- Discuss - Mailman 3

domain "w" listed, causing problems
by John DeMillion 24 Jan '06

24 Jan '06

Not sure when this happened, but a plain "w" somehow got listed in the SURBL, at least in the text list version. I've perused the website and the list removal section, but haven't found a way of determining what the source of the "w" is, since the query tools do domain format checking and won't let me query on a plain "w". The "w" shows up in this list: http://www.surbl.org/dns-queries.blocklist.counts.txt It's in the section preceeded by the number "2". The effect of this is that domains that have a "w" in certain places generate false positives. It might be a good idea to run new domains through a simple domain format parsing check to make sure that they're basically valid before adding them to the SURBL. John DeMillion Director of Information Technology Chester County Intermediate Unit

4 3

Fw: [sniffer] Watch out... SURBL & SORBS full of large ISPs and Antispam providres.
by Darrell (support＠invariantsystems.com) 21 Jan '06

21 Jan '06

Jeff/others, Did some issue occur to cause the domains listed below to be populated in SURBL? Darrell ------------------------------------------------------------------------ Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. ----- Original Message ----- From: "Pete McNeil" <madscientist(a)microneil.com> To: <sniffer(a)sortmonster.com> Sent: Tuesday, January 17, 2006 4:27 AM Subject: [sniffer] Watch out... SURBL & SORBS full of large ISPs and Antispam providres. > Hello Sniffer Folks, > > Watch out for false positives. This morning along with the current > spam storm we discovered that SURBL and SORBs are listing a large > number of ISP domains and anti-spam service/software providers. > > As a result, many of these were tagged by our bots due to spam > arriving at our system with those domains and IPs. Most IPs and > domains for these services are coded with "nokens" in our system to > prevent this kind of thing, but a few slipped through. > > We are aggressively hunting any more that might have arrived. > > You may want to temporarily reduce the weight of the experimental IP > and experimental ad-hoc rule groups until we have identified and > removed the bad rules we don't know about yet. > > Please also do your best to report any false positives that you do > identify so that we can remove any bad rules. I don't expect that > there will be too many, but I do want to clear them out quickly if > they are there. > > Please also, if you haven't already, review the false positive > procedures: > http://www.sortmonster.com/MessageSniffer/Help/FalsePositivesHelp.html > > Pay special attention to the rule-panic procedure and feature in > case you are one of the services hit by these bad entries. > > An example of some that we've found in SURBL for example are > declude.com, usinternet.com, and w3.org > > It's not clear yet how large the problem is, but I'm sure it will be > resolved soon. > > Hope this helps, > > Thanks, > _M > > Pete McNeil (Madscientist) > President, MicroNeil Research Corporation > Chief SortMonster (www.sortmonster.com) > Chief Scientist (www.armresearch.com) > > > This E-Mail came from the Message Sniffer mailing list. For information > and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html >

11 13

Subscription questions
by martin.dibble＠altohiway.com 16 Jan '06

16 Jan '06

Hi All, Just wondering if anyone has details about subscription times to surbl. We completed the forms back mid december and got redirected to a page which confirmed the subscription request had been passed through but it may take a couple of weeks to approve. As yet I havn't heard anything since so just wondering what the normal time scales are or if there are any contact addresses I can try and contact at least to confirm the request has been received? thanks in advance, -Martin Dibble Internal Network Engineer altoHiway Ltd The content of this email and any attachments is confidential,and is intended only for the addressees. If you are not the intended recipient you may not use, distribute, disclose or copy the contents. If you have been sent this email in error please forward it to notify(a)altohiway.com and destroy the original. Any opinions expressed within this email are those of the sender and do not necessarily represent the opinion of altoHiway Ltd. Any prices quoted in this email and any attachments are subject to VAT, valid for 30 days and subject to altohiways standard Terms and Conditions of business. E and OE. This email has been checked for virus content by the altoHiway Mailcontroller service. However, it is the responsibility of the recipient to ensure that the contents of this email are virus free. altoHiway Ltd. accept no liability for any loss or damage arising from the contents of this email.

1 0

RE: Google search as spam URI
by Chris Santerre 10 Jan '06

10 Jan '06

> -----Original Message----- > From: Dhawal Doshy [mailto:dhawal@netmagicsolutions.com] > Sent: Wednesday, January 04, 2006 3:01 PM > To: Dallas L. Engelken > Cc: Jeff Chan; SpamAssassin Users; SURBL Discuss > Subject: Re: Google search as spam URI > > > Dallas L. Engelken writes: > > > adding a redirector_pattern will catch this. > > > > redirector_pattern > > > /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9 > \-\.]+)$/I > > better write a rule for google translate as well.. i see it > being abused > soon. > > http://translate.google.com/translate?u=www.domain.tld&langpai r=en%7Cen&hl=e n Hah! Am I reading that right? Translate English to English! I give them 1 point for coming up with that one. --Chris

2 1

RE: Google search as spam URI
by Dallas L. Engelken 04 Jan '06

04 Jan '06

adding a redirector_pattern will catch this. redirector_pattern /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9\-\.]+)$/I dbg: uri: parsed uri found, http://www.google.com/search?q=site:bluevallet.com dbg: uri: cleaned parsed uri, http://bluevallet.com dbg: uri: cleaned parsed uri, http://www.google.com/search?q=site:bluevallet.com dbg: uri: cleaned parsed uri, bluevallet.com dbg: uri: parsed domain, google.com dbg: uri: parsed domain, bluevallet.com dbg: uridnsbl: domain google.com in skip list dbg: uridnsbl: domains to query: bluevallet.com dbg: uri: running uri tests; score so far=-0.001 dbg: rules: ran uri rule __LOCAL_PP_NONPPURL ======> got hit: "http://bluevallet.com" dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: domain "bluevallet.com" listed (URIBL_BLACK): 127.0.0.2 dbg: uridnsbl: query for bluevallet.com took 1 seconds to look up (multi.uribl.com.:bluevallet.com) dbg: uridnsbl: queries completed: 1 started: 0 dbg: uridnsbl: queries active: DNSBL=1 NS=1 at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: domain "bluevallet.com" listed (URIBL_SC_SURBL): 127.0.0.2 dbg: uridnsbl: query for bluevallet.com took 1 seconds to look up (multi.surbl.org.:bluevallet.com) dbg: uridnsbl: queries completed: 1 started: 0 dbg: uridnsbl: queries active: NS=1 at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: waiting 2 seconds for URIDNSBL lookups to complete dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: queries completed: 1 started: 2 dbg: uridnsbl: queries active: at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: queries completed: 1 started: 1 dbg: uridnsbl: queries active: A=1 at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: queries completed: 1 started: 1 dbg: uridnsbl: queries active: DNSBL=1 at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: domain "bluevallet.com" listed (URIBL_SBL): "http://www.spamhaus.org/SBL/sbl.lasso?query=SBL36468" dbg: uridnsbl: domain "bluevallet.com" listed (URIBL_SBL): "http://www.spamhaus.org/SBL/sbl.lasso?query=SBL36335" dbg: uridnsbl: query for bluevallet.com took 1 seconds to look up (sbl.spamhaus.org.:17.160.20.58) dbg: uridnsbl: queries completed: 1 started: 0 dbg: uridnsbl: queries active: DNSBL=1 at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: select found 1 socks ready dbg: uridnsbl: domain "bluevallet.com" listed (URIBL_SBL): "http://www.spamhaus.org/SBL/sbl.lasso?query=SBL36470" dbg: uridnsbl: query for bluevallet.com took 1 seconds to look up (sbl.spamhaus.org.:7.134.11.221) dbg: uridnsbl: queries completed: 1 started: 0 dbg: uridnsbl: queries active: at Wed Jan 4 08:26:42 2006 dbg: uridnsbl: done waiting for URIDNSBL lookups to complete dbg: uri: running uri tests; score so far=9.972 dbg: uri: running uri tests; score so far=7.11254545454546 Thanks, Dallas > -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Wednesday, January 04, 2006 3:56 AM > To: SpamAssassin Users; SURBL Discuss > Subject: Google search as spam URI > > This drug spam message body seems problematic, since the URI is > google, being used to search for the spammer's. Naturally the > actual spammer domain bluevallet.com is blacklisted. This > showed up Tue, 03 Jan 2006 14:45:48 +0100 > > __ > > > Proecia > Xana > Pail > VALIM from $1.21 > IAGRA from $3.33 > IALIS from $3.75 > eridia > Abien > Soa > Levtra > =20 > http://www.google.com/search?q=3Dsite:bluevallet.com > <http://www.google.com/search?q=3Dsite:bluevallet.com>=20 > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 > Transitional//EN"> <HTML><HEAD> <META > http-equiv=3DContent-Type content=3D"text/html; = > charset=3Dus-ascii"> <META content=3D"MSHTML 6.00.2800.1106" > name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY > bgColor=3D#ffffff> <DIV><FONT face=3DArial size=3D3>Pro<IMG = > src=3D"cid:000101c6106b$c54633bd$66c5a8c0@printingmachine">eci a</FONT></DIV> > <DIV><FONT face=3DArial size=3D3>Xana<IMG = > src=3D"cid:000201c6106b$c54633bd$66c5a8c0@printingmachine"></F ONT></DIV> > <DIV><FONT face=3DArial size=3D3>Pa<IMG = > src=3D"cid:000201c6106b$c54633bd$66c5a8c0@printingmachine">il< /FONT></DIV> > <DIV><FONT face=3DArial size=3D3>VALI<IMG = > src=3D"cid:000301c6106b$c54633bd$66c5a8c0@printingmachine">M > <STRONG>from = $1.21</STRONG></FONT></DIV> <DIV><FONT > face=3DArial size=3D3><IMG = > src=3D"cid:000401c6106b$c54633bd$66c5a8c0@printingmachine">IAG RA <STRONG>from = $3.33</STRONG></FONT></DIV> <DIV><FONT face=> 3DArial size=3D3><IMG = > src=3D"cid:000501c6106b$c54633bd$66c5a8c0@printingmachine">IAL IS <STRONG>from = $3.75</STRONG></FONT></DIV> <DIV><FONT face=> 3DArial size=3D3><IMG = > src=3D"cid:000601c6106b$c54633bd$66c5a8c0@printingmachine">eri dia</FONT></DIV> > <DIV><FONT face=3DArial size=3D3>A<IMG = > src=3D"cid:000701c6106b$c54633bd$66c5a8c0@printingmachine">bie n</FONT></DIV> > <DIV><FONT face=3DArial size=3D3>So<IMG = > src=3D"cid:000701c6106b$c54633bd$66c5a8c0@printingmachine">a</ FONT></DIV> > <DIV><FONT face=3DArial size=3D3>Lev<IMG = > src=3D"cid:000801c6106b$c54633bd$66c5a8c0@printingmachine">tra </FONT></DIV> > <DIV><FONT face=3DArial size=3D3></FONT> </DIV> > <DIV><FONT face=3DArial size=3D3><A = > href=3D"http://www.google.com/search?q=3Dsite:bluevallet.com"> <FONT = face=3DArial = size=3D3>http://www.google.com/search?q=> 3Dsite:bluevallet.com</FONT></A><= > /FONT></DIV></BODY></HTML> > R0lGODdhDQAMAOMAAP///wUTCMDEwWJrZCQwJt/h4KGmooKJg0NORQAAAAAAAA > AAAAAAAAAAAAAA > AAAAACwAAAAADQAMAAAEMRBIMUggo8htiNFFp0kFMW4Hsg3HtoWb6c5SQNP27c > q6xN6GF4/TQnlA > KZoAEbgUJREAOw== > R0lGODdhDgAZAOMAAP///wUCDkNBSqGgpN/f4CQhLIKAhmJgaMC/wgAAAAAAAA > AAAAAAAAAAAAAA > AAAAACwAAAAADgAZAAAESxDISau9OOvNu/9gKHLCcA3CFAhERRSBOhiVYcRSXF > QFgQOxg0kyOABV > AERKIkAcc5Jecvd8GowHWhX36kK/gIPACP4hAs4yhfyNAAA7 > R0lGODdhDQAXAMIAAP///wANER8rLt/g4V9nar/Cw5+kpQAAACwAAAAADQAXAA ADMgi63P4wykmr > vRiGt1dvHxB6zKiEplhyq4Oyi+AM8kIUjUEwtDEAA4PgxyMIAgICUZEAADs= > R0lGODdhDAAVAOMAAP///wgOEMHCwyYsLYOGh2RoaeDg4aKkpUVKSwAAAAAAAA > AAAAAAAAAAAAAA > AAAAACwAAAAADAAVAAAENhDISau9OOvNu5/CcA2CRFbhRBRVQUyGSAUGVRzTga > C7hJSVQS12IbyM > F6IQg9BlDgNcRkaJAAA7 > R0lGODdhBQANAIAAAP///w0KDywAAAAABQANAAACDIQfp2uJ6hqcr0pTAAA7 > R0lGODdhDgANAMIAAP///xIJC6aioy8nKcPBwk1GSOHg4IiEhSwAAAAADgANAA > ADJwi63P4wShXE > CIPYUFcoBnB8oRB4hBdSHnO2LBwD70zLt1zn8+4rCQA7 > R0lGODdhCgAVAOMAAP///xMPD6alpTAtLcTDw2tpaeHh4YmHh05LSwAAAAAAAA > AAAAAAAAAAAAAA > AAAAACwAAAAACgAVAAAELRDISau9OOvNu/9AIAzBQFCBCBDmpEpC4RqTMbhVMN > e39AIxV4tF8x1I > iCIgAgA7 > R0lGODdhCQAVAMIAAP///wQKA2JlYaCjoN/g3yMoIgAAAAAAACwAAAAACQAVAA > ADJQi63P4wykmr > XWKsIRQpBPCFCgdkjaA6REAyaseYqAeK96mVcgIAOw== > > __ > > SpamAssassin 3.0.1 did not catch this one, though the sender > IP was on the SpamCop BL (that was all it caught). > > Jeff C. > -- > Don't harm innocent bystanders. > >

3 2

RE: Google search as spam URI
by Matthew.van.Eerde＠hbinc.com 04 Jan '06

04 Jan '06

Dallas L. Engelken wrote: >> From: Dallas L. Engelken [mailto:dallase@nmgi.com] >> >> /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9 >> \-\.]+)$/I >> > > Notice the 'I' at the end should be 'i'. > Damn outlook, Agreed. > I know what I want to say! Have you configured Outlook to use Word as the email editor? If so that might explain the AutoCorrect you are experiencing. -- Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer

2 1

RE: Google search as spam URI
by Dallas L. Engelken 04 Jan '06

04 Jan '06

> -----Original Message----- > From: Martin Hepworth [mailto:martinh@solid-state-logic.com] > Sent: Wednesday, January 04, 2006 10:36 AM > To: Dallas L. Engelken; 'Jeff Chan'; 'SpamAssassin Users'; > 'SURBL Discuss' > Subject: RE: Google search as spam URI > > Dallas > > Small change required for my to lint cleanly... > > redirector_pattern > /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9 > \-\.]+)$/i > > (lower case letter I at the end, not uppercase/capitol I) > Arghhhh.. Did you miss this? >> Notice the 'I' at the end should be 'i'. Damn outlook, I know what I want to say! >> D Or am I the one that's missing something?? D

1 0

RE: Google search as spam URI
by Dallas L. Engelken 04 Jan '06

04 Jan '06

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Wednesday, January 04, 2006 3:56 AM > To: SpamAssassin Users; SURBL Discuss > Subject: Google search as spam URI > > This drug spam message body seems problematic, since the URI is > google, being used to search for the spammer's. Naturally the > actual spammer domain bluevallet.com is blacklisted. This > showed up Tue, 03 Jan 2006 14:45:48 +0100 > > __ Also FWIW, we auto-listed bluevallet.com on black.uribl.com at bluevallet.com Listed: 2006-01-03 06:38:02 CDT (-0500 UTC) What I'm wondering is "how", since this shouldn't be showing up in the dns query stream if people were not using the google redirector pattern.... D

2 1

RE: Google search as spam URI
by Chris Santerre 04 Jan '06

04 Jan '06

> -----Original Message----- > From: Dallas L. Engelken [mailto:dallase@nmgi.com] > Sent: Wednesday, January 04, 2006 9:30 AM > To: Jeff Chan; SpamAssassin Users; SURBL Discuss > Subject: RE: Google search as spam URI > > > adding a redirector_pattern will catch this. > > redirector_pattern > /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9 > \-\.]+)$/I > > > Thanks, > Dallas Should this be a standard redirect added to SA or should SARE add the a rule to 70_Specific.cf? Also I don't know how it got added to URIBL, as the only NANAS hits show them using this redir. --Chris

1 0

RE: Google search as spam URI
by Dallas L. Engelken 04 Jan '06

04 Jan '06

> -----Original Message----- > From: Dallas L. Engelken [mailto:dallase@nmgi.com] > Sent: Wednesday, January 04, 2006 8:30 AM > To: Jeff Chan; SpamAssassin Users; SURBL Discuss > Subject: RE: Google search as spam URI > > adding a redirector_pattern will catch this. > > redirector_pattern > /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9 > \-\.]+)$/I > Notice the 'I' at the end should be 'i'. Damn outlook, I know what I want to say! D

1 0

Google search as spam URI
by Jeff Chan 04 Jan '06

04 Jan '06

This drug spam message body seems problematic, since the URI is google, being used to search for the spammer's. Naturally the actual spammer domain bluevallet.com is blacklisted. This showed up Tue, 03 Jan 2006 14:45:48 +0100 __ Proecia Xana Pail VALIM from $1.21 IAGRA from $3.33 IALIS from $3.75 eridia Abien Soa Levtra =20 http://www.google.com/search?q=3Dsite:bluevallet.com <http://www.google.com/search?q=3Dsite:bluevallet.com>=20 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"> <META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT face=3DArial size=3D3>Pro<IMG = src=3D"cid:000101c6106b$c54633bd$66c5a8c0@printingmachine">ecia</FONT></DIV> <DIV><FONT face=3DArial size=3D3>Xana<IMG = src=3D"cid:000201c6106b$c54633bd$66c5a8c0@printingmachine"></FONT></DIV> <DIV><FONT face=3DArial size=3D3>Pa<IMG = src=3D"cid:000201c6106b$c54633bd$66c5a8c0@printingmachine">il</FONT></DIV> <DIV><FONT face=3DArial size=3D3>VALI<IMG = src=3D"cid:000301c6106b$c54633bd$66c5a8c0@printingmachine">M <STRONG>from = $1.21</STRONG></FONT></DIV> <DIV><FONT face=3DArial size=3D3><IMG = src=3D"cid:000401c6106b$c54633bd$66c5a8c0@printingmachine">IAGRA <STRONG>from = $3.33</STRONG></FONT></DIV> <DIV><FONT face=3DArial size=3D3><IMG = src=3D"cid:000501c6106b$c54633bd$66c5a8c0@printingmachine">IALIS <STRONG>from = $3.75</STRONG></FONT></DIV> <DIV><FONT face=3DArial size=3D3><IMG = src=3D"cid:000601c6106b$c54633bd$66c5a8c0@printingmachine">eridia</FONT></DIV> <DIV><FONT face=3DArial size=3D3>A<IMG = src=3D"cid:000701c6106b$c54633bd$66c5a8c0@printingmachine">bien</FONT></DIV> <DIV><FONT face=3DArial size=3D3>So<IMG = src=3D"cid:000701c6106b$c54633bd$66c5a8c0@printingmachine">a</FONT></DIV> <DIV><FONT face=3DArial size=3D3>Lev<IMG = src=3D"cid:000801c6106b$c54633bd$66c5a8c0@printingmachine">tra</FONT></DIV> <DIV><FONT face=3DArial size=3D3></FONT> </DIV> <DIV><FONT face=3DArial size=3D3><A = href=3D"http://www.google.com/search?q=3Dsite:bluevallet.com"><FONT = face=3DArial = size=3D3>http://www.google.com/search?q=3Dsite:bluevallet.com</FONT></A><= /FONT></DIV></BODY></HTML> R0lGODdhDQAMAOMAAP///wUTCMDEwWJrZCQwJt/h4KGmooKJg0NORQAAAAAAAAAAAAAAAAAAAAAA AAAAACwAAAAADQAMAAAEMRBIMUggo8htiNFFp0kFMW4Hsg3HtoWb6c5SQNP27cq6xN6GF4/TQnlA KZoAEbgUJREAOw== R0lGODdhDgAZAOMAAP///wUCDkNBSqGgpN/f4CQhLIKAhmJgaMC/wgAAAAAAAAAAAAAAAAAAAAAA AAAAACwAAAAADgAZAAAESxDISau9OOvNu/9gKHLCcA3CFAhERRSBOhiVYcRSXFQFgQOxg0kyOABV AERKIkAcc5Jecvd8GowHWhX36kK/gIPACP4hAs4yhfyNAAA7 R0lGODdhDQAXAMIAAP///wANER8rLt/g4V9nar/Cw5+kpQAAACwAAAAADQAXAAADMgi63P4wykmr vRiGt1dvHxB6zKiEplhyq4Oyi+AM8kIUjUEwtDEAA4PgxyMIAgICUZEAADs= R0lGODdhDAAVAOMAAP///wgOEMHCwyYsLYOGh2RoaeDg4aKkpUVKSwAAAAAAAAAAAAAAAAAAAAAA AAAAACwAAAAADAAVAAAENhDISau9OOvNu5/CcA2CRFbhRBRVQUyGSAUGVRzTgaC7hJSVQS12IbyM F6IQg9BlDgNcRkaJAAA7 R0lGODdhBQANAIAAAP///w0KDywAAAAABQANAAACDIQfp2uJ6hqcr0pTAAA7 R0lGODdhDgANAMIAAP///xIJC6aioy8nKcPBwk1GSOHg4IiEhSwAAAAADgANAAADJwi63P4wShXE CIPYUFcoBnB8oRB4hBdSHnO2LBwD70zLt1zn8+4rCQA7 R0lGODdhCgAVAOMAAP///xMPD6alpTAtLcTDw2tpaeHh4YmHh05LSwAAAAAAAAAAAAAAAAAAAAAA AAAAACwAAAAACgAVAAAELRDISau9OOvNu/9AIAzBQFCBCBDmpEpC4RqTMbhVMNe39AIxV4tF8x1I iCIgAgA7 R0lGODdhCQAVAMIAAP///wQKA2JlYaCjoN/g3yMoIgAAAAAAACwAAAAACQAVAAADJQi63P4wykmr XWKsIRQpBPCFCgdkjaA6REAyaseYqAeK96mVcgIAOw== __ SpamAssassin 3.0.1 did not catch this one, though the sender IP was on the SpamCop BL (that was all it caught). Jeff C. -- Don't harm innocent bystanders.

1 0

RE: [SURBL-Discuss] The (bad) situation with Yahoo / Geocities.
by Guy Rosen 25 Dec '05

25 Dec '05

We've been compiling and reporting lists of GeoCities sites and from here too it seems GeoCities isn't handling them well. We compile lists based on spam reports from our user community, and at one point we even found around 3,500 (!) live GeoCities spam sites. Eric, do you know that GeoCities were monitoring your list specifically, or might they have just shut down a lot of sites that day, regardless of your list? Guy Rosen Lead Analyst, Operations Team Blue Security http://www.bluesecurity.com/ Tel: +972-9-9577736 x228 AIM: guyrrosen (double R) -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Eric Montr?al Sent: Wednesday, December 21, 2005 23:32 To: SURBL Discussion list Subject: [SURBL-Discuss] The (bad) situation with Yahoo / Geocities. Hi, It seems like people who were not too optimistic when the number of active spamming sites on Geocities dropped from more than 300 to 14 on Friday were unfortunately right. Yahoo / Geocities did not make anything to prevent spammers from (ab)using their service and only used the list once to remove their (old and unused) spam related sites, but did nothing to prevent spammers from building new spammy sites all over again. Today, Geocities still makes the bulk of spammy sites on the list (total 368) and in the last 2 days, they only closed down 6 of them, that's below 2% ! One thing we learned last friday is that Yahoo / Geocities are not only fully aware of the situation, but they are monitoring this list. Here is the current active list: http://nospam.mailpeers.net/alive_spammy.txt I thought maybe it's difficult to detect those sites, maybe spammers are very crafty and make it hard to separate their redirection pages from other non spammy pages, so I started analyzing the pages content and here is what I found: - More than 95% of Geocities spammy sites are redirections (the balance being 'click here' manual redirections). - there is a surprisingly low number of variation in those redirection scripts - The more spammy tries to obfuscate his scripts, the more the signs are evident and easy to detect. - only 11 rules have detected *all* redirection scripts to this date. - Non redirection sites are simply detected by the URIs they contain (blacklist now, I hope to add SURBL support soon). - hometown.aol.com *DOES NOT USE ANTIVIRUS !* on their user data. As a result, they end up being a malware hosting heaven ! (even if they remove some of them when they get complaints) http://nospam.mailpeers.net/alive_spammy_malware.txt - hometown.aol.com non malware sites are *all* using the same randomized redirection script - tripod.com seems to be handling the problem perfectly (unless my sampling is severely biased, send me more) and in the rare cases where a spammer tries to use them, the spammy site is usually shutdown before I list it. Fight the spammies, and they'll move away. Why are the others not doing the same ? You'll find the complete analysis results for all alive spammy sites on this page (updated regularly): http://nospam.mailpeers.net/alive_spammy2.txt I also added http://nospam.mailpeers.net/fresh_alive_spammy.txt that lists the most recent entries (first one is the most recent). These sites are actively used in current spam runs (The ones you *really* want down !) In cases where spammy does not encrypt his redirector, extracting the real target URL behind the redirector is a piece of cake. They end up here, along with blacklisted ones, in http://nospam.mailpeers.net/spammy_targets.txt (with country code) Some of them (but not all) are already listed in SURBL. BTW, is there a script (bash, perl, whatever) that simply decodes URIs and query SURBL ? I won't distribute the rules, since their effectiveness would be immediately impaired, but if the Yahoo guy or the AOL guy want them, I'd be glad to share... however, at least for Yahoo/Geocities, I have no illusions. The very low number of variation makes me wonder. Is it because all spammers use the same spamware to generate their redirection pages, or are only a selected few of them 'allowed' to (ab)use Geocities for their redirection needs ? ------------ So, what's next ? hometown.aol.com is actually shutting down some sites, but it's too few, too late. They need to be more proactive. the worst problem with their service being the presence of malware. A list member sent me a reporting address for hometown.aol.com abuses, I'll see if it works, and if so, it will become automatic. Yahoo/Geocities is a different beast. After months of well known abuse and minimal action, I think they deserve being treated as a spam ressource provider. Just like other spam ressource providers, they can get away with it just as long as their regular customers are not aware of their activities. Their parent company being Yahoo, it's completely useless to complain to their upstream ;-) but they have to protect Yahoo's corporate image. If yahoo sees a serious risk that their name will be associated with spam support / illegal activities, a *real* change will occur. I think I've done my homework collecting enough proof of Yahoo/Geocities's refusal to stop the spam support activities taking place on their network and that it could be used as a starting point in gathering enough evidence (+insiders info?) to issue a well researched press release. Obviously, since (as you might have noticed !) English is not my main language and I'm not familiar with the press, this is a call for volunteers for the additional data collection and redaction work. Regards, Eric ------------ PS-1: If you operate Spamassassin 3.xx, you can share all the Geocities / AOL / tripod URIs in the messages going through your server in near real time. All it takes is a 4 lines patch in URIDNSBL.pm and a simple cron job. PS-2:I'd like to have independent third party daily backups of the whole nospam.mailpeers.net subdomain. It's small, and a simple wget -r -w3 would do. If you want to do it, email me so that I'm aware of it. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

4 3

The (bad) situation with Yahoo / Geocities.
by Eric Montréal 23 Dec '05

23 Dec '05

Hi, It seems like people who were not too optimistic when the number of active spamming sites on Geocities dropped from more than 300 to 14 on Friday were unfortunately right. Yahoo / Geocities did not make anything to prevent spammers from (ab)using their service and only used the list once to remove their (old and unused) spam related sites, but did nothing to prevent spammers from building new spammy sites all over again. Today, Geocities still makes the bulk of spammy sites on the list (total 368) and in the last 2 days, they only closed down 6 of them, that's below 2% ! One thing we learned last friday is that Yahoo / Geocities are not only fully aware of the situation, but they are monitoring this list. Here is the current active list: http://nospam.mailpeers.net/alive_spammy.txt I thought maybe it's difficult to detect those sites, maybe spammers are very crafty and make it hard to separate their redirection pages from other non spammy pages, so I started analyzing the pages content and here is what I found: - More than 95% of Geocities spammy sites are redirections (the balance being 'click here' manual redirections). - there is a surprisingly low number of variation in those redirection scripts - The more spammy tries to obfuscate his scripts, the more the signs are evident and easy to detect. - only 11 rules have detected *all* redirection scripts to this date. - Non redirection sites are simply detected by the URIs they contain (blacklist now, I hope to add SURBL support soon). - hometown.aol.com *DOES NOT USE ANTIVIRUS !* on their user data. As a result, they end up being a malware hosting heaven ! (even if they remove some of them when they get complaints) http://nospam.mailpeers.net/alive_spammy_malware.txt - hometown.aol.com non malware sites are *all* using the same randomized redirection script - tripod.com seems to be handling the problem perfectly (unless my sampling is severely biased, send me more) and in the rare cases where a spammer tries to use them, the spammy site is usually shutdown before I list it. Fight the spammies, and they'll move away. Why are the others not doing the same ? You'll find the complete analysis results for all alive spammy sites on this page (updated regularly): http://nospam.mailpeers.net/alive_spammy2.txt I also added http://nospam.mailpeers.net/fresh_alive_spammy.txt that lists the most recent entries (first one is the most recent). These sites are actively used in current spam runs (The ones you *really* want down !) In cases where spammy does not encrypt his redirector, extracting the real target URL behind the redirector is a piece of cake. They end up here, along with blacklisted ones, in http://nospam.mailpeers.net/spammy_targets.txt (with country code) Some of them (but not all) are already listed in SURBL. BTW, is there a script (bash, perl, whatever) that simply decodes URIs and query SURBL ? I won't distribute the rules, since their effectiveness would be immediately impaired, but if the Yahoo guy or the AOL guy want them, I'd be glad to share... however, at least for Yahoo/Geocities, I have no illusions. The very low number of variation makes me wonder. Is it because all spammers use the same spamware to generate their redirection pages, or are only a selected few of them 'allowed' to (ab)use Geocities for their redirection needs ? ------------ So, what's next ? hometown.aol.com is actually shutting down some sites, but it's too few, too late. They need to be more proactive. the worst problem with their service being the presence of malware. A list member sent me a reporting address for hometown.aol.com abuses, I'll see if it works, and if so, it will become automatic. Yahoo/Geocities is a different beast. After months of well known abuse and minimal action, I think they deserve being treated as a spam ressource provider. Just like other spam ressource providers, they can get away with it just as long as their regular customers are not aware of their activities. Their parent company being Yahoo, it's completely useless to complain to their upstream ;-) but they have to protect Yahoo's corporate image. If yahoo sees a serious risk that their name will be associated with spam support / illegal activities, a *real* change will occur. I think I've done my homework collecting enough proof of Yahoo/Geocities's refusal to stop the spam support activities taking place on their network and that it could be used as a starting point in gathering enough evidence (+insiders info?) to issue a well researched press release. Obviously, since (as you might have noticed !) English is not my main language and I'm not familiar with the press, this is a call for volunteers for the additional data collection and redaction work. Regards, Eric ------------ PS-1: If you operate Spamassassin 3.xx, you can share all the Geocities / AOL / tripod URIs in the messages going through your server in near real time. All it takes is a 4 lines patch in URIDNSBL.pm and a simple cron job. PS-2:I'd like to have independent third party daily backups of the whole nospam.mailpeers.net subdomain. It's small, and a simple wget -r -w3 would do. If you want to do it, email me so that I'm aware of it.

4 4

Re: [SURBL-Discuss] Re: One way to handle the Geocities spam
by Joe Zitnik 19 Dec '05

19 Dec '05

I like it. While it hasn't completely nuked the geocities spam we were seeing, it has put a significant dent in it. >>> warren_ro(a)compuserve.com 12/13/2005 12:33 am >>> Hi All, Any feedback on how effective this is ? Regards Warren ----- Original Message ----- From: "Eric Montréal" <erv(a)mailpeers.net> To: "Jeff Chan" <jeffc(a)surbl.org>; "SURBL Discussion list" <discuss(a)lists.surbl.org> Sent: Sunday, December 04, 2005 11:57 AM Subject: Re: [SURBL-Discuss] Re: One way to handle the Geocities spam > > Jeff Chan wrote: > >>On Friday, December 2, 2005, 3:31:41 PM, Eric Montréal wrote: >> >>>I've >>>made my own >>>auto-generated spamassassin rules for both Geocities and Tripod spam. >>> >>>This list is similar in it's principles to the good old BigEvilList ... >>> >>>You can download and test it from there: http://nospam.mailpeers.net/ >>> >>>Feedback appreciated (good or bad, in or outside of the list) ... >>> >> >>This would work, but it could be somewhat difficult to maintain >> > The list generation / maintenance is somewhat automated and will be even > more if > there is enough interest for it. > > What I would need now is a broader set of URLs, since I only have a > partial view of > what's going on at a global level. > >>and distribute. >> > Not sure what you mean by distribution, but if successful, it might need > mirrors. > >> Note that that doesn't mean I think it's a bad >>idea. Anything that reasonably stops spam is a positive IMO. >> >> > Should work as the BigEvil list worked ... until it became too big and you > found a way > to solve the problem ... > > In the meantime those rules are easy to add and don't require any change > in Spamassassin. > >>Jeff C. >>-- >>Don't harm innocent bystanders. >> > I'll do my best ;-) > > Eric > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss > _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

5 7

WebRedirect SpamAssassin Plugin for use with 'Geocities Spam'
by Daryl C. W. O'Shea 17 Dec '05

17 Dec '05

I was planning on giving Yahoo! more time to correct their "Geocities Spam" problem before I released my plugin to deal with it, but I've been noticing a decline in the scores these mails are getting. I also just found out that I have copies of this sort of spam going back to at least December 28, 2004 and have been getting them in volume since May 2005. I had thought it only went back to September and not back an entire year with increasing volume (10%+ of my spam is now "geocities spam") in the last six months. In my opinion they've had sufficient time to act. Further, while adding some documentation to the plugin, I tested some of the spam I used to write the plugin back in September and found that some of the "member sites" are still active. Conveniently, there are only a few versions of the pages linked to, so writing rules against them is pretty effective -- which is what this plugin is for. A few words of caution if you do decide to use this plugin: - While I believe there are no issues with the code, I'm not too familiar with LWP::UserAgent, so it's entirely possible that I have missed something. In the event your machine gets rooted, you've been warned. - Query the links found in an email inherently has a number of privacy and technical issues you should be aware of. The plugin attempts to avoid them by stripping visible query strings and login credentials, but I encourage you to read the WARNING section of the plugin's perldoc before using it. Be sure to NEVER use this plugin to query links hosted on a server the sender may control. - High volume sites would be wise to run this behind a caching HTTP proxy such as Squid to reduce the 0.3 to 1 second that it may take to query each link. While the web query is blocking, it takes place just after the DNS requests are kicked off, so it gives the DNS queries more time to complete which may result in DNSBL hits that may have been missed due to timeouts. - The scores assigned to the rules are guesses on my part based on what they match. I have no legitimate email to compare hits against. I recommend monitoring the hits for some period of time and reassigning scores if necessary or not to your liking. The plugin is available at: http://wiki.apache.org/spamassassin/WebRedirectPlugin Send me an email if you find the plugin useful or spot a flaw that should be corrected. Best Regards, Daryl C. W. O'Shea

5 5

RE: [SURBL-Discuss] 'Geocities Spam' ... a miracle ?
by Kristopher Austin 17 Dec '05

17 Dec '05

I had 8 as ok, 7 as 301, all the rest were 403 and 404. Kris > -----Original Message----- > From: discuss-bounces(a)lists.surbl.org [mailto:discuss- > bounces(a)lists.surbl.org] On Behalf Of Eric Montréal > Sent: Friday, December 16, 2005 3:59 AM > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] 'Geocities Spam' ... a miracle ? > > wget http://nospam.mailpeers.net/rip_spammy.txt -Orip.txt;for i in > $(egrep -i > '^http:[0-9a-z\/_\-\.]*\bgeocities\b[0-9a-z\/_\-\.]*$'<rip.txt);do echo > -n "$i - ";wget -T3 -t3 -w3 --spider -U"Mozilla/4.0 (compatible; MSIE > 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" $i 2>&1|grep > 'awaiting'|cut -d'.' -f4|cut -d' ' -f2-;done;rm -f rip.txt > > Are they all 403 or 404 ?

2 1

Re: [SURBL-Discuss] 'Geocities Spam' ... a miracle ?
by List Mail User 16 Dec '05

16 Dec '05

>... >Hi, > >Looks like, after months ignoring the problem, a miracle finally >happened at Yahoo / Geocities tonight ... > >Yesterday, my list of alive Geocities spammy sites was more than 350 >names long. > >Tonight it's down to ... 14 Geocities sites ! All others have been shutdown >... Let us hope that some proactive mechanism is now shutting them down, and that hometown.aol.com doesn't pickup all the slack (where I've been seen them from recently). The worse case would have been if they just downloaded your list and checked and shut those - the 14 left implies that some other means was used (which is by far preferable). Paul Shupak track(a)plectere.com

2 1

RE: [SURBL-Discuss] 'Geocities Spam' ... a miracle ?
by Chris Santerre 16 Dec '05

16 Dec '05

> -----Original Message----- > From: List Mail User [mailto:track@plectere.com] > Sent: Friday, December 16, 2005 7:47 AM > To: discuss(a)lists.surbl.org > Cc: track(a)plectere.com > Subject: Re: [SURBL-Discuss] 'Geocities Spam' ... a miracle ? > > > >... > >Hi, > > > >Looks like, after months ignoring the problem, a miracle finally > >happened at Yahoo / Geocities tonight ... > > > >Yesterday, my list of alive Geocities spammy sites was more than 350 > >names long. > > > >Tonight it's down to ... 14 Geocities sites ! All others > have been shutdown > >... > > Let us hope that some proactive mechanism is now shutting them > down, and that hometown.aol.com doesn't pickup all the slack > (where I've > been seen them from recently). The worse case would have been if they > just downloaded your list and checked and shut those - the 14 > left implies > that some other means was used (which is by far preferable). > SWEEET!! +1 on the aol! This is a good day! --Chris

1 0

One way to handle the Geocities spam
by John Graham-Cumming 15 Dec '05

15 Dec '05

How about transforming a Geocities URL into a DNS query like this: http://uk.geocities.com/xyz/ becomes xyz.geocities.com.multi.surbl.org And then we could SURBL check the individual pages within Geocities. In a way geocities.com is just another TLD. John. -- John Graham-Cumming jgc(a)jgc.org Home: http://www.jgc.org/ Blog: http://www.jgc.org/blog/ POPFile: http://getpopfile.org/ GNU Make Standard Library: http://gmsl.sf.net/ GNU Make Debugger: http://gmd.sf.net/ Fast, Parallel Builds: http://www.electric-cloud.com/ Sign up for my Spam and Anti-spam Newsletter at http://www.jgc.org/

9 18

RE: [SURBL-Discuss] Possible FP...
by Chris Santerre 12 Dec '05

12 Dec '05

> -----Original Message----- > From: Alex Broens [mailto:surbl@alexb.ch] > Sent: Monday, December 12, 2005 10:07 AM > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] Possible FP... > > > Chris Santerre wrote: > > 2.0 URIBL_WS_SURBL Contains an URL listed in the > WS SURBL blocklist > > [URIs: promoreply .com] > > > > I'm not sure on the history of this domain. It was marked in a legit > > subscribed newsletter from one of my users. Doesn't mean it > isn't a spammer > > however. If anyones got some good evidence, I'll gladly > contact the legit > > newsletter and tell them not to use them. > > > > This domain was hosting all the images in the legit HTML email. > > Chris > > sorta curious... > > What was the newsletter domain? > > I have promoreply. com listed locally since Jan 2005 (no > more evidence > from back then) roadrunnersports.com I think they recently started using this listed domain to host images. Because the user has been subscribed for a long time (Greater then 3 yrs). I *think* this is the first time they have hit a URIBL list. --Chris

2 1

Possible FP...
by Chris Santerre 12 Dec '05

12 Dec '05

2.0 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: promoreply .com] I'm not sure on the history of this domain. It was marked in a legit subscribed newsletter from one of my users. Doesn't mean it isn't a spammer however. If anyones got some good evidence, I'll gladly contact the legit newsletter and tell them not to use them. This domain was hosting all the images in the legit HTML email. Chris Santerre SysAdmin and SARE/URIBL ninja http://www.uribl.com http://www.rulesemporium.com

2 1

surbl false positive?
by mouss 09 Dec '05

09 Dec '05

Hi all, Is there a reason why mobileav-DEMUNGED.org is listed on surbl? I checked their site, and it doesn't seem to be a spam site.

1 0

How can I test SURBL is working?
by List 21 Nov '05

21 Nov '05

Hi, I have 1) [root@beyond ~]# rpm -q caching-nameserver caching-nameserver-7.3-3 2) Net::DNS is up to date. 3) /usr/bin/perl -T -w /usr/bin/spamd -L -x -u vpopmail Running on FC4 with SpamAssassin 3.10, init.pre has loadplugin Mail::SpamAssassin::Plugin::URIDNSBL How do i test SA is running with SURBL. I dont see any hit on any email since the day(6 months now) i had installed SA. Best regards

2 1

yahoo.com and ebaystatic.com in sc.surbl.org yesterday
by Giorgio 18 Nov '05

18 Nov '05

I've seen that yahoo.com and ebaystatic.com where included for a short period of time in sc.surbl.org yesterday (November 17). It seems really strange to me since this two servers are even present in the SURBL global whitelist. Ex: dig yahoo.com.multi.surbl.org ; <<>> DiG 9.2.2-P1 <<>> yahoo.com.multi.surbl.org ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54931 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 14, ADDITIONAL: 12 ;; QUESTION SECTION: ;yahoo.com.multi.surbl.org. IN A ;; ANSWER SECTION: yahoo.com.multi.surbl.org. 6700 IN A 127.0.0.2 ;; Query time: 23 msec ;; SERVER: xxxxxxxx#53(xxxxxxxx) ;; WHEN: Thu Nov 17 17:36:53 2005 ;; MSG SIZE rcvd: 475 Does anybody know what happened ? Thanks, Giorgio

2 2

FTC Finds Affiliates and Hosts both responsible in spam case
by Jeff Chan 18 Nov '05

18 Nov '05

This case gives CAN-SPAM some teeth to go after both affiliates and the hosts they advertise. It's also a precedent worth mentioning to those who say they have no responsibility for their affiliates. http://www.ftc.gov/opa/2005/11/globalnet.htm For Release: November 17, 2005 Spammers Barred from Violating Federal Law Operators Required to Keep Closer Eye on Affiliated E-mail Programs Spammers who sent millions of illegal e-mail messages including sexually explicit messages have paid $621,000 to settle Federal Trade Commission charges that their practices violated federal laws. The settlement will bar future violations and will require the marketers to monitor their affiliates to assure they are complying with federal laws, as well. According to the FTC complaint filed in January 2005, the defendants sold access to sexually explicit Web sites through spam. Four defendants control a network of corporations that own and operate the Web sites, payment systems, and servers used to distribute and sell sexually explicit content. One defendant was an affiliate hired to market the content from the Web sites. While the affiliate sent many of the e-mails that allegedly violated federal law, under the CAN-SPAM Act all of the defendants are responsible for the e-mails, including the defendants who paid others to send the e-mails on their behalf. [...] Jeff C. -- Don't harm innocent bystanders.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss