Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

RE: [SURBL-Discuss] Re: Was: List of spamvertised sites sent viazombies, open proxies, etc.?
by Matthew Wilson 13 Mar '05

13 Mar '05

Jeff, I'm confused... Why are you looking for historical snapshot or summary data when the nature of the message stream is to change continually? Surely any statistics that would correlate domains and XBL'ed hosts would only be good for a day or two at the most?? Matthew

2 1

RE: [SPAM-TAG] Re: [SURBL-Discuss] A list of spammers urls
by Matthew.van.Eerde＠hbinc.com 12 Mar '05

12 Mar '05

Jeff Chan wrote: > On Friday, March 11, 2005, 4:33:45 AM, Chris Edwards wrote: >> I wonder if there'd be much mileage in a SpamAssaassin feature to >> award points for any URLs that don't resolve ? > > In principle it's something that could be done, but the timeouts > encountered trying to resolve non-existent domains could make it > impractical. Aren't the name resolution attempts done in parallel? Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer perl -e"map{y/a-z/l-za-k/;print}shift" "Jjhi pcdiwtg Ptga wprztg,"

2 1

JP on rulesemporium
by Matthew Wilson 12 Mar '05

12 Mar '05

I'm curious as to why JP isn't queried on the rulesemporium.com SURBL checker?

2 1

A list of spammers urls
by Rakesh 11 Mar '05

11 Mar '05

Here is a list of urls that i compiled from spams. I queried sc.surbl.org, using them but didnt find them listed. Some of the domains are the randomly generated ones and might have became invalid as of now. However some of them are still working. I didnt knew where to report this list to, so I am posting it to this list and Jeff. http://get-internet-software.com/cgi-bin/rd.cgi?poKzgADTMS <http://get-internet-software.com/cgi-bin/rd.cgi?poKzgADTMS> http://surfer-support.com/w30/pikapika.html <http://surfer-support.com/w30/pikapika.html> http://sanguozhi10.com/tp/default.asp <http://sanguozhi10.com/tp/default.asp> http://pinghetang.com/ http://get-internet-software.com/w30/pikapika.html <http://get-internet-software.com/w30/pikapika.html> http://tempole.com http://bma.net.mypillsvalues.com <http://bma.net.mypillsvalues.com> http://rckksa.a6.defenses8093biz.us <http://rckksa.a6.defenses8093biz.us> http://pj.decatur9854rx.us http://nht.p.aye3054biz.us http://i.p.aye3054biz.us http://rd.a6.defenses8093biz.us <http://rd.a6.defenses8093biz.us> http://rem.decatur9854rx.us http://xanb.su.aye3054biz.us http://pd.abk.crucify8156pi11.us <http://pd.abk.crucify8156pi11.us> opp.dacemhad.us <http://opp.dacemhad.us> images.dacemhad.us <http://images.dacemhad.us> http://q.m.crucify8156pi11.us http://popupblocker-software.com/w30/pikapika.html <http://popupblocker-software.com/w30/pikapika.html> http://history-cleaner-software.com <http://history-cleaner-software.com> http://www.spyware-killer-software.com <http://www.spyware-killer-software.com> http://images.NCatalpa2m.biz/ http://Passionvin.biz -- Regards, Rakesh B. Pal Emergic CleanMail Team. Netcore Solutions Pvt. Ltd. ======================================================================== It doesn't matter who you are, it's what you do that takes you far ======================================================================== ---------------------------------------------------------- Netcore Solutions Pvt. Ltd. Website: http://www.netcore.co.in Spamtraps: http://cleanmail.netcore.co.in/directory.html ----------------------------------------------------------

4 15

RE: [SURBL-Discuss] Spam Honeypot identification through SURBL
by Chris Santerre 10 Mar '05

10 Mar '05

>-----Original Message----- >From: Matthew Wilson [mailto:matthew@boomer.com] >Sent: Thursday, March 10, 2005 12:01 PM >To: Jeff Chan; SURBL Discussion list >Subject: [SURBL-Discuss] Spam Honeypot identification through SURBL > > >Jeff (and list), > >I'm worried that spammers can use SURBL to identify honeypot email >servers by using unique subdomains. A spammer must merely >send a unique >subdomain URL to every address on their list, and if that unique >subdomain is blacklisted in SURBL, they have identified a potential >honeypot and will no longer send spam to that address/server. > >It is therefore my humble opinion that only the second-to-top domain >name should be listed in SURBL, and not any of the subdomains. > >Thoughts? > >-Matthew Wilson I make it a point to not list subdomains. Only the main domains get listed by me. If one got in, it was an oversight. When some submissions come in from certain projects, I will purposely delay their addition to SURBL, so that spammers can't time them with spam runs. But frankly the domains come from so many different sources, it doesn't matter much. --Chris

1 0

RE: [SURBL-Discuss] RFC: Updated list removal statement
by Chris Santerre 08 Mar '05

08 Mar '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, March 08, 2005 4:35 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] RFC: Updated list removal statement > > >On a related note, I've updated the list removal statement on the >SURBL web site to include: >__ > > http://www.surbl.org/lists.html > >List Removal > >All of the data in SURBL lists come from external data sources. >None of the SURBL lists come from data created here, so generally >speaking to get a record off a list you should contact that data >source as described earlier under each list. However, for the sc >and ab lists you may send a removal request to whitelist at surbl >dot org. > > Note: Before reporting false positives, please check that > they are actually on SURBL lists. This can be done for > example with a name resolution or by using the SURBL+ > checker tool. There is an intermittent bug with SpamAssassin > that appears to show FPs when none actually exist. (See > SpamAssassin Bugzilla id=3997.) > >When sending a removal request, please include: > > 1. Full and complete contact information for your organization > including street address and telephone numbers, > 2. Information about your sending servers such as IP addresses, > 3. A sample message with full, sent headers and full message > body including URIs, > 4. A brief description of your organization or a link to one, > 5. Your organization's published mail practices, especially > its published anti-spam policies, or links to them. > >If your organization does not publish and actually practice an >anti-spam policy, it should. Please send your request from your >organization's domain. Requests sent from Hotmail, Yahoo, gmail, >etc. accounts may not be considered. >__ > >How does this look to everyone? Too strict? Not strict enough? >Too little info? Too much? How about: "Be prepaired to explain any UBE that is found to contain your domain." "Understand that you ARE responsible for the actions of your affiliates." "If you purchased a list which contains harvested addresses and use them in a mailing, then you are commiting a crime." "'Just unsubscribe!', is NOT a valid response!" --Chris

1 0

RE: [SURBL-Discuss] Spammer Anti-SURBL tactic
by Chris Santerre 08 Mar '05

08 Mar '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, March 08, 2005 2:22 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Spammer Anti-SURBL tactic > > >On Monday, March 7, 2005, 9:07:37 PM, Steven Champeon wrote: > >> Speaking of anti-SURBL tactics, I got this turdlet today (snippet >> of HTML email below): > >> <DIV>We are giving out Free Import / Export / Wholesales/ >Distributers / >> Retailers  Contact Database</DIV> >> <DIV> </DIV> >> <DIV>If You interested Pls get at Following URL</DIV> >> <DIV> </DIV> >> <DIV><A >onmouseover="window.status='http://www.impexp-data.com';return true;" >> onmouseout="window.status=' ';return true;" >> href="http://indigisys.com/chawla1/open.htm" target=_blank>Business = >> Database</A> </DIV> >> <DIV> </DIV> >> <DIV>Free Business / Marketing Tools ( Free SMS to All >over world Unl= >> imited ) </DIV> >> <DIV><A >> >onmouseover="window.status='http://www.impexp-data.com/sms';ret >urn true;" >> onmouseout="window.status=' ';return true;" >> href="http://indigisys.com/chawla1/open.htm" >target=_blank>FREE SMS = Tools >> </A></DIV> > >> It *looks* like whoever owns indigisys.com wants to hide the fact >> that they're actually indigisys.com by pretending to be >impexp-data.com, >> which doesn't exist. Does SURBL's lookup code catch this? > >SpamAssassin 2.64 running SpamCopURI seems to check both domains: > >debug: checking url: http://indigisys.com/chawla1/open.htm >debug: returning cached data : indigisys.com.multi.surbl.org >-> ARRAY(0x9351f4c) >debug: Receieved match prefix: 127.0.0 >debug: Receieved mask: 32 >debug: no match > >debug: checking url: http://www.impexp-data.com';return >debug: returning cached data : >impexp-data.com.multi.surbl.org -> ARRAY(0x9386f58) >debug: Receieved match prefix: 127.0.0 >debug: Receieved mask: 32 > >As does SpamAssassin 3.0.1: > >debug: URIDNSBL: query for indigisys.com took 0 seconds to >look up (multi.surbl.org.:indigisys.com) >debug: URIDNSBL: query for impexp-data.com took 0 seconds to >look up (multi.surbl.org.:impexp-data.com) > > >Those are the only SURBL applications I have easy access to, so I >don't know how others may handle them. SpamAssassin does the >right thing. :-) > Not only that, but the SARE rules look for this trick as well. Everytime they try to get around something, spammers end up painting themselves in a corner. --Chris

1 0

RFC: Updated list removal statement
by Jeff Chan 08 Mar '05

08 Mar '05

On a related note, I've updated the list removal statement on the SURBL web site to include: __ http://www.surbl.org/lists.html List Removal All of the data in SURBL lists come from external data sources. None of the SURBL lists come from data created here, so generally speaking to get a record off a list you should contact that data source as described earlier under each list. However, for the sc and ab lists you may send a removal request to whitelist at surbl dot org. Note: Before reporting false positives, please check that they are actually on SURBL lists. This can be done for example with a name resolution or by using the SURBL+ checker tool. There is an intermittent bug with SpamAssassin that appears to show FPs when none actually exist. (See SpamAssassin Bugzilla id=3997.) When sending a removal request, please include: 1. Full and complete contact information for your organization including street address and telephone numbers, 2. Information about your sending servers such as IP addresses, 3. A sample message with full, sent headers and full message body including URIs, 4. A brief description of your organization or a link to one, 5. Your organization's published mail practices, especially its published anti-spam policies, or links to them. If your organization does not publish and actually practice an anti-spam policy, it should. Please send your request from your organization's domain. Requests sent from Hotmail, Yahoo, gmail, etc. accounts may not be considered. __ How does this look to everyone? Too strict? Not strict enough? Too little info? Too much? Jeff C. -- "If it appears in hams, then don't list it."

1 0

RE: [SURBL-Discuss] Nice article on SURBL and note about weekends .....
by Chris Santerre 08 Mar '05

08 Mar '05

Wow this is even a better article! <http://etdeliverability.typepad.com/chips_deliverability_tips/2004/10/brand _names_und.html> Perhaps we should get in touch with the people of Pivotal Veracity?? Check out this paragraph: "How does this affect you? My friends at Pivotal Veracity who offer phenomenal new technology for tracking email deliveries to top ISP's recently completed a study on the topic of SURBL's and deliverability. They found that emails containing a blocked URL were blocked entirely at 5 of the 20 ISP's tested, while 7 ISP's moved the email to the bulk folder. Also, their tests showed that emails with blocked URL's were filtered to bulk or discarded at 50% of medium to larger enterprises. Pivotal Veracity's new product, eBrand Monitor (also offered via ExactTarget's Inbox Detective), helps companies detect blocking before it causes problems." For those keeping count, that leaves 8 ISPs that need a LART ;) I suspect this is why Jeff always yells at me to get our FP rate lower! But I love how the article ends. Clearly shows legit companies that they need to keep track of their affiliates, because they can and will hurt their brand. --Chris

2 1

Nice article on SURBL and note about weekends.....
by Chris Santerre 08 Mar '05

08 Mar '05

I was surfing for something else while waiting for two machines to reboot. Found this... http://daryl.learnhouston.com/?p=143 I like people who like us :) Also a side note: I know sometimes updates over the weekend run a little slower, I am still working on some ideas to speed that up on my end. But to try to counter act this a little, ANY, and I mean ANY and ALL domains submitted over the weekend, go thru a MUCH more rigourus research then the weekday. I figure if spammers are trying to take advantage of people being away for the weekend, then I'm going to look at those domains MUCH more closely. For instance, for the domains reported this weekend that fell into my bucket, I added about 35 times the amount from researching them all! Thats the price they pay for trying to be sneaky! ;) --Chris

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss