- Discuss - Mailman 3

sc2.surbl.org and xs.surbl.org
by Peter M. Abraham 26 Sep '05

26 Sep '05

Greetings: sc2.surbl.org and xs.surbl.org are not mentioned on http://www.surbl.org/lists.html What's the criteria for being listed in these two new ones? Are there any changes to implementation and usage of them? Thank you.

4 4

FP: Emigrant Direct
by sare＠menschel.net 25 Sep '05

25 Sep '05

The attached email hit URIBL_OB_SURBL -- it's a normal marketing email from EmigrantDirect.com, for which I signed up at the recipient email address. I've never seen any spam from EmigrantDirect. Please check into this OB entry ... should probably be removed. Bob Menschel This is a forwarded message From: EmigrantDirect(a)emigrant.com <EmigrantDirect(a)emigrant.com> To: Date: Tuesday, September 20, 2005, 5:05:54 PM Subject: Rate increase - EmigrantDirect races to 4.0% APY ===8<==============Original message text=============== Return-path: <return(a)fire2.sumnet.com> Envelope-to: emigrant(a)menschel.net Delivery-date: Tue, 20 Sep 2005 17:13:34 -0700 Received: from pascal.ctyme.com ([69.50.226.20]) by newton.ctyme.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.52) id 1EHsEq-0004hA-9k for emigrant(a)menschel.net; Tue, 20 Sep 2005 17:13:30 -0700 Received: from mail by pascal.ctyme.com with ctyme-spam-scanned (Exim 4.52) id 1EHsEm-00061R-ND for emigrant(a)menschel.net; Tue, 20 Sep 2005 17:13:27 -0700 Received: from broadcast5.sumnet.com ([206.139.137.83] helo=sumnet.com) by pascal.ctyme.com with esmtp (Exim 4.52) id 1EHsEl-0005yz-JW for emigrant(a)menschel.net; Tue, 20 Sep 2005 17:13:23 -0700 Received: (from return@localhost) by sumnet.com (8.11.7p1+Sun/8.11.7) id j8L05s917331; Tue, 20 Sep 2005 20:05:54 -0400 (EDT) Date: Tue, 20 Sep 2005 20:05:54 -0400 (EDT) Message-Id: <200509210005.j8L05s917331(a)sumnet.com> From: EmigrantDirect(a)emigrant.com Subject: Rate increase - EmigrantDirect races to 4.0% APY Bcc: X-Sumid: H0000AE4 X-Mailer: Email Broacaster 1.2 Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="-----00000AE3_0000001A_4330946D_000835SUM.ALT" X-Mail-from: return(a)fire2.sumnet.com X-Spamprobe: neutral ***** 0.3518373 OK X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on pascal.ctyme.com X-Spam-Level: ********** X-Spam-Status: Yes, score=10.4 required=5.0 tests=CT_APPLY,HTML_40_50, HTML_MESSAGE,LINK_PHRASE,MAILTO_LINK,MISSING_HEADERS,NO_FEE, NO_REAL_NAME,URIBL_OB_SURBL autolearn=no version=3.0.4 X-Spam-Report: * 1.0 NO_REAL_NAME From: does not include a real name * 2.0 LINK_PHRASE Phrase within link * 1.0 MISSING_HEADERS Missing To: header * 1.0 NO_FEE BODY: No Fees * 0.1 CT_APPLY BODY: Apply for Something * 0.0 HTML_40_50 BODY: Message is 40% to 50% HTML * 1.0 HTML_MESSAGE BODY: HTML included in message * 1.0 MAILTO_LINK RAW: Includes a URL link to send an email * 3.2 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist * [URIs: emigrant-direct.com] X-Spam-filter-host: pascal.ctyme.com - http://www.junkemailfilter.com X-Spam: [SPAM] - LOW X-Spam: [SPAM] - LOW [INLINE] We are pleased to announce that effective today, Tuesday, September 20, your American Dream Savings Account from EmigrantDirect now yields 4.0% APY, the highest rate in the country with no fees and no minimums, FDIC insured. Responding immediately to the most recent news from the Federal Reserve, EmigrantDirect is pleased to be able to offer this unmatched rate to our loyal customers. You may wish to take this opportunity to put all your available funds to work for you. If you have deposits earning less interest at other institutions, now is a good time to consolidate those savings at EmigrantDirect. Electronic transfers into and out of your account are free and our new 4.0% APY is guaranteed through December 31, 2005 (subject to upward adjustments only). Additionally, we are also pleased to announce the upcoming launch of a no-fee credit card from EmigrantDirect offering the highest cash back rebate in the country on all your purchases - from the first dollar spent on your card to the very last. This revolutionary credit card featuring platinum-level benefits will be offered only to EmigrantDirect customers and be available before yearend. Cash back amounts will be deposited into your American Dream Savings Account automatically not once, but twice a year for added convenience. If you would like to be sent a priority invitation to apply for the card once it becomes available, please send a quick email with your name and email address to [1]emigrantdirect(a)emigrant.com. We hope that you will become a cardholder and discover yet another way that EmigrantDirect serves and rewards its customers with outstanding value. Sincerely, [INLINE] Howard P. Milstein Co-Chairman, President and CEO Emigrant Savings Bank Emigrant Bancorp, Inc. [INLINE] Subject to applicable terms and conditions and account disclosures as set out at EmigrantDirect.com. No minimum balance required. All rights reserved. You are receiving this email in accordance with the terms and conditions of your account with EmigrantDirect. If you do not wish to receive general informational or promotional emails from EmigrantDirect about products and services that might be of interest to you, [2]click here. References 1. mailto:emigrantdirect@emigrant.com 2. mailto:emigrantdirect@emigrant.com?subject=Unsubscribe ===8<===========End of original message text===========

2 1

FP AddictionReport (dot) com
by Mariano Absatz 20 Sep '05

20 Sep '05

Hi, AddictionReport (dot) com is listed in ws & jp, however, I just received a legit mail including a (supposedly pay) advertisement by them. The mail is Randy Cassingham's newslatter "This is True" (http://www.thisistrue.com/), which includes plain text advertisement, and one of these hit badly. The advertisement read like this: ----------==========**********O**********==========---------- HOW CAN ANYONE BE SUCH AN IDIOT? What's the connection between suicide bombers, New Orleans thugs, half the people you read about in This is True, financial abuse, emotional abuse and the need to blame everyone else for one's problems? Doug Thorburn explains destructive behaviors and more, including how to AVOID being caught up in their games. Fascinating books, FREE monthly Addiction Report newsletter: http://www (dot) AddictionReport (dot) com ----------==========**********O**********==========---------- Regards. -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com

4 5

RE: [SURBL-Discuss] Help with sa-blacklist load
by William Stearns 17 Sep '05

17 Sep '05

Good afternoon, all, (One kind responder said) >> Try to get people to grab the file at different >> times, not all at the same time of the hour. > > Not that Jeff mentions it, I'm now fearful the hourly surge would tax my > server too much at certain moments??? > > Is there any way that these updates could be spread out more? I actually tried to do that from day 1. The instructions on the web site encouraged people to put in a random pause in the cron line before downloading. It's a little hard to tell whether people are doing that or not, as I'm pegging the line starting at the top of the hour for a number of minutes. :-) Cheers, - Bill --------------------------------------------------------------------------- Weinberg's Law: If builders built buildings the way programmers wrote programs, then the first woodpecker that came along would destroy civilization. (Courtesy of David E. Vandewalle, vandewal(a)prairienet.org) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

1 0

Help with sa-blacklist load
by William Stearns 16 Sep '05

16 Sep '05

Good day, all, I'm running into a problem with the sa-blacklist content I host at http://www.stearns.org/sa-blacklist/ . The box (*) is hosted at pa.net, a colo facility once employing a good friend. A new guy was going over the bandwidth stats and noticed that that machine hogs the available bandwidth on its ethernet segment for a few minutes after each hour as people download the sa-blacklist. I asked him what kind of bandwidth he'd ideally like that system to use, and how much I'm using at the moment. I should be using around 10G/month. I'm currently using 1TB/month. Oops. I'm not in imminent danger of being kicked off their cable, but both they and I agree that I need to do something differently. I could put another physical box at another ISP with unlimited bandwidth, but I'm already paying around $1500/year to host the site, and am reluctant to double that. Because that box hosts 27 virtual machines, moving it is a project that would need a few months of lead time to arrange, and would be a nightmare in itself. It would be great if someone already has enough bandwidth to host the content on a different cable, but I think people with a terabyte/month to spare may be rare. *smile* If you've got some bandwidth you could share, would you consider doing round-robin with me with the content? 10 sites spreading the load would have 100GB/month, or an average of about 300 kilobits/sec. 20 sites sould be half that each, and so on. I'd need to upload content via rsync over ssh. The actual content is published via web, rsync, and ftp, although I could easily set up www.sa-blacklist.stearns.org for the sites willing to share over http, rsync.sa-blacklist.stearns.org, for the sites willing to share over rsync, and ftp.sa-blacklist.stearns.org. If you can spare some bandwidth, please respond. Let me know what you can spare in average kilobits/sec. That way, if only 10 people respond and one of them can provide 100 kilobits/sec, I'll know not to include that person in the mirror until I can get 30 people. If you can take part, I'd be forever grateful. *sincere smile* Cheers, - Bill * http://www.stearns.org/slartibartfast/uml-coop.current.html --------------------------------------------------------------------------- (Referring to the 32 bit system that feeds out files for kernel.org) "We learned that the Linux load average rolls over at 1024. And we actually found this out empirically." -- Peter Anvin -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

2 1

cheetahmail / rhsbl.ahbl.org
by wolfgang 31 Aug '05

31 Aug '05

Hi, when experimenting with rhsbl.ahbl.org sender blacklists on MTA level, I noticed: reject_warning: RCPT from mta121.cheetahmail.com[66.165.100.122]: 571 Service unavailable; Sender address [bo-byytbuda6faq70bcxwgsmb73r6zqxc(a)b.apc.chtah.com] blocked using rhsbl.ahbl.org; Domain used in spam. Access is not allowed.; To me, the email seemed to be a valid product hotfix notification from http://www.apc.com to registered recipients. What are your experiences with or views about cheetah.com? They appear to be mass mailers, but also engaged in anti-spam measures / sender verification acitivities, and what are your experiences with rhsbl.ahbl.org? I would like to make up my mind - whether to whitelist cheetah.com mailservers from being blocked on MTA level in order to avoid FPs when using ahbl - whether to use rhsbl.ahbl.org to reject mails at the MTA level. Cheers, wolfgang

4 7

Fw: [off-topic] Free Opera Registration
by Kevin A. McGrail 30 Aug '05

30 Aug '05

Just passing along some interesting news: Opera is celebrating 10 years with a free registration code. It's very simply and very much on the up and up. Go to http://my.opera.com/community/party/reg.dml " SURPRISE!!! Free registration codes - Party favors: Get a free Opera registration code by clicking the "go free" button below. We're giving away registration codes for as long as the party lasts!" Regards, KAM

1 0

photo.com?
by Jeff Chan 29 Aug '05

29 Aug '05

Got a spam mentioning photo.com and some chat site. The chat site may be spammy but does anyone know anything about photo.com? Seems to be several years old: Registrant: Calumet Photographic Inc. 890 Supreme Dr. Bensenville, IL 60106 US Domain Name: PHOTO.COM Administrative Contact: Perazella, Tom tom.perazella(a)CALUMETPHOTO.COM Calumet Photographic, Inc. 890 Supreme Dr. Bensenville, IL 60106 US (630) 860-7447 fax: 999 999 9999 Technical Contact: Fischer, Douglas doug.fischer(a)calumetphoto.com 890 Supreme Drive Bensenville, IL 60106 US 630-860-7447 X3204 fax: 123 123 1234 Record expires on 06-Apr-2006. Record created on 07-Apr-1998. Database last updated on 28-Aug-2005 04:09:30 EDT. Domain servers in listed order: NS1.PRIMARYDEVELOPMENT.NET 38.119.37.68 NS3.PRIMARYDEVELOPMENT.NET 38.119.37.120 NS2.PRIMARYDEVELOPMENT.NET 38.119.37.69 Jeff C. -- Don't harm innocent bystanders.

2 3

re: [SURBL-Discuss] RE: Porn Domains and SURBL
by Jay Swackhamer 26 Aug '05

26 Aug '05

> The address I had for reporting spam to mailpolice was: > > > spam(a)mailpolice.com > > But it may no longer work. Yes, the address still works. Please do send any kind of spam to that address. -- Jay Swackhamer <jswack(a)nebularis.com> Nebularis Inc <http://www.nebularis.com> MailPolice Spam&Virus Elimination <http://www.mailpolice.com> Tel: 1-613-843-9358 Fax: 1-613-825-5960

3 2

RE: Porn Domains and SURBL
by Rob McEwen 23 Aug '05

23 Aug '05

It was brought to the attention of some SURBL contributors recently a reminder that we have to be careful not to list porn messages just because they are porn if little or no evidence of actual spamming is found. This is because SURBL is suppose to be a "spammer's URI" list, not an objectionable content list. There has always been a general agreement on this. But this issue has reminded me to remind everyone to please, where applicable, send any porn domains which did NOT quite make the SURBL "spam threshold" over to MailPolice.com's "porn.rhs.mailpolice.com" list... especially the newer ones which might not already be there. In fact, for the past 14 months, I've been slowly and diligently working on my own commercial spam filtering solution with which I hope to carve out a nitch area where I will especially appeal to families who are concerned about content as well as spam. Therefore, for my **own** filtering, porn is filtered out regardless of spamming issues and, therefore, MailPolice's porn list is a great addition to my filter. Other filters may choose to have a "family option" or "strict option" which would be ideal for "grownups" who struggle with porn addiction and/or great for families who want an extra layer of protection for their own children's e-mail accounts. This can catch porn outfits who spam "just below the radar" or it can catch them if/when they just start spamming. Of course, this is no substitute for linguistic filtering, for which I have one of the best porn filters ever. Of course, the real trick is to catch these without catching the dirty jokes that people send around to each other. (and I've gotten pretty good at blocking the former without blocking the latter in my linguistic filtering!) Of course, this kind of filtering is not for everyone or every mail server!!! But I just want to make sure that you all know about MailPolice being a good place to send this stuff to when not deemed SURBL-material. BTW - When I start selling my spam filtering service, it will be available here: http://Stop-Spam-Forever-Filter-Blocker.com (or, alternatively) http://StopSpamForever.com But my web site for promoting my filter is not yet built :( Finally, funny thing is... I don't know for sure **how** best to report porn domains to MailPolice. Jay Swackhamer <jswack at nebularis.com> is the contact there who provided the MailPolice-to-SURBL phishing data feed. Try him or perhaps Jeff or someone else has a suggestion or additional contact there? Rob McEwen PowerView Systems Rob(a)PowerViewSystems.com

3 2

Surbl.org mirror down due to hardware probs
by Dirk Bonengel 21 Aug '05

21 Aug '05

Hi, I'm sorry but trabant.login-solutions.de (212.172.180.57), one of the mirror servers for the surbl.org zones, is down, probably due to hardware probs. Please, can someone disable that machine in the DNS setup. Thanks Dirk

2 1

RBLDNSD + mrtg
by Michele Neylon 16 Aug '05

16 Aug '05

Hi Has anyone managed to plot RBLDNS stats using MRTG? I've googled, but I haven't found anything TIA Michele

2 2

Geocities
by Darrell (support＠invariantsystems.com) 13 Aug '05

13 Aug '05

I want to check on this before I add geocities as an exception (i.e. do not check against SURBL) - Is geocities one of the domains that would never end up on SURBL. I was doing an analysis this week against domains that always returned clean and number of times - and geocities was listed as #1. Darrell

5 4

Lookup of (phishing) URLs with an IP
by Dirk Bonengel 13 Aug '05

13 Aug '05

Hi, sorry for crossposting, but I think this concerns both SURBL and URIBL. Given: A (phishing-)mail containg a link to the IP 219.144.194.158 The lookup page on rulesemporium.com says it's listed on ws and ph in SURBL However, I find that the current SpamAssassin (3.0.4) does not appear to lookup IP-based URLs. Is that correct? Secondly, which form would be correct to lookup that IP via dig (or whatever), and how should SA handle it if it tried to lookup IP-based URIs? dig 219.144.194.158.multi.surbl.org gives no results back, but the reversed dotted decimal form does: dig 158.194.144.219.multi.surbl.org returns 127.0.0.12. Lastly: The URIBL-Lookup page says that the IP 219.144.194.158 is neither listed on SURBL nor URIBL but claims that 158.194.144.219 is listed both in SURBL (ws and ph) and URIBL (black). I take that to be simply wrong. Dirk

2 2

RE: [SURBL-Discuss] Geocities
by Rob McEwen 13 Aug '05

13 Aug '05

Oops... I meant, "it is on the master white list" NOT "it is no the master white list" --Rob McEwen

1 0

XS inclusion into multi
by Darrell (support＠invariantsystems.com) 11 Aug '05

11 Aug '05

Jeff, Any idea's when xs will be included into multi? Darrell

6 7

hotlog.ru?
by Jeff Chan 08 Aug '05

08 Aug '05

hotlog.ru and some subdomains appeared in the SURBL data yesterday, but the site is also ranked about 25k on Alexa so it seems to be a fairly popular site. A couple readers of Russian took a look at the site and determined it's some kind of web log analysis tool vendor, but could not easily say if it had legitimate uses. Is anyone here familiar with them? In particular might they have legitimate uses? It's been around since 2000: domain: HOTLOG.RU type: CORPORATE nserver: ank.ank.ru. nserver: ns.wplus.net. nserver: ns1.wplus.net. state: REGISTERED, DELEGATED person: ANDREW N KUZMIN phone: +7 812 5963532 fax-no: +7 812 5963532 e-mail: ank(a)ank.ru registrar: RUCENTER-REG-RIPN created: 2000.11.29 paid-till: 2005.11.30 source: TC-RIPN Jeff C. -- Don't harm innocent bystanders.

1 0

Re: [SURBL-Discuss] Re: SURBL: sc2 vs sc?
by Jeff Chan 06 Aug '05

06 Aug '05

On Thursday, August 4, 2005, 7:36:11 AM, Bil Cook wrote: > Have yet to hit a FP on SC2 and that is over almost three weeks now On Thursday, August 4, 2005, 5:29:00 AM, Rob McEwen wrote: > Last night, I ran SC2 against a corpus of 119,000 messages consisting of > about 97-99% ham. This was a corpus of mostly ham mail which had made it > past my filter over the past few months. (BTW, my percentages keep getting > better, so most of that small percentage of spam in this corpus was from a > few months ago). > SC2 caught about 150 messages from this corpus. ALL of these caught messages > were spam. It did NOT "block" a single ham. Thanks much for the feeback Bil, Rob and others earlier and off-list. If the SA folks don't have time to do a corpus check on SC2, then maybe we should go ahead and put SC2 into production. I'd still feel better with a large ham check from them before doing it though. Jeff C. -- Don't harm innocent bystanders.

3 5

Re: [SURBL-Discuss] Why you should check Phish IPs first :/
by List Mail User 06 Aug '05

06 Aug '05

>... >In today's spamtrap take, I got a phish targeting eBay that >contained a link to the following IP: > >66.135.192.124 > >The link was inside a JavaScript and looked, at first and second >glance, like a link to a phish site. As a habit, I do an rDNS >on all IPs, however, before listing them. That's fortunate, in >this case -- that IP resolves as hp-core.ebay.com. Yes, a genuine >eBay IP pointing to a genuine eBay server, one that has nothing >to do with the phish, of course. > >The actual phish link in this spam was: > >http://www.doje.de/bbs/eBayISAPI.dllhdsh6ds65bcgadhgd43as676bsda6gwcv7zfcag… > >It appeared well down the spam, after not one, but two, decoy >links to the eBay IP above. > >By the way, I'm not listing doje.de as a Phish Domain either. >It's a Chinese language web site (yes, at a German national >domain, probably something for expatriates), and the format >of the URL suggests that the phisher exploited an insecure >web BBS package. This is one where blocking on the URL is >the appropriate approach. <sigh> > >Posted because I'm seeing quite a few phishes with this sort >of decoy information/links lately. :/ Phishers are clearly >trying to poison the blocklisting process. We have to be >careful. > > >-- >Catherine Hampton <ariel(a)spambouncer.org> >The SpamBouncer * <http://www.spambouncer.org/> >Personal Home Page * <http://www.devsite.org/> >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > I think it is Korean, not Chinese. Paul Shupak track(a)plectere.com

1 0

SURBL: sc2 vs sc?
by Jeff Chan 04 Aug '05

04 Aug '05

It's sounding like the sc2 list is catching 10-15% more spam than the sc list, based on some early reports of SA users. Is anyone else getting some results? Are there differences in ham hits? Has anyone been able to run them through their test corpora? How about xs.surbl.org? Jeff C. -- Don't harm innocent bystanders.

5 7

Re: [SURBL-Discuss] RFC: Adding SpamBouncer phishing data to ph.surbl.org
by List Mail User 02 Aug '05

02 Aug '05

Steve, I'm not a procmail user and nearly all your expressions look good except a few. If you have any users into genealogy the next~of~kin pair may give you problems; I get mail like this from family members who are "into" that sort of thing. Also, my accountants will sometimes send me emails with urgent_response and/or urgent_reply in them. All the rest seem to match what I have seen in 419s only - a really good list overall. (BTW. Bayes is good at catching these too. How often does an American even see or hear the word "barrister"? Ouside of the Commonwealth or old Commonwealth countries, I doubt the work gets any use except on PBS; And who *really* wants to hear from a lawyer anyway:-)) Paul Shupak track(a)plectere.com

2 1

RFC: Adding SpamBouncer phishing data to ph.surbl.org
by Jeff Chan 02 Aug '05

02 Aug '05

Catherine Hampton of SpamBouncer (welcome to the SURBL Discuss list Catherine!) is kindly making available her carefully checked phishing domains and IPs for our inclusion in the SURBL phishing list. They're not currently added to ph.surbl.org, but the hooks are in place to make it live after some discussion here. Catherine's data come from antiphishing.org plus her own trapped phishes. All are hand checked about once a day. When I reviewed a recent snapshot of the data: http://www.spambouncer.org/dist/standalone/phishdata/current.txt I found that 124 of the 193 domains were already listed on various SURBLs. The other new 69 looked quite phishy and probably ok to list. For the IPs, we had 22 of the 74 listed, and I'll assume the others are probably zombies, etc. as Catherine suggested. Generally speaking there's little harm in listing IPs since most legitimate sites don't get referenced by IP, so there's good upside and little downside for listing them. Please take a look at the data for yourself and comment. Regarding expiring the data, Catherine told me: > I expire "Phish IP" listings every month. Phishers move around a > LOT, probably because most of the IPs are on compromised or trojaned > hosts and tend to get fixed within a couple of weeks. > > I don't expire Phish domains formally right now, although eventually > I plan to run them through regular "has this domain expired and not > been renewed" checks. Since I only list domains designed specifically > for phishing and used only by phishers as "Phish domains", they aren't > likely to be used for anything else. (Domains like paypalll.com > don't seem to have much legitimate use to me.) which sound like reasonable policies to me. Does anyone have comments on adding these to the PH list? Am I forgetting anything Catherine? :-) Jeff C. -- Don't harm innocent bystanders.

6 7

RE: Adding SpamBouncer phishing data to ph.surbl.org
by Greg Allen 02 Aug '05

02 Aug '05

I agree, we definitely need SURBL black lists. They have helped tremendously against spam! I just feel that it would be chasing one's tail a bit to try to catch phishing in SURBL. People who do phishing are going to change their IP address (IP where the actual target/sucker is sent) frequently. They are also probably going to use random and ever changing computer IPs outside the US for obvious legal reasons. Maybe zombies even, who knows. Any domain names in a phishing email code are most likely going to be legit domain names such as, ebay.com, bankofamerica,com, southtrustbank.com etc.. These are the domains visible to the target/sucker. So it just seems to me that an antivirus program is better for detecting HTML code patter of these schemes rather than the IP address of the day/week that they would be sending from in South Korea, Russia or China, etc. There is a very simple ClamAV plugin that does this (see the SA Wiki). I am using it on my SA system and it does the job of sending it on to my next downstream systems marked as spam. I have more antivirus on downstream systems that will delete real viruses as well since I just use ClamAV for spam tagging for simplicity sake. (I don't want to put a ton of programs on the computer to call SA, such as Amavis-new, etc., so that is why I do this.) >And by the way: I REALLY appreciate your SURBL lists and hard >work even if I think other tools supplement and help make your >stuff even better. > >My security principles include (but are not limited to): > > 1) Stop as much as possible at the outer perimeter > (earlier the better) > > 2) Defense in depth > >For us, the virus scanning happens before the Spam tests; >early is good. > >-- >Herb Martin

4 10

Re: Adding SpamBouncer phishing data to ph.surbl.org
by Jeff Chan 01 Aug '05

01 Aug '05

On Sunday, July 31, 2005, 3:52:53 AM, Herb Martin wrote: > Presumably -- now you have me interested so I am going to check > -- ClamAV does more than a naive pattern match on the URI and > apparently they even have (had) endless debates in the ClamAV > newsgroups/lists on this subject. Sure, and any additional pattern matching is probably useful for detecting phishes, but every phish I've seen has tried to direct someone to a fake web site. Web sites mentioned in spams, including phishing spams, are *precisely* what SURBLs are designed to detect. SURBLs are not designed to detect viruses at all, just web sites. Phishes don't usually have viruses, but they do have web sites. Draw your own conclusions.... :-) > And by the way: I REALLY appreciate your SURBL lists and hard > work On behalf of the many people helping out with the SURBL project in various ways, thanks for your kind words. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Please test sc2.surbl.org (and xs.surbl.org)
by Chris 31 Jul '05

31 Jul '05

Jeff, did this come out any better? ---------- Forwarded Message ---------- Email: 148 Autolearn: 0 AvgScore: 19.63 AvgScanTime: 6.54 sec Spam: 103 Autolearn: 0 AvgScore: 32.95 AvgScanTime: 6.39 sec Ham: 45 Autolearn: 0 AvgScore: -10.87 AvgScanTime: 6.88 sec Time Spent Running SA: 0.27 hours Time Spent Processing Spam: 0.18 hours Time Spent Processing Ham: 0.09 hours TOP SPAM RULES FIRED ------------------------------------------------------------ RANK RULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM ------------------------------------------------------------ 1 PYZOR_CHECK 103 5.70 69.59 100.00 100.00 2 DIGEST_MULTIPLE 93 5.15 62.84 90.29 4.44 3 RAZOR2_CF_RANGE_51_100 89 4.93 60.14 86.41 0.00 4 RAZOR2_CHECK 88 4.87 59.46 85.44 0.00 5 BAYES_99 87 4.81 58.78 84.47 0.00 6 DCC_CHECK 61 3.38 41.22 59.22 4.44 7 URIBL_SC2_SURBL 59 3.27 39.86 57.28 0.00 8 URIBL_JP_SURBL 57 3.15 38.51 55.34 0.00 9 URIBL_SC_SURBL 56 3.10 37.84 54.37 0.00 10 URIBL_OB_SURBL 55 3.04 37.16 53.40 0.00 11 URIBL_AB_SURBL 53 2.93 35.81 51.46 0.00 12 HTML_MESSAGE 53 2.93 35.81 51.46 2.22 13 URIBL_XS_SURBL 51 2.82 34.46 49.51 0.00 14 RCVD_IN_XBL 45 2.49 30.41 43.69 0.00 15 URIBL_WS_SURBL 40 2.21 27.03 38.83 0.00 16 RCVD_IN_BL_SPAMCOP_NET 40 2.21 27.03 38.83 0.00 17 URIBL_SBL 34 1.88 22.97 33.01 0.00 18 RCVD_IN_DSBL 31 1.72 20.95 30.10 0.00 19 RCVD_IN_SORBS_DUL 26 1.44 17.57 25.24 0.00 20 MIME_HTML_ONLY 26 1.44 17.57 25.24 2.22 ------------------------------------------------------------ TOP HAM RULES FIRED ------------------------------------------------------------ RANK RULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM ------------------------------------------------------------ 1 PYZOR_CHECK 45 25.14 30.41 100.00 100.00 2 BAYES_00 39 21.79 26.35 0.97 86.67 3 AWL 29 16.20 19.59 2.91 64.44 4 SPF_HELO_PASS 11 6.15 7.43 0.97 24.44 5 SPF_PASS 6 3.35 4.05 0.00 13.33 6 USER_IN_WHITELIST 5 2.79 3.38 0.00 11.11 7 RCVD_BY_IP 4 2.23 2.70 7.77 8.89 8 NO_REAL_NAME 4 2.23 2.70 10.68 8.89 9 BAYES_50 4 2.23 2.70 5.83 8.89 10 SPF_SOFTFAIL 3 1.68 2.03 15.53 6.67 11 DNS_FROM_RFC_POST 3 1.68 2.03 17.48 6.67 12 DCC_CHECK 2 1.12 1.35 59.22 4.44 13 RCVD_IN_BSP_TRUSTED 2 1.12 1.35 0.00 4.44 14 DIGEST_MULTIPLE 2 1.12 1.35 90.29 4.44 15 RCVD_IN_BSP_OTHER 2 1.12 1.35 0.00 4.44 16 DNS_FROM_RFC_WHOIS 2 1.12 1.35 6.80 4.44 17 USER_IN_DEF_WHITELIST 2 1.12 1.35 0.00 4.44 18 MIME_HTML_ONLY 1 0.56 0.68 25.24 2.22 19 PLING_QUERY 1 0.56 0.68 0.97 2.22 20 HTML_MESSAGE 1 0.56 0.68 51.46 2.22 ------------------------------------------------------------ ------------------------------------------------------- -- Chris Registered Linux User 283774 http://counter.li.org 15:24:08 up 6 days, 16:25, 2 users, load average: 0.50, 0.16, 0.11 Mandriva Linux 10.1 Official, kernel 2.6.8.1-12mdk ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I read the newspaper avidly. It is my one form of continuous fiction. -- Aneurin Bevan ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss