ask about a situation where a legitimate opt-in newsletter has been blocked. This was a NewsMax.com newsletter that I, in fact, specifically requested. The offending domain found in this newsletter is the following: exacttarget-MUNGED.com Maybe exacttarget-MUNGED.com plays clean sometimes (as the case of this particular newsletter) and plays dirty other times. If that is the case, then I don't have a problem with this domain name getting blocked... but if not please double check this and consider whitelisting them. Thanks. Rob McEwen rob(a)pvsys.com

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss