- Discuss - Mailman 3

RE: [SURBL-Discuss] newly registered domains
by Matthew Wilson 09 May '05

09 May '05

I wasn't talking about doing huge numbers of whois lookups; I was saying cache the whois lookups in the a uribl dns zone, encoded using regex. > -----Original Message----- > From: discuss-bounces(a)lists.surbl.org > [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Chris Santerre > Sent: Monday, May 09, 2005 9:20 AM > To: 'SURBL Discussion list' > Subject: RE: [SURBL-Discuss] newly registered domains > > Because they don't take to kindly to anyone doing tons of > whois looksups an hour. Trust me ;) > > --Chris > > >-----Original Message----- > >From: Matthew Wilson [mailto:matthew@boomer.com] > >Sent: Monday, May 09, 2005 9:44 AM > >To: SURBL Discussion list > >Subject: RE: [SURBL-Discuss] newly registered domains > > > > > >Why not integrate a whois date lookup directly into SURBL or URIBL? > >Design an encoding system whereby > >suspectedspammydomain.spammertld.dr.surbl.org (or uribl.com) would > >return the date somehow regex encoded in the IP address. > Then write a > >nice SA rule that decodes it, also using regex. Are there any regex > >geniuses out there that could encode a date in an IP address? > > > >-Matthew

1 0

RE: [SURBL-Discuss] newly registered domains
by Matthew Wilson 09 May '05

09 May '05

Why not integrate a whois date lookup directly into SURBL or URIBL? Design an encoding system whereby suspectedspammydomain.spammertld.dr.surbl.org (or uribl.com) would return the date somehow regex encoded in the IP address. Then write a nice SA rule that decodes it, also using regex. Are there any regex geniuses out there that could encode a date in an IP address? -Matthew > Well this has been brought up before. It is a very good idea, > however difficult to implement. Unfortunetly the date > returned by a whois querey comes in a wide variety of > flavors. We (SARE) thought we had all of the returned date > codes figured out. Nope. New ones still keep coming. > > uribl.com has some ideas on how to attack this very issue, > but not sure it is worth it yet. > > In short, it would be wonderful to start doing whois lookups > for every domain in an email. Lots of things could be flagged > off of it. Think of a sort of baysien whois DB. But the > traffic would be pretty dam big. > > --Chris > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss > > >

1 0

RE: [SURBL-Discuss] newly registered domains
by Chris Santerre 09 May '05

09 May '05

>-----Original Message----- >From: Matthew Wilson [mailto:matthew@boomer.com] >Sent: Sunday, May 08, 2005 9:29 PM >To: Jeff Chan; SURBL Discussion list >Subject: [SURBL-Discuss] newly registered domains > > >Does anyone know of a SA rule to check how recently a domain name has >been registered? > >The various uri lookups catch the vast majority of spammy urls during >the day, but from 2-5 a.m. CST, my servers get hit with tons of spam >with urls that aren't in SURBL yet. All of the domains are newly >registered domains (registered in the past week or so). > >I know that the SARE ninjas have some private tools to do this kind of >lookup for their feeds and manual lookups, but I'm wondering if this >kind of thing could be worked directly into a SA rule. Well this has been brought up before. It is a very good idea, however difficult to implement. Unfortunetly the date returned by a whois querey comes in a wide variety of flavors. We (SARE) thought we had all of the returned date codes figured out. Nope. New ones still keep coming. uribl.com has some ideas on how to attack this very issue, but not sure it is worth it yet. In short, it would be wonderful to start doing whois lookups for every domain in an email. Lots of things could be flagged off of it. Think of a sort of baysien whois DB. But the traffic would be pretty dam big. --Chris

2 1

RE: [SURBL-Discuss] multi.surbl.org.rbldnsd Update Times
by Smith, Eric 09 May '05

09 May '05

When you say several times an hour, does that mean weekends and holidays also? /E. -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan Sent: Sunday, May 08, 2005 11:01 AM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] multi.surbl.org.rbldnsd Update Times On Sunday, May 8, 2005, 7:09:11 AM, Eric Smith wrote: > I'm sure this is dependent on the mirror we are pulling the zone from, but > how often is the source zone updated, and should we expect that mirrors > update on a regular schedule around the clock? What I'm getting at is we > are monitoring file changes to the zone file to ensure it's updating often, > but as of Friday we have received no updates (I'm guessing because it > doesn't get updated on the weekends). Is my assumption correct? Does the > schedule vary by mirror? If so is there a mirror that anyone knows the > replication interval for? If not Jeff do you know the schedule requirements > for a site to become a mirror so we can base monitoring off this schedule? If you're asking about spamhaus lists, I have no idea. SURBL lists are updated several times an hour usually. Jeff C. -- Don't harm innocent bystanders. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

newly registered domains
by Matthew Wilson 09 May '05

09 May '05

Does anyone know of a SA rule to check how recently a domain name has been registered? The various uri lookups catch the vast majority of spammy urls during the day, but from 2-5 a.m. CST, my servers get hit with tons of spam with urls that aren't in SURBL yet. All of the domains are newly registered domains (registered in the past week or so). I know that the SARE ninjas have some private tools to do this kind of lookup for their feeds and manual lookups, but I'm wondering if this kind of thing could be worked directly into a SA rule. Thanks, Matthew

2 1

multi.surbl.org.rbldnsd Update Times
by Smith, Eric 08 May '05

08 May '05

I'm sure this is dependent on the mirror we are pulling the zone from, but how often is the source zone updated, and should we expect that mirrors update on a regular schedule around the clock? What I'm getting at is we are monitoring file changes to the zone file to ensure it's updating often, but as of Friday we have received no updates (I'm guessing because it doesn't get updated on the weekends). Is my assumption correct? Does the schedule vary by mirror? If so is there a mirror that anyone knows the replication interval for? If not Jeff do you know the schedule requirements for a site to become a mirror so we can base monitoring off this schedule? Any input is greatly appreciated. Thanks, Eric

2 1

RE: [SURBL-Discuss] SURBL Content
by Smith, Eric 08 May '05

08 May '05

XBL actually, very strange, I will check and follow up regarding it. /E. -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan Sent: Friday, May 06, 2005 11:34 PM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] SURBL Content On Friday, May 6, 2005, 5:59:15 PM, Eric Smith wrote: > This morning we received a huge blast from a spammer that spamhaus.org > identified properly but multi.surbl.org.rbldnsd didn't :( Just checking > though :) > Eric When you say spamhaus.org, which list are you referring to, XBL or SBL? Because one of the new lists we're experimenting with, xu.surbl.org, gets data from CBL spamtrap URI hits. CBL feeds into XBL, and some of the XBL senders probably end up in SBL also. Next time you see one like this, if you check it using the SURBL checker: http://www.rulesemporium.com/cgi-bin/uribl.cgi it would be interesting to to hear if it hits the preliminary version of the XS data. Cheers, Jeff C. -- Don't harm innocent bystanders. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

False Positive on AB_URI_RBL
by wolfgang 07 May '05

07 May '05

Hi, ab.surbl.org created a FP here today. The URI in question www dot teleflora dot com was in the ad part of a yahoogroups mail, in the part of the message that is automatically added by yahoo. please consider removing the URI to prevent false positives. regards, wolfgang

2 1

RE: [SURBL-Discuss] SURBL Content
by Smith, Eric 07 May '05

07 May '05

This morning we received a huge blast from a spammer that spamhaus.org identified properly but multi.surbl.org.rbldnsd didn't :( Just checking though :) Eric -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan Sent: Friday, May 06, 2005 8:03 PM To: discuss(a)lists.surbl.org Subject: Re: [SURBL-Discuss] SURBL Content On Friday, May 6, 2005, 10:57:25 AM, Eric Smith wrote: > Quick question regarding multi.surbl.org.rbldnsd; the list of content for > this file (i.e. sc.surbl.org, ws.surbl.org, etc) on the surbl.org website is > all inclusive correct? Yes. > Does multi.surbl.org.rbldnsd contain anything from > spamhaus.org or any other content providers? Not yet, though we're working on some trapped URI data from the CBL folks. Why do you ask? :-) > Thanks, > Eric Smith Cheers, Jeff C. -- Don't harm innocent bystanders. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

SURBL Content
by Smith, Eric 07 May '05

07 May '05

Quick question regarding multi.surbl.org.rbldnsd; the list of content for this file (i.e. sc.surbl.org, ws.surbl.org, etc) on the surbl.org website is all inclusive correct? Does multi.surbl.org.rbldnsd contain anything from spamhaus.org or any other content providers? Thanks, Eric Smith

2 1

RE: registrar boundary inconsistencies
by Chris Santerre 06 May '05

06 May '05

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Thursday, May 05, 2005 1:19 AM >To: discuss(a)lists.surbl.org >Cc: jeffc(a)surbl.org; dev(a)spamassassin.apache.org >Subject: registrar boundary inconsistencies > > >I ran SURBL (well, a copy a few weeks old) through the split_domains() >function in SpamAssassin to see which listings contained both a >host+domain rather than just domain from the perspective of >SpamAssassin. Those listings would be missed by the URIBL module. > >These are reversed for easier reading, but basically, it works >like this: > >if this is listed: > > com.50megs.brisisbri > com.50megs.cddvdmp3 > com.50megs.slashbackman > >were these then in SURBL: > > brisisbri.50megs.com > cddvdmp3.50megs.com > slashbackman.50megs.com > >However, the URIDNSBL plugin would catch none of those unless >50megs.com >was listed (it's not) since 50megs.com is the domain as far as >SpamAssassin is concerned. However, it would catch them if 50megs.com >was in SURBL in addition or instead of those hostname.domain >combinations. > >Here is the data. We (SURBL or SpamAssassin) need to do one of these >actions for each of these listings and SURBL probably has more to say >about it (initially, at least) since it's your database. > > - change the domain code in SA to consider the domain a registry like > eu.org or demon.co.uk (let us know and we'll change our >code as long > as it makes sense ;-). This means we don't expect blacklist the > entire "registry". > > - SURBL (or your data provider) blacklists the entire domain > > - remove the hostname.domain listings ... why bother if nothing's > going to hit them > >Daniel I vote for changing the domain code to recognise these domains. Blacklisting the entire domain can have too many problems. Removing the whole thing would let spammers game these domains. I imagine that SA would need updating a lot for more domains like this. Each release. Unless of course there was some data cf file that we could just update at SARE? SImply a list of these type of domains, so they aren't hard coded? anyway, I hope you devs are having a great Cinco De Mayo!! --Chris

5 6

Re: [SURBL-Discuss] Re: registrar boundary inconsistencies
by List Mail User 06 May '05

06 May '05

>From discuss-bounces(a)lists.surbl.org Thu May 5 11:47:09 2005 >To: John Gardiner Myers <jgmyers(a)proofpoint.com> >In-Reply-To: <427A6488.8020603(a)proofpoint.com> >From: jm(a)jmason.org (Justin Mason) >... >Cc: Chris Santerre <csanterre(a)MerchantsOverseas.com>, quinlan(a)pathname.com, > dev(a)spamassassin.apache.org, discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] Re: registrar boundary inconsistencies >... > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >John Gardiner Myers writes: >> Daniel Quinlan wrote: >> >> > We can't just add them willy-nilly. >> >> Why not? Treat them like .us -- do two queries. > >we don't currently do that. but that may be a good option, actually! >allow url_to_domain to return >1 datum, and query all of them. > >In the case of .us, and these private registrars, return 2 >domains, "foo.eu.org" and "eu.org", or "foo.state.us" and >"bar.foo.state.us". > >- --j. >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.2.5 (GNU/Linux) >Comment: Exmh CVS > >iD4DBQFCemjHMJF5cimLx9ARAsWsAJ91vAjk0Mn7J7M+TbFUKxn3b1bDOwCWKbuw >b/NvALdeCXRn600SsZ4trw== >=6YpK >-----END PGP SIGNATURE----- > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Anybody look at bloomington.in. us recently? Care to guess who registered it. (Hint: It seem only to be used to get SpamCop reports for certain IP ranges in China.) Paul Shupak track(a)plectere.com P.S. Unfortunately the sets of spammers and registrars are not disjoint (and the set of large scale spammers seems almost to be a subset of the set of registrar resellers).

2 1

RE: registrar boundary inconsistencies
by Chris Santerre 05 May '05

05 May '05

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Thursday, May 05, 2005 2:07 PM >To: Chris Santerre >Cc: 'quinlan(a)pathname.com'; discuss(a)lists.surbl.org; jeffc(a)surbl.org; >dev(a)spamassassin.apache.org >Subject: RE: registrar boundary inconsistencies > > >Chris Santerre <csanterre(a)MerchantsOverseas.com> writes: > >> I vote for changing the domain code to recognise these >domains. Blacklisting >> the entire domain can have too many problems. Removing the >whole thing would >> let spammers game these domains. > >Well, that's easy to SAY, but we need to know: > > - which are really registrars (so some hosts will be bad and some > will not be) > - which are just spammers using different hostnames on their domain > >We can't just add them willy-nilly. > >Daniel Oh I completely agree. Will leave the willy nilly stuff to those crazy ninjas! :) But yeah, thats what I meant about needing updating for new legit regitrars and clean hosting. Its one of those things that can't really remain too static. --Chris

1 0

Brief problem with ab.surbl.org
by Jeff Chan 05 May '05

05 May '05

FWIW there was a brief error where .com got into ab.surbl.org and that caused it to hit all .com domains. This problem lasted an hour or two today and happened between around 01:00 to 0:300 UTC on 5 May 2005. Andy's fixed the data side of AB, and I've added dotted and non-dotted versions of all gtlds and cctlds to the SURBL whitelist to prevent these from getting listed. Source for the cctld list is the standard ARIN page: http://www.iana.org/cctld/cctld-whois.htm Cheers, Jeff C. -- Don't harm innocent bystanders.

1 0

registrar boundary inconsistencies
by Daniel Quinlan 05 May '05

05 May '05

I ran SURBL (well, a copy a few weeks old) through the split_domains() function in SpamAssassin to see which listings contained both a host+domain rather than just domain from the perspective of SpamAssassin. Those listings would be missed by the URIBL module. These are reversed for easier reading, but basically, it works like this: if this is listed: com.50megs.brisisbri com.50megs.cddvdmp3 com.50megs.slashbackman were these then in SURBL: brisisbri.50megs.com cddvdmp3.50megs.com slashbackman.50megs.com However, the URIDNSBL plugin would catch none of those unless 50megs.com was listed (it's not) since 50megs.com is the domain as far as SpamAssassin is concerned. However, it would catch them if 50megs.com was in SURBL in addition or instead of those hostname.domain combinations. Here is the data. We (SURBL or SpamAssassin) need to do one of these actions for each of these listings and SURBL probably has more to say about it (initially, at least) since it's your database. - change the domain code in SA to consider the domain a registry like eu.org or demon.co.uk (let us know and we'll change our code as long as it makes sense ;-). This means we don't expect blacklist the entire "registry". - SURBL (or your data provider) blacklists the entire domain - remove the hostname.domain listings ... why bother if nothing's going to hit them Daniel ------- start of cut text -------------- br.adm.etiquetabordada br.adm.hbl br.adm.max br.adm.mensagemonline br.adm.mundial br.adm.ondec-sp br.adm.wfh1000 br.pro.additionalservices br.pro.adorationsofallinvoled br.pro.allourchoices br.pro.applieapplestosciene br.pro.bojengles br.pro.clemts br.pro.considerothers br.pro.crazyarrra br.pro.e-server br.pro.exodus br.pro.havealook br.pro.ifnotnowwhen br.pro.interarmaenimsilentleges br.pro.keepthepeaceprocess br.pro.keepyourheadup br.pro.krisenmj br.pro.mastrmnd br.pro.muchmorefor-you br.pro.raisetheblackflag br.pro.saveourselves br.pro.solarityinfstr br.pro.strcturedsizeappl br.pro.thisisthetime br.pro.trabalho br.pro.wwolf359 br.pro.xerion com.50megs.brisisbri com.50megs.cddvdmp3 com.50megs.slashbackman com.netfirms.chasyfogin com.netfirms.chrterone com.netfirms.citl5d8rdsir com.netfirms.desynecyx com.netfirms.ebfeesycom com.netfirms.gsternal com.netfirms.minakis30 com.netfirms.ww2-serv-wm com.port5.1stsource com.port5.e-suntrust com.proxymyworld com.proxymyworld.charterone com.proxymyworld.citifinancial com.proxymyworld.citizensbank com.proxymyworld.regionsnet com.tripod.billebay com.tripod.paypalzzzz ee.pri.highlight ee.pri.zammy kg.pe kg.pe.ebaycom kg.pe.halifax-online kr.es kr.es.bos kr.es.cabs kr.es.wbong net.cjb.account-overdue net.cjb.cgi4-awconfirmisapidll-38u3428 net.cjb.dh7wznrj net.cjb.updateyourpaypai net.ebay-online net.ebay-online.information net.ebay-online.verify net.ohaime.bankofoklahoma net.ohaime.charterone net.ohaime.lasallebank net.userset.uk.co.barclays net.userset.uk.co.halifax-online net.userset.uk.co.nationwide nr.co.hahano nr.co.moot ro.go ro.go.accshert ro.go.citicards1 ro.go.luca2003 ro.home.hai-saruta-ma ro.home.login543644 ro.home.rranostand ro.home.xyxca ru.da.49 ru.da.5120 ru.da.aavm59jk ru.da.gvqw30fsg ru.nm.berawepoy ru.nm.lo409fds ru.nm.m5nu728f ru.nm.saoretwas st.cn.adult-portal st.cn.boysarchive st.cn.gowdot st.cn.kindyraod st.cn.underageworld st.hk.7now st.hk.adult-portal st.hk.adultworld st.hk.animeangels st.hk.boys-portal st.hk.comics-evolution st.hk.hotgirlsphotos st.hk.lollyedition7 st.hk.mydreamlo st.hk.ppvcd st.hk.uderageworld st.hk.ummmyea st.hk.undersites st.hk.underworld st.hk.undworld st.hk.x-adult st.sg.adult-portal st.sg.adultworld st.sg.comics-evolution st.sg.factoryb st.sg.felcorp st.sg.jklos st.sg.lolmag4 st.sg.ptz-portal st.sg.undworld st.sg.uworld st.tw.adult-portal st.tw.adultworld st.tw.redvids2 st.ye.hegre st.ye.lesbian us.onlinehome.s110082232 us.onlinehome.s117107589 us.onlinehome.s118791939 ------- end ---------------------------- -- Daniel Quinlan http://www.pathname.com/~quinlan/

1 0

false positive
by George Georgalis 29 Apr '05

29 Apr '05

Hi! I've been away from his list for a while... which means my spam filters have been working perfect! But today I got a false positive, bought a phone and the post sales info was flagged as spam. Is there some history I should know about re the domain? eg do they hire resellers who spam, do they spam, etc? Content analysis details: (4.0 points, 4.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 4.0 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: letstalk.com] // George -- George Georgalis, systems architect, administrator Linux BSD IXOYE http://galis.org/george/ cell:646-331-2027 mailto:george@galis.org

1 1

Re: [SURBL-Discuss] Fw: heads up, massive phishing going on.
by List Mail User 29 Apr '05

29 Apr '05

>... > >>From a guy I trust and work on anti-spam algorithm's who also works at Network Solutions: > > >The system running here detected a rash of ebay and paypal phishing earlier today and it is still going on. Hope this info can help find and stop it before someone gets damaged. > > > >Here are the IP addresses of the mail servers sending them and the sites they point to. 84.0.191.93: http://61.8.248.242/paypal/ > >... A good reason to refuse email from all "cable" campanies or at least dynamic addresses. track(a)plectere.com

1 0

Fw: heads up, massive phishing going on.
by Kevin A. McGrail 28 Apr '05

28 Apr '05

>From a guy I trust and work on anti-spam algorithm's who also works at Network Solutions: The system running here detected a rash of ebay and paypal phishing earlier today and it is still going on. Hope this info can help find and stop it before someone gets damaged. Here are the IP addresses of the mail servers sending them and the sites they point to. 84.0.191.93: http://61.8.248.242/paypal/ 211.207.71.179: http://ebay-loginpage.com/ 222.121.181.227: http://ebay-loginpage.com/ 82.155.149.110: http://61.8.248.242/paypal/ 81.153.23.110: http://61.8.248.242/paypal/ 66.169.92.212: http://ebay-loginpage.com/ 68.161.50.212: http://ebay-loginpage.com/ 220.77.245.178: http://ebay-loginpage.com/ 220.77.180.56: http://ebay-loginpage.com 12.207.38.75: http://ebay-loginpage.com/ 61.223.193.166: http://ebay-loginpage.com/ 85.137.184.131: http://ebay-loginpage.com/ 211.212.84.200: http://ebay-loginpage.com/ 24.147.168.88: http://ebay-loginpage.com/ 143.107.228.233: http://ebay-loginpage.com/ 24.175.96.61: http://ebay-loginpage.com/ 24.175.96.61: http://ebay-loginpage.com/ 80.99.29.32: http://ebay-loginpage.com/ 199.222.69.90: http://211.92.164.43/paypal/login.html 66.163.169.223: http://62.14.104.42/popcond/cgi-bin/webscr/cmd_login/submit/login_cmd/login… 66.163.169.227: http://62.14.104.42//popcond/cgi-bin/webscr/cmd_login/submit/login_cmd/logi… 66.163.170.7: 62.14 one 218.71.219.118: http://61.8.248.242/paypal/ 201.3.200.130: http://200.126.231.52/verify/paypalDLLUPDATE/index.html 81.154.223.105: http://61.8.248.242/paypal/ There are too many, here are all the ip addresses so far. Except for the paypal one, nearly all of them point to that ebay-loginpage link.: 12.207.38.75 143.107.228.233 143.107.228.233 161.67.47.158 161.67.47.158 172.193.163.214 194.126.113.99 201.132.84.249 202.160.31.55 207.14.190.25 210.124.50.122 211.204.200.248 211.207.71.179 211.207.71.179 211.212.84.200 211.238.88.66 213.10.229.235 218.20.62.11 218.52.113.198 218.52.113.198 218.74.7.184 219.74.51.148 220.117.95.86 220.117.95.86 220.75.20.2 220.77.180.56 220.77.245.178 220.91.135.89 220.92.95.169 221.143.218.203 221.220.115.241 222.116.57.65 222.121.181.227 222.136.148.24 222.209.126.58 222.248.162.59 222.97.136.193 222.97.136.193 24.12.180.41 24.12.180.41 24.132.102.192 24.136.234.85 24.136.234.85 24.147.168.88 24.147.168.88 24.161.195.248 24.171.68.170 24.175.96.61 59.189.82.23 59.19.143.13 59.23.88.148 61.110.240.238 61.223.193.166 61.84.102.163 61.91.197.226 65.184.247.8 66.169.92.212 67.163.166.132 68.161.28.204 68.161.50.212 68.59.7.246 69.250.34.189 80.131.76.88 80.48.131.35 80.8.64.78 80.99.29.32 81.153.23.110 81.9.129.170 81.9.129.170 82.123.168.1 82.155.149.110 83.145.180.107 84.0.191.93 84.121.40.154 84.94.184.172 84.94.192.145 85.137.184.131

3 3

RE: [SURBL-Discuss] Fw: heads up, massive phishing going on.
by Chris Santerre 28 Apr '05

28 Apr '05

>-----Original Message----- >From: Kevin A. McGrail [mailto:kmcgrail@pccc.com] >Sent: Thursday, April 28, 2005 2:41 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Fw: heads up, massive phishing going on. > > >Can't send them for privacy reasons as they are addressed to users :-( > >> Submit a few samples of those to SURBL so the target URL gets listed. >> Also feed them to the ClamAV people (http://www.clamav.net/). >> >> ClamAv now has anti-phishing rules in its virus scanner and >recently I've >> seen its blocked phishes outnumber the blocked viri. Added all the IPs to black.uribl.com server. Thanks for the heads up. Chris Santerre System Admin and SARE/URIBL Ninja http://www.rulesemporium.com http://www.uribl.com

1 0

RE: [SURBL-Discuss] russian pill-pushing gangsters
by Chris Santerre 27 Apr '05

27 Apr '05

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Tuesday, April 26, 2005 7:00 PM > To: Chris Santerre > Cc: 'SURBL Discussion list' > Subject: Re: [SURBL-Discuss] russian pill-pushing gangsters > > > On Tuesday, April 26, 2005, 1:13:01 PM, Chris Santerre wrote: > > >>PS: up til now, I've been feeding domains to Chris S.; what > do I need > >>to do to submit these directly? > > > Steve means since I don't update SURBL anymore, what does he do? > > > Bret was correct: > > http://www.rulesemporium.com/cgi-bin/uribl.cgi > > is the only place. > > > The uribl.com submission page should be up soon. Its > different from the > > SURBL. Allows for quicker additions. > > Hmm, are the other people (besides yourself) who were helping > with the public submissions into ws.surbl.org through > http://www.rulesemporium.com/cgi-bin/uribl.cgi still going to be > helping with that? I can't speak for them. I removed myself from submissions the day I left SURBL. > If not, perhaps the SURBL submission page there > should go away, or people directed to use SpamCop instead. Thats your choice. I never intended to take it down. > > Note: I hope at least the SURBL lookup page there will still stay > up. Many people find it useful. Why on earth would you think I would remove it??? I would never recommend that unless you did something completely ridiculous....like saying baseball is better then Ice Hockey :) --Chris

3 2

RE: [SURBL-Discuss] russian pill-pushing gangsters
by Chris Santerre 27 Apr '05

27 Apr '05

> -----Original Message----- > From: Doc Schneider [mailto:maddoc@maddoc.net] > Sent: Tuesday, April 26, 2005 9:01 PM > To: Jeff Chan; SURBL Discussion list > Subject: Re: [SURBL-Discuss] russian pill-pushing gangsters > > > Jeff Chan wrote: > > On Tuesday, April 26, 2005, 6:46:22 PM, Chris Santerre wrote: > > > >>But the thought never > >>crossed my mind to remove. Why would it? I still love you > like a long lost, > >>twice removed, step cousin that used to steal my bike ;) > > > > > >>Or are you just asking about the "choice" part? I meant its > your choice if > >>you would like to leave it up or down. I'm sure the group > would go either > >>way. If you have less people handling submissions and want > to tell ppl to > >>report to SC, that might be good. > > > > > > We'll I'd say leave the submission page up, and definitely leave > > the checker page up. > > > > I have basically no visibility on the SARE side of things, > > so I don't know if they have people handling submissions. > > Maybe someone from SARE can address this. > > Jeff, > > Rest assured there are a few SARE ninjas involved with SURBL and also > doing additions to ws. I happen to be one of them! > > And as far as removing the link from rulesemporium... I, for > one, would > pitch a fit! Now see! There you have it! :) You don't want to see Doc pitching a fit. Its bad enough he would be throwing ninja smoke bombs and deadly darts. But he's also highly medicated! He might get out the dym-mak (Death Touch!) It would be just like the time Ninja Bob got into the Saki closet! Ninja Fred is still healing! --Chris (Run ninjas-----RUN!)

1 0

RE: [SURBL-Discuss] russian pill-pushing gangsters
by Chris Santerre 27 Apr '05

27 Apr '05

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Tuesday, April 26, 2005 7:53 PM > To: 'SURBL Discussion list' > Subject: Re: [SURBL-Discuss] russian pill-pushing gangsters > > > On Tuesday, April 26, 2005, 5:52:27 PM, Chris Santerre wrote: > >> From: Jeff Chan [mailto:jeffc@surbl.org] > > >> Hmm, are the other people (besides yourself) who were helping > >> with the public submissions into ws.surbl.org through > >> http://www.rulesemporium.com/cgi-bin/uribl.cgi still going to be > >> helping with that? > > > I can't speak for them. I removed myself from submissions > the day I left > > SURBL. > > >> If not, perhaps the SURBL submission page there > >> should go away, or people directed to use SpamCop instead. > > > Thats your choice. I never intended to take it down. > > Acutally I would think it's the choice of the people who run the > rulesemporium.com site. If that's not you, then who is it? Yup. In everyone of my projects, there is a group. I can, and have, been overruled in a heartbeat. Frankly, I think a few of those guys like to do it for fun. I know I enjoy it when they do it :) So yes, there would have had to have been a vote. But the thought never crossed my mind to remove. Why would it? I still love you like a long lost, twice removed, step cousin that used to steal my bike ;) Or are you just asking about the "choice" part? I meant its your choice if you would like to leave it up or down. I'm sure the group would go either way. If you have less people handling submissions and want to tell ppl to report to SC, that might be good. I'm here to help. Seriously...I am! Stop laughing! --Chris (I'm joking. I still like Jeff. Much more when BF2 comes out!)

3 2

More xs.surbl.org stats
by Owen, Daniel 27 Apr '05

27 Apr '05

I'm impressed with the FP rate so far. 4/26/05 total e-mails: 7641 total strikes: 1066 (14% of total e-mail) spam strikes: 1066 ham strikes: 0 total messages marked as spam (all rules): 4679 (61.2% of total e-mail) total messages marked as spam (all rules) also marked by XS: 1041 also in: URIBL_AB_SURBL: 254 URIBL_OB_SURBL: 911 URIBL_SC_SURBL: 565 URIBL_WS_SURBL: 707 URIBL_JP_SURBL: 1004 NOT in any one of the above: 48 (4.5% of total XS strikes) This email contains privileged and confidential information intended only for the use of the person to whom it is directed and intended. Any reproduction, dissemination or other use of this email by anyone who is not the intended recipient is strictly prohibited. If you have received this email in error, you should advise the sender immediately and delete the email from your mail box.

1 0

RFC: How to use new data source: URIs advertised through CBL-listed senders
by Jeff Chan 27 Apr '05

27 Apr '05

We've been working for a few weeks with the folks at CBL to extract URIs appearing on their extensive spam traps that also trigger inclusion in CBL, i.e. zombies, open proxies, etc. What this means is that we can get URIs of spams that are sent using zombies and open proxies, where that mode of sending is a very good indication of spamminess since legitimate senders probably don't use hijacked hosts or open proxies to send their mail. For anyone not familiar with CBL, here are a few words about it. IP addresses of compromised senders like zombies and open proxies end up in cbl.abuseat.org and xbl.spamhaus.org, which are widely used to block spam senders at the MTA level. Experience with this RBL shows it to be very accurate and useful indicators of compromised senders with a low false positive rate. Many systems and networks find these RBLs useful to block on, with good results. http://cbl.abuseat.org/ One of the goals of looking at URIs appearing on the CBL traps in messages also triggering CBL inclusion is to get listings of new URIs into SURBLs sooner. One of the valid criticisms of SURBLs is that there is too much delay between the time a URI is first used and it gets listed in SURBLs. This is a problem with RBLs in general, and it means that the targeted senders (or URIs) have a window of time before detection and list inclusion where they can send unhindered. One advantage we have with SURBLs is that the hosts mentioned in spam URIs tend to be longer-lasting than the compromised spam senders. In other words URIs are often somewhat more "durable" indicators of spams than zombie IP addresses. Zombie usage is often rather fleeting and in the minutes to hours range, where URI usage can be in the days to weeks range. Therefore if we can find URIs sent by zombies, we can potentially "bridge the gap" and get new URI hosts blacklisted sooner. In that sense they work together with and improve the effectiveness of RBLs like CBL by creating a longer-lasting and more persistent view of some of the same types of messages that get caught by RBLs, by taking a closer look at the content of those messages, specifically the sites they advertise. An aspect of the CBL URI data that makes them potentially very attractive as a new data source for SURBLs is that the CBL traps are very extensive and specifically focussed on and correlated with zombie and open proxy detection. As such, it's somewhat orthogonal to other existing SURBL data sources which are manual lists, user reports, or smaller, but still rather substantial *spam-focussed* traps. As a new data source, CBL URIs could therefore complement our existing sources quite well due to its size and differing composition, thus hopefully increasing the overall detection performance of SURBLs in general. Like most URI data sources, the main problem with the CBL URI data is false positives or appearance of otherwise legitimate domains. For example amazon.com is one that appears frequently. This does not mean that amazon.com is using zombies to send mail, or that the CBL traps have been deliberately poisoned, but that spammers occasionally mention legitimate domains like amazon.com in their spams. FPs aside, the CBL URI data does indeed appear to include other domains operating for the benefit of spammers or their customers. These are the new domains we would like to catch. Our challenge therefore is to find ways to use those while excluding the FPs. Some solutions that have been proposed so far are: 1. Counting trap appearance volume and taking the top most often appearing URIs. 2. Including domains and the infrequent IP that are already in other SURBLs. This is useful as a confirmation of a zombieness dimension of existing SURBL records. 3. Including domains that resolve into sbl.spamhaus.org as NS, MX or web host records. 4. Excluding records already in our somewhat limited whitelists. In fact we have an existing program which takes a combination of the first four to produce a list, but the output of that program is not yet published in SURBL form. We may put these in the 128th-bit position of multi.surbl.org to begin testing, but looking at the data there are probably still too many FPs to put it into official production use. Consider some of the additional possibilities below which are not currently being done, and let us know if you think it may be useful to start publishing the above data. 5. Including domains that resolve into the IP space of manually reported URIs, for example from the SpamCop spamvertised site data used in sc.surbl.org and ab.surbl.org. 6. Doing regular (probably nightly) manual review of SURBL additions and whitelisting FPs that appear. (This should probably be done regardless of any new data sources.) Obviously we can't check every new domain that appears on SURBLs, but we could set up criteria to flag checking, such as domain registration older than 90 days, non-inclusion in SBL, few NANAS reports, etc. Some kind of rating engine using those or other criteria could be applied to new listings to flag manual review of some of the more likely FPs. We would not automatically whitelist these, but flag them for further checking. CBL URI data may well represent a useful new data source, but the best way to determine that may be to start using them. However I'd like your comments on some of the above FP mitigation ideas and any new ideas anyone may have for that purpose before we put these new data into production. Therefore please speak up if you have any ideas or comments, Jeff C. -- "If it appears in hams, then don't list it."

8 23

RE: [SURBL-Discuss] russian pill-pushing gangsters
by Chris Santerre 27 Apr '05

27 Apr '05

> >PS: up til now, I've been feeding domains to Chris S.; what do I need >to do to submit these directly? Steve means since I don't update SURBL anymore, what does he do? Bret was correct: http://www.rulesemporium.com/cgi-bin/uribl.cgi is the only place. The uribl.com submission page should be up soon. Its different from the SURBL. Allows for quicker additions. Yes these domains were already added to URIBL.com's lists :) --Chris

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss