Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

Proflowers again, was: Send Holiday Flowers for $24.99 plus Beautiful Glass Vase from Proflowers (fwd)
by William Stearns 24 Dec '04

24 Dec '04

Good afternoon, all, We discussed proflowers earlier this year. To quote Jeff: > It also seems they're at least trying to cut back on spamming if we > accept the decrease in recent NANAS sightings. I just received 4 more spams from them, one attached. Perhaps they just get quiet between holidays? I'd like to place one vote for blacklisting them. Opinions? Cheers, - Bill --------------------------------------------------------------------------- "What is the most effective Windows NT remote management tool? A car." -- Network Intrusion Detection, An Analyst's Handbook 2nd Edition, 2000 Stephen Northcutt et al, page 147 (Courtesy of Rodrigo Goya <lucent(a)securenet.com.mx>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

5 8

RE: [SURBL-Discuss] phishing attempt
by Matthew Wilson 24 Dec '04

24 Dec '04

Jeff, I don't know if you ever got access to anti-phishing's phish archive; but if you didn't, you might put up a donation link on your site and solicit contributions that would specifically go toward paying for access to their database, for at least 1 year. Of course, if their database isn't updated as quickly as yours or isn't helpful for the first year, then you obviously wouldn't continue it... Just an idea... Matthew Wilson

2 1

phishing attempt
by Mariano Absatz 24 Dec '04

24 Dec '04

Hi David et al. Just got this phishing attempt referencing: http://211.235.248.74:280/index.php?Ihwt=NBKFdEjFBJRXqkQblivPGRDGUPJEYgMMTy… Cc-ing SURBL just FYI. The complete message is at the bottom. -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com Received: from louiskoo.com ([219.251.237.182]) by prxy6.uba.ar (8.12.10/8.12.10) with ESMTP id iBNB6ZEc035962 for <baby(a)ccc.uba.ar>; Thu, 23 Dec 2004 08:06:37 -0300 (ART) Received: from tcfexpress.com (tcfexpress.com [207.250.12.89]) by louiskoo.com with esmtp id 0D0E50BB10 for <baby(a)ccc.uba.ar>; Thu, 23 Dec 2004 14:07:24 +0300 Reply-To: TCF <support-auto23(a)tcfexpress.com> Message-ID: <110101c4e8df$85ab0d5f$624d22dc(a)tcfexpress.com> From: TCF Support <support-auto53(a)tcfexpress.com> To: Baby <baby(a)ccc.uba.ar> Subject: Debit Card Attention! Date: Thu, 23 Dec 2004 14:07:24 +0300 MIME-Version: 1.0 Content-Type: text/html X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.4682 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 X-GMX-Antivirus: 0 (no virus found) Return-Path: <support-auto53(a)tcfexpress.com> <html> <head><title>TCF - Bank</title></head><body> Dear TCF Client, Information to your attention: our bank is switching to newest transactions security standards. TCF ATM services utilize advanced security technology to protect your personal financial information. This security update will be effective immediately. <a href="http://211.235.248.74:280/index.php?Ihwt=NBKFdEjFBJRXqkQblivPGRDGUPJEYgMMTy…">Please click on this reference.</a> This security upgrade will be effective immediately and requires our customers to update their ATM card information. Thank you for contacting TCF. TCF Security Dept. </body> </html>

2 1

http://www.web-o-trust.org/
by Daniel Quinlan 23 Dec '04

23 Dec '04

(oops, that was sent before I was finished) This whitelist is probably a bit more directly usable than some of my suggestions. I don't know why I didn't think of it before, but Russell Nelson suggested it to me (it's his creation, of course). It should be fairly trivial (and I think there might be a tool for this) to walk the web-o-trust tree, produce a "lowest depth seen" for each domain and then start working through it. I don't know if there are bad entries if you go too deep on the tree. By the way, did I mention why I'm so keen on your whitelist? Once domain authentication becomes a reality, it will be a great source for whitelisting of authenticated senders. I believe Justin has looked at web-o-trust some, so I've copied him on the message. Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

2 1

Re: MIT Spam conference
by Daniel Quinlan 21 Dec '04

21 Dec '04

William Stearns <wstearns(a)pobox.com> writes: > I'll be attending the MIT spam conference this year, Jan 21st, > 9-5. Details at http://www.spamconference.org/ . The registration is > free, but they suggest an early registration before the conference fills > up. Last year, it was awesome to meet up with SpamAssassin developers and other anti-spam folks, but the MIT spam conference itself was disappointing for the second year in a row. It: - was full of poorly reviewed papers of anecdotal information - was unbelievably cold (both inside and outside) - uncomfortable to sit in circa-1965 wood chairs > I'd love a chance to meet other people working on spamassassin and > surbl. Is anyone else planning on attending? I'd love to meet you and other SURBL/SA people. If you want to attend a peer-reviewed anti-spam conference with heating, a pleasant climate, and comfortable seating, I can definitely recommend CEAS. If you're ever in the SF Bay Area and would like to get together, drop me a line. I've met with Jeff a few times. Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

2 1

SURBL and listing abuse address
by Nick Askew 21 Dec '04

21 Dec '04

Hi, I have MDaemon installed and lately it has been working wonders to reject spam. However I've noticed that all it does is bounces the mail back to the person who supposedly sent it. Now we all know that it is almost always some innocent address or a fake address and so best case the bounce is pointless and worst case some innocent person is being bombarded with mails. I'm relatively new to all this so please forgive me if this has been suggested before or indeed if it is simply possible with other mail servers. It occurs to me that we could list the various abuse addresses of the ISP hosting the black listed site and this could be returned when a match is found. If the server software then bounced the mail not to the sender but to the abuse address we would seriously start to affect these ISP's. It seems to me this is not like the lycos solution because we are only sending a mail when we receive a mail that mentions a spam url. The result is that the more spam they send the more mails they receive from us, the less spam they send the less mail they will receive and no innocent addresses are affected. There is a drawback to SURBL and that is that someone could end up black listed wrongly. This mechanism would add insult to injury but lets face it if I wanted to get at xyz.com I'd send out a bunch of spam as if it came from jdoe(a)xyz.com advertising xyz.com and wait for the them to appear on the black list and then send out more spam and now watch their ISP get really upset with them as the bounced messages end up with them. Nick

3 5

RE: [SURBL-Discuss] SURBL and listing abuse address
by Chris Santerre 21 Dec '04

21 Dec '04

>-----Original Message----- >From: Nick Askew [mailto:Nick@Askew.nl] >Sent: Monday, December 20, 2004 3:42 PM >To: 'SURBL Discussion list' >Subject: RE: [SURBL-Discuss] SURBL and listing abuse address > > >> > I'm relatively new to all this so please forgive me if this >> has been >> > suggested before or indeed if it is simply possible with >other mail >> > servers. It occurs to me that we could list the various abuse >> > addresses of the ISP hosting the black listed site and this >> could be >> > returned when a match is found. If the server software >then bounced >> > the mail not to the sender but to the abuse address we >> would seriously >> > start to affect these ISP's. >> >> Most of these domains either dont have abuse addresses, nor >> care about any abuse email that rolls their way (the're just >> dummy domains who only exist for a month to spam, then die).. >> What you are suggesting is going to result in my server >> queueing the message (rather than just returning a 5xx half >> way through the SMTP conversation) and sending it to a >> (probably bogus) abuse address, which will bounce.. >> >Yes I suppose if you simply perform a whois on the IP address of the >site you will end up with some spammer that does not care if >you post to >abuse or postmster. However I would think that most spam domains are >purchased off other ISP's so after a while perhaps it would be possible >to change the listed address to that of the ISP's ISP and so on until >someone takes notice. > >I'm sure that actually fetching the content of the site would work to >deter people from sending out their URL as spam but it would lead to a >new problem. Every machine in the world using SURBL (and let's face it >that should be everyone, it works so well) could be used for a DoS >attack just by sending an email (OK the domain would need to be in >SURBL). Discussing ideas is always good :) A quicker method instead of looking at the spamvertised site, is to look at the whois info for the spam domain. Something being worked on now. All SURBL entries are manually added by a human. Well, some guys ride the border of 'human'. We'll just say biped. :-) --Chris

2 1

RE: [SURBL-Discuss] SURBL and listing abuse address
by Matthew Wilson 21 Dec '04

21 Dec '04

Nick, This isn't a topic for the SURBL discussion list. Please submit your complaint to the MDaemon forums at http://lists.altn.com/WebX?14@189.fwM8arWQnvI.0@.ee88f61 -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Nick Askew Sent: Monday, December 20, 2004 1:46 PM To: discuss(a)lists.surbl.org Subject: [SURBL-Discuss] SURBL and listing abuse address Hi, I have MDaemon installed and lately it has been working wonders to reject spam. However I've noticed that all it does is bounces the mail back to the person who supposedly sent it. Now we all know that it is almost always some innocent address or a fake address and so best case the bounce is pointless and worst case some innocent person is being bombarded with mails. I'm relatively new to all this so please forgive me if this has been suggested before or indeed if it is simply possible with other mail servers. It occurs to me that we could list the various abuse addresses of the ISP hosting the black listed site and this could be returned when a match is found. If the server software then bounced the mail not to the sender but to the abuse address we would seriously start to affect these ISP's. It seems to me this is not like the lycos solution because we are only sending a mail when we receive a mail that mentions a spam url. The result is that the more spam they send the more mails they receive from us, the less spam they send the less mail they will receive and no innocent addresses are affected. There is a drawback to SURBL and that is that someone could end up black listed wrongly. This mechanism would add insult to injury but lets face it if I wanted to get at xyz.com I'd send out a bunch of spam as if it came from jdoe(a)xyz.com advertising xyz.com and wait for the them to appear on the black list and then send out more spam and now watch their ISP get really upset with them as the bounced messages end up with them. Nick _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

3 2

Re: [SURBL-Discuss] SURBL and listing abuse address
by Rob McEwen (PowerView Systems) 20 Dec '04

20 Dec '04

Nick, "Joe Jobs" happen all the time. Usually via a virus which plays "musical chairs" with the address book and sometimes via a spammer maliciously attacking someone. Also, MANY or MOST of these viruses DO contain affiliate URLs and large portion of these ARE SURBL-listed. Therefore, your plan will hurt innocent parties very, very often (not just in cases where someone was wrongly listed in SURBL). But, your intentions are sound and maybe a workable idea will result from this discussion. Rob McEwen

1 0

MIT Spam conference
by William Stearns 18 Dec '04

18 Dec '04

Good day, all, I'll be attending the MIT spam conference this year, Jan 21st, 9-5. Details at http://www.spamconference.org/ . The registration is free, but they suggest an early registration before the conference fills up. I'd love a chance to meet other people working on spamassassin and surbl. Is anyone else planning on attending? Cheers, - Bill --------------------------------------------------------------------------- "God grant me the senility to accept the things I cannot change, The frustration to try to change things I cannot affect, and the wisdom to tell the difference." (Courtesy of Mike Ricketts <rickettm(a)ox.compsoc.net>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss