Discuss

discuss@lists.surbl.org

1862 discussions

RE: Non-Clickable URI's
by Chris Santerre 07 Dec '04

07 Dec '04

>-----Original Message----- >From: RD [mailto:bitoy@lawin.pinoy.org] >Sent: Friday, December 03, 2004 8:21 PM >To: Spamassassin List >Subject: Non-Clickable URI's > > >Hello List, > >I've seen spams where spammers are using >"Cut&Paste_this_URL_to_your_browser" method reason why spamassassin >won't trigger SURBL database lookup. > >Is there a known workaround to catch this non-clickable URIs >and trigger >SURBL lookup? This is in the form of www . domain . com It was mentioned on the SURBL list, and I wrote a quick and dirty SA rule for it. Initial tests were dissmal. Found 2 ham: > http :// www . drugstore . com / ivd0324 > header copied into the body of a forward: > X-Scanned-By: MIMEDefang 2.28 (www . roaringpenguin . com / mimedefang) Also hit 12 spam out of around 70k. A little more testing needed. But I think this shows that it isn't worth the rule. The links break and require end lusers to not only copy and paste, but edit the link to remove the spaces. Clearly more then most users would do. --Chris

2 1

RE: [SURBL-Discuss] Re: a few URL blacklist sources
by Chris Santerre 06 Dec '04

06 Dec '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Monday, December 06, 2004 1:19 PM >To: quinlan(a)pathname.com >Cc: SURBL Discuss >Subject: [SURBL-Discuss] Re: a few URL blacklist sources > > >> http://moinmaster.wikiwikiweb.de/BadContent > >Apparently, this is now just a copy of mt-blacklist: > > http://www.jayallen.org/comment_spam/ > >It looks a little stagnant, but my previous cooperation suggestion >stands. :-) Thanks DQ. Looks like some good sources. I'll talk to Jeff and see if we can come up with something. I know he will want to put this thru a test of some sort to reduce FPs. But a great idea. --Chris

1 0

RE: [SURBL-Discuss] Web page
by Chris Santerre 06 Dec '04

06 Dec '04

Sweet! Thanks! --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 8:54 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Web page > > >On Friday, December 3, 2004, 8:31:51 AM, Chris Santerre wrote: >> Do we list all the programs that curently support SURBL on >the web site? It >> seemed to escape my eyes if it is. > >There was a partial list on the Quick Start page under "Additional >programs using SURBLs", which I've just updated. > > http://www.surbl.org/quickstart.html > >"Additional programs using SURBLs > >Many programs now support SURBLs including sendmail, qmail, >qmail-ldap, exim, exchange, Policy Patrol, MailScanner, Declude >Junkmail, Merak Mail Server, MDaemon, GEE Whiz, SpamBouncer, >ALOAHA, ASTPS, NEMX Power Tools, XWall, ORFilter, STAT AntiSpam, >MTS Professional, Trash Finder, and more. Please see the News and >Links sections for more information." > >The main list is on the Links page: > > http://www.surbl.org/links.html > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Web page
by Chris Santerre 04 Dec '04

04 Dec '04

Do we list all the programs that curently support SURBL on the web site? It seemed to escape my eyes if it is. --Chris

2 1

RE: [SURBL-Announce] SURBL patches for qmail and qmail-ldap
by Chris Santerre 03 Dec '04

03 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 10:15 AM >To: SURBL Announce >Subject: [SURBL-Announce] SURBL patches for qmail and qmail-ldap > > >Pieter Droogendijk has written patches for qmail and qmail-ldap >to support SURBLs: > *sniff* our little baby, is growing up so fast! ;) --Chris

1 0

RE: [SURBL-Discuss] What are the chances of FP on Newsletters and Order Confs.
by Chris Santerre 03 Dec '04

03 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 12:19 AM >To: Paul Schwarz >Cc: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] What are the chances of FP on Newsletters >and Order Confs. > *snip* > >In a nutshell our false positive rate is very low. Our policies >help that, and you can help by reporting any false positives >you may find to us. Our rate of false positive reports is very >low, probably less than one per day. A comment on this. This FP rate is arguable in my eyes. Anyone on the SURBL list knows Jeff and I have a difference of opinion as to what an FP is :-) (Much love for Jeff!) If a legit newsletter sends to a spamtrap, then is that truely an FP? Think about that, let it simmer, eat something, think about it some more, then answer it. (You don't have to answer that one Jeff, I know....) But we follow the SURBL contributor rules whether we like them or not. WWJD= What would Jeff do? ;) I have to admit, it bothers me that Theo's stats show the WS list in second lowest place for FPs. Damit it! We want to be the lowest FP rate of them all!!! Call it a freindly competition. We are close, so close. --Chris

1 0

RE: [SURBL-Discuss] Spammers Workaround
by Chris Santerre 03 Dec '04

03 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 2:45 AM >To: RD >Cc: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Spammers Workaround > > >On Thursday, December 2, 2004, 11:02:26 PM, RD RD wrote: >> I just thought that an additional feature for SpamcopURI to scan the >> message for a non-clickable links/domains that is present it >SURBL would >> be a nice add-on. > >SpamAssassin probably already does quite a bit of deobfuscation >to detect URIs and domains in them. I think it may look for >www.domain.com already, but I don't know about www . domain . com >You could look at the source code or ask them.... > Actually I see a nice pattern to look for. I will right an SA rule for this and post it later today for testing. But if people are stupid enough to fall for spams, then they are too stupid to remove the spaces, and these links are useless. :) --Chris (I'm a toys-r-us kid!)

1 0

Spammers Workaround
by RD 03 Dec '04

03 Dec '04

Hello List, Somehow spammers are using below's method to get around SURBL. I can create a simple body rule but might end-up having a huge list like the bigevil list. Any suggestions how to beat this type of spam? Subject: Rx Meds to go From: "zasrybf" <zasrybf(a)yahoo.com> Date: Wed, 01 Dec 2004 19:15:43 -0700 To: <Undisclosed Recipients> Total confidentiality with hundreds of different drug products in stock. Your very best prescription medications online. www. rxandyou. com (Copy and Paste this address to your browser) Thanks in advance. -RD

3 6

What are the chances of FP on Newsletters and Order Confs.
by Paul Schwarz 03 Dec '04

03 Dec '04

Hi Guys, just wondered if using SURBL will block IT Dept, HR Dept and such newsletters that people get. We get a lot of those in our depts. Also what are the chances of blocking a confirmation emails for something someone orders, etc And also Airlines Just feeling a little leery of using SURBL for a risk of false positives. Seems like a lot of newsletters outsource to companies that could look like spammers. I know it won't block and person to person email but can you help me feel more comfortable about SURBL ? Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100 www.starktruss.com

5 5

Lycos Screensaver that attacks Spammers
by Kevin A. McGrail 03 Dec '04

03 Dec '04

Below is an interesting article from The Washington Post where it details a new screensaver from Lycos. The screensaver visits websites while your computer is idle that are referenced in SPAM and make it to a bad spammers list. This is done in an attempt to limit the website ability to server traffic efficiently by causing extra traffic. While I question the 100% legality of such a tactic, it DOES make sense that we could make a SURBL site-still-online-verification-list that would cause an LWP request to URLs per incoming email. This could be used to verify that websites are still online which is valid and is done in response only to email received at your server. Perhaps this information wouldn't be used Real-time to prevent mail server delays but simply collected in the background and reported to a central service. If it has the added benefit of costing spammers extra money or slowing down their site, they should throttle their improper email outbound having a direct 1:1 correlation. Thoughts? KAM http://www.washingtonpost.com/ac2/wp-dyn/A22311-2004Nov30?language=printer Lycos Offers Program to Attack Spammers By Daniel Woolls The Associated Press Tuesday, November 30, 2004; 9:50 PM MADRID, Spain -- At the risk of breaching Internet civility, a European Web portal is offering its visitors a weapon against spam: a screensaver program that tries to choke spam servers by flooding them with junk traffic. As of Tuesday, about 65,000 people have signed up for the controversial tool from the German-based Lycos Europe, whose sites get 20 million users monthly. The company insists the technique is legal - it says the culprit servers are simply choked a bit, not completely asphyxiated - and dismissed concerns that its "Make Love not Spam" offensive can further clog the world's digital pipeline. Still, computer experts are worried. "You don't stop a bad thing by being bad yourself," said David Farber, former chief technologist at the U.S. Federal Communications Commission. "The idea of somebody coming and hitting you and you hitting back, you both end up very hurt. It just aggrevates an already serious problem." When a computer with the free Lycos screensaver is idle, the program sends junk commands to Web sites identified by Lycos as selling products pitched in spam. When done in masse, this eats up precious bandwidth, causing the sites to overload and slow down. The goal, said Lycos Europe spokesman Kay Oberbeck, is to "show the owners of such spam Web sites that there is massive interest of thousands of users who are not willing to just give up against more and more spam each day." The targets generally are not the servers used to do the actual mailings; these days, those servers are most often legitimate ones co-opted into spamming by viruses and worms. Lycos chooses its targets by reviewing lists of suspect sites identified by independent spam monitors such as SpamCop. The company said it checks each manually to make sure it genuinely carries products promoted by spam, though Oberbeck acknowledged the risk of going after a legitimate site that has been hijacked by a spam-spewing site. He said Lycos takes care not to crash spam servers altogether, ensuring that they will never go below 5 percent bandwidth. Thus, he said, the offensive isn't the same as denial-of-service attacks commonly used by hackers to incapacitate Web sites. Cyberspace activism - such as virtual sit-ins in which computer users gang together and use automated tools to flood a Web site - is not entirely new, said Dorothy Denning, a professor of defense analysis at the Navy Postgraduate School in Monterey, Calif. But in this case a for-profit company is the driving force. "The interesting question is whether or not that company might be liable under some law, and would probably be liable, certainly, at least under a lawsuit by the spammers," she said. Denning believes any impact on spamming will be minor at best. Though spam sites have to pay for bandwidth required for the extra traffic, she said, "the cost off adding extra bandwidth may be worth the reward that comes from spamming." © 2004 The Associated Press

4 5

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss