- Discuss - Mailman 3

More xs.surbl.org stats
by Owen, Daniel 27 Apr '05

27 Apr '05

I'm impressed with the FP rate so far. 4/26/05 total e-mails: 7641 total strikes: 1066 (14% of total e-mail) spam strikes: 1066 ham strikes: 0 total messages marked as spam (all rules): 4679 (61.2% of total e-mail) total messages marked as spam (all rules) also marked by XS: 1041 also in: URIBL_AB_SURBL: 254 URIBL_OB_SURBL: 911 URIBL_SC_SURBL: 565 URIBL_WS_SURBL: 707 URIBL_JP_SURBL: 1004 NOT in any one of the above: 48 (4.5% of total XS strikes) This email contains privileged and confidential information intended only for the use of the person to whom it is directed and intended. Any reproduction, dissemination or other use of this email by anyone who is not the intended recipient is strictly prohibited. If you have received this email in error, you should advise the sender immediately and delete the email from your mail box.

1 0

RFC: How to use new data source: URIs advertised through CBL-listed senders
by Jeff Chan 27 Apr '05

27 Apr '05

We've been working for a few weeks with the folks at CBL to extract URIs appearing on their extensive spam traps that also trigger inclusion in CBL, i.e. zombies, open proxies, etc. What this means is that we can get URIs of spams that are sent using zombies and open proxies, where that mode of sending is a very good indication of spamminess since legitimate senders probably don't use hijacked hosts or open proxies to send their mail. For anyone not familiar with CBL, here are a few words about it. IP addresses of compromised senders like zombies and open proxies end up in cbl.abuseat.org and xbl.spamhaus.org, which are widely used to block spam senders at the MTA level. Experience with this RBL shows it to be very accurate and useful indicators of compromised senders with a low false positive rate. Many systems and networks find these RBLs useful to block on, with good results. http://cbl.abuseat.org/ One of the goals of looking at URIs appearing on the CBL traps in messages also triggering CBL inclusion is to get listings of new URIs into SURBLs sooner. One of the valid criticisms of SURBLs is that there is too much delay between the time a URI is first used and it gets listed in SURBLs. This is a problem with RBLs in general, and it means that the targeted senders (or URIs) have a window of time before detection and list inclusion where they can send unhindered. One advantage we have with SURBLs is that the hosts mentioned in spam URIs tend to be longer-lasting than the compromised spam senders. In other words URIs are often somewhat more "durable" indicators of spams than zombie IP addresses. Zombie usage is often rather fleeting and in the minutes to hours range, where URI usage can be in the days to weeks range. Therefore if we can find URIs sent by zombies, we can potentially "bridge the gap" and get new URI hosts blacklisted sooner. In that sense they work together with and improve the effectiveness of RBLs like CBL by creating a longer-lasting and more persistent view of some of the same types of messages that get caught by RBLs, by taking a closer look at the content of those messages, specifically the sites they advertise. An aspect of the CBL URI data that makes them potentially very attractive as a new data source for SURBLs is that the CBL traps are very extensive and specifically focussed on and correlated with zombie and open proxy detection. As such, it's somewhat orthogonal to other existing SURBL data sources which are manual lists, user reports, or smaller, but still rather substantial *spam-focussed* traps. As a new data source, CBL URIs could therefore complement our existing sources quite well due to its size and differing composition, thus hopefully increasing the overall detection performance of SURBLs in general. Like most URI data sources, the main problem with the CBL URI data is false positives or appearance of otherwise legitimate domains. For example amazon.com is one that appears frequently. This does not mean that amazon.com is using zombies to send mail, or that the CBL traps have been deliberately poisoned, but that spammers occasionally mention legitimate domains like amazon.com in their spams. FPs aside, the CBL URI data does indeed appear to include other domains operating for the benefit of spammers or their customers. These are the new domains we would like to catch. Our challenge therefore is to find ways to use those while excluding the FPs. Some solutions that have been proposed so far are: 1. Counting trap appearance volume and taking the top most often appearing URIs. 2. Including domains and the infrequent IP that are already in other SURBLs. This is useful as a confirmation of a zombieness dimension of existing SURBL records. 3. Including domains that resolve into sbl.spamhaus.org as NS, MX or web host records. 4. Excluding records already in our somewhat limited whitelists. In fact we have an existing program which takes a combination of the first four to produce a list, but the output of that program is not yet published in SURBL form. We may put these in the 128th-bit position of multi.surbl.org to begin testing, but looking at the data there are probably still too many FPs to put it into official production use. Consider some of the additional possibilities below which are not currently being done, and let us know if you think it may be useful to start publishing the above data. 5. Including domains that resolve into the IP space of manually reported URIs, for example from the SpamCop spamvertised site data used in sc.surbl.org and ab.surbl.org. 6. Doing regular (probably nightly) manual review of SURBL additions and whitelisting FPs that appear. (This should probably be done regardless of any new data sources.) Obviously we can't check every new domain that appears on SURBLs, but we could set up criteria to flag checking, such as domain registration older than 90 days, non-inclusion in SBL, few NANAS reports, etc. Some kind of rating engine using those or other criteria could be applied to new listings to flag manual review of some of the more likely FPs. We would not automatically whitelist these, but flag them for further checking. CBL URI data may well represent a useful new data source, but the best way to determine that may be to start using them. However I'd like your comments on some of the above FP mitigation ideas and any new ideas anyone may have for that purpose before we put these new data into production. Therefore please speak up if you have any ideas or comments, Jeff C. -- "If it appears in hams, then don't list it."

8 23

RE: [SURBL-Discuss] russian pill-pushing gangsters
by Chris Santerre 27 Apr '05

27 Apr '05

> >PS: up til now, I've been feeding domains to Chris S.; what do I need >to do to submit these directly? Steve means since I don't update SURBL anymore, what does he do? Bret was correct: http://www.rulesemporium.com/cgi-bin/uribl.cgi is the only place. The uribl.com submission page should be up soon. Its different from the SURBL. Allows for quicker additions. Yes these domains were already added to URIBL.com's lists :) --Chris

2 1

russian pill-pushing gangsters
by Steven Champeon 27 Apr '05

27 Apr '05

One (and possibly two) of my domains are being joe'd at the moment, and I'd like to submit the following domains to SURBL: amotusfemmf .com jocosehnajj .com unbungkanbe .com uigurimfif .com eremichnmnl .com editehkce .com revertalmgd .com tanachklgmj .com vadymbicm .com burtonabdea .com dutchibabd .com akimbomjmcm .com phudleaj .com Thanks, Steve PS: up til now, I've been feeding domains to Chris S.; what do I need to do to submit these directly? -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us! http://hesketh.com/about/careers/account_manager.html join us!

3 2

RE: [SURBL-Discuss] "surgically" blocking certain redirectors
by Chris Santerre 26 Apr '05

26 Apr '05

>-----Original Message----- >From: Rob McEwen [mailto:rob@powerviewsystems.com] >Sent: Tuesday, April 26, 2005 10:56 AM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] "surgically" blocking certain redirectors > > >Jeff said: >"It is possible to blacklist nina.18.to but not 18.to if nina >is owned by >spammers but 18 is not." > >Why not then add certain redirectors to the SURBL lists where >the redirector >is deemed to NOT be found in hams? Specifically, I'm referring >to situations >where we could list redirect.somedomain.com but NOT list somedomain.com > >Rob McEwen There will be a SARE ruleset out shortly that will tag these redirectors. You can then score to taste. The Ninjas do it again!! --Chris

1 0

OT: What's up with spamcop...
by Patrik Nilsson 26 Apr '05

26 Apr '05

Once again, outgoing IPs for bulk.scd.yahoo.com, sourceforge.net, etc, are getting listed on spamcop. I thought they had got past these kind of obvious FP problems. Anyone know what is going on? Patrik

1 0

Re: [SURBL-Discuss] russian pill-pushing gangsters
by List Mail User 26 Apr '05

26 Apr '05

>... > > >One (and possibly two) of my domains are being joe'd at the moment, >and I'd like to submit the following domains to SURBL: > >amotusfemmf .com >jocosehnajj .com >unbungkanbe .com >uigurimfif .com >eremichnmnl .com > >editehkce .com >revertalmgd .com >tanachklgmj .com >vadymbicm .com > >burtonabdea .com >dutchibabd .com >akimbomjmcm .com >phudleaj .com > >Thanks, >Steve > >PS: up til now, I've been feeding domains to Chris S.; what do I need >to do to submit these directly? > >-- >hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com >join us! http://hesketh.com/about/careers/account_manager.html join us! >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Several of these domains were part of a fraud purpertrated by YesNIC yesterday. The name servers were removed from the registration data listings, but the "Updated Date" was not changed. I filed complaints at the internic about sevral of them. Given that they now (at least the ones I've checked) have no name servers, they are eligible for nomination to rfci's "whois" list (if I have been there first), and subject to delisting by filing the form at the internic (i.e. wdprs.internic.net - just fill out the section of name servers, noting that they have none). One of them, jocosehnajj. com, is a brand new registration, it didn't show up at the internic this morning, nut by a good guess, I found it at whois.directnic.net. Paul Shupak track(a)plectere.com

1 0

XS hits
by Paul Shields 24 Apr '05

24 Apr '05

Below are some stats from our incoming mail since midnight 23/04/05. I'm not going to go into too deep an analysis as it's the weekend and I'm too 'tired' to do that ;). Total nbr of messages with at least one ??_SURBL hit over the last 22 hours was around 1.4 million. The counts below show how many triggered as 'spam' ("result: Y"), and how many didn't trigger ("result: \."). This is based on our Spam Assassin default threshold of 8, but we have many custom rules so spam threshold is really only meaningful to our config - YMMV ;). We don't currently block or tag via SURBL/RBL at the MTA layer - everything goes through SA. XS popped up reasonably frequently in all SURBL hits - and we had 10456 XS spam hits where it wasn't listed in any other URIBL (unable to say how many false-positives out of that list, but our default tagging threshold is high in SA and FP's are vanishingly small). Anyway - make of it as you will. SURBL rocks anyway - XS *may* be a useful addition. Cheers Paul -- --- List of all messages (spam and non-spam) that included a SURBL hit: report01:/tmp# wc surbl-2005-04-23.log 1447355 SURBL XS Non-spam report01:/tmp# cat surbl-2005-04-23.log|grep XS_SURBL|grep -c "result: \." 6283 SURBL XS Spam (including messages that had other SURBL hits) report01:/tmp# cat surbl-2005-04-23.log|grep XS_SURBL|grep -c "result: Y" 939134 --- Nbr of XS spam hits that weren't in any other SURBL lists: report01:/tmp# cat surbl-2005-04-23.log| egrep -v "URIBL_AB_SURBL|URIBL_OB_SURBL|URIBL_PH_SURBL|URIBL_SC_SURBL|URIBL_WS_SURBL|URIBL_JP_SURBL" |grep -c "result: Y" 10456 -- Nbr of non-spam XS hits (not in any other SURBL lists): report01:/tmp# cat surbl-2005-04-23.log|egrep -v "URIBL_AB_SURBL|URIBL_OB_SURBL|URIBL_PH_SURBL|URIBL_SC_SURBL|URIBL_WS_SURBL|URIBL_JP_SURBL" |grep -c "result: \." 5300 --- AB non spam report01:/tmp# cat surbl-2005-04-23.log|grep AB_SURBL|grep -c "result: \." 604 AB spam report01:/tmp# cat surbl-2005-04-23.log|grep AB_SURBL|grep -c "result: Y" 521886 --- WS non-spam report01:/tmp# cat surbl-2005-04-23.log|grep WS_SURBL|grep -c "result: \." 12578 WS spam report01:/tmp# cat surbl-2005-04-23.log|grep WS_SURBL|grep -c "result: Y" 996200 --- JP non-spam report01:/tmp# cat surbl-2005-04-23.log|grep JP_SURBL|grep -c "result: \." 4376 JP spam report01:/tmp# cat surbl-2005-04-23.log|grep JP_SURBL|grep -c "result: Y" 1234602 --- OB non-spam report01:/tmp# cat surbl-2005-04-23.log|grep OB_SURBL|grep -c "result: \." 36760 OB spam report01:/tmp# cat surbl-2005-04-23.log|grep OB_SURBL|grep -c "result: Y" 1139181 --- SC non-spam report01:/tmp# cat surbl-2005-04-23.log|grep SC_SURBL|grep -c "result: \." 1095 SC spam report01:/tmp# cat surbl-2005-04-23.log|grep SC_SURBL|grep -c "result: Y" 751549 --- PH non-spam report01:/tmp# cat surbl-2005-04-23.log|grep PH_SURBL|grep -c "result: \." 1 PH spam report01:/tmp# cat surbl-2005-04-23.log|grep PH_SURBL|grep -c "result: Y" 383

3 4

Re: New xs.surbl list
by Jeff Chan 23 Apr '05

23 Apr '05

[forwarded with Paul's permission. Please comment.] From: Jeff Chan To: Paul Shupak Date: Friday, April 22, 2005, 12:06:46 AM Subject: New xs.surbl list On Thursday, April 21, 2005, 6:16:16 PM, Paul wrote: > Jeff, > I don't know the current method used to decide when to add domains > to your new list, and I definitely see *much* smaller levels of spam than > many others on the various mailing lists. It's the top 97th percentile of hits, which only gets about a hundred more new records (domains and IPs) than we already have in SURBLs. We can crank that up later when we get the FP issues nailed down better, though improved processing techniques. > However, my own experience, so far, > is that absolutely no "zero-hour" spams have been caught, Yes, that's because the new URI hit counts must overcome the mass of earlier reports. There may be smarter ways to organize this, but simply lowering the threshold of inclusion (e.g., going to the 98th percentile) would get more on the list sooner. > but very many Spamcop > reports (about 1/2 hour later) do trigger; So I have to agree with the few who > have suggested a much more aggressive decision about when to add. Yes, I agree too. :-) When I announced the list for testing I said we'd start conservative to get a feeling for the data. > I'm making my own proposal here to avoid the political complications > of which sources I will suggest using: > Clearly, since the attempt is to catch domains, and RHS list is of no > value for verification. I would propose a "point system" where you assign one > point each for every hit of both the URI's own IP and each of its name servers > IPs for each of the following lists: > sbl.spamhaus.org > combined-HIB.dnsiplists.completewhois.com [ combined-HIB.dnsiplists.completewhois.com is a composite list of bogus IP blocks, hijacked IPs, and blocks with invalid whois data. See: http://www.completewhois.com/bogons/bogons_usage.htm ] > and one point for each SpamCop report. A likely total score of 5 or 6 should > probably trigger its inclusion - i.e. it would be possible to get on the list > by having the original URI and two of the name servers on each list, despite > not yet having any SpamCop reports (in the middle of the day, SpamCop slows > down greatly - sometimes to a crawl, with one hour+ turn-around time between > reporting and verification - and you get the data some time later!). > Possibly adding some of the even more aggressive lists like FIVETEN > and NOMOREFUNN at a half point (or other lower weight) could help also. You > can alway revisit the entries at a later time (i.e. if the "aggressive" points > are used to add the entry, the timeout can be set low -- If a more conservative > scheme later applies also, the timeout can be raised to its full value). > I think this would give a much better chance of catching "zero-hour" > spam. So far, I have 12 SpamCop reports, that have hit XS (about 10 hours of > use), but not a single original spam (out of ~110). > Just an idea. > Bye, > paul Good suggestions. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

3 5

RE: Research wanted: age of spam gang URI domains
by Chris Santerre 23 Apr '05

23 Apr '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, April 21, 2005 7:46 PM >To: SURBL Discuss; SpamAssassin Users >Subject: Research wanted: age of spam gang URI domains > > >Does anyone have research or references for the age profiles of >domains appearing in the URIs of spam gang (i.e. Ralsky, Lindsay, >Richter, etc.) spams? In other words, how old are the domains of >sites being spamvertised *by spam gangs*? (By age I mean how >long ago they were (most recently) created.) > >Jeff C. Off the top of my nogging, I've seen the major guys be about 1-3 days from registering. However...... I also saw a pattern a few spammers using ones registered 3 months prior. This is when I began to theorise that there was possibly a spam domain service. Someone simply registering domain names full time, then selling them out to other spammers. I started researching the idea, then got busy on other stuff. When things settle I'll try to pick back up on the research. Sorry I don't have any hard data for you. --Chris

4 4

XS FP
by Daniel Kleinsinger 23 Apr '05

23 Apr '05

XS tagged an email from peak.org. I can't forward the email, but peak.org seems to be an ISP in Oregon. Also, the only place peak.org appears in the email is in a section of the email showing envelope information from a previous email in the reply chain. >Date: Wed, 20 Apr 2005 03:54:43 -0700 (PDT) >Subject: Re: blah blah blah blah >From: businesscontact(a)peak.org >To: "someone" <someone(a)mindspring.com> Does that look like a URL to the URIBL plugin? I'm using SA 3.0.2. That's been the only email tagged by XS that had a final score less than 10 so it was easy to spot. Daniel

2 1

Re: [SURBL-Discuss] Testing: xs.surbl.org (CBL Data)
by Jeff Chan 23 Apr '05

23 Apr '05

Chris Barton of McAfee spotted the following FPs in the XS data. Looks like they could all be avoided by a date of registration filter where domain registrations older than say 1 year were excluded. Anyone have feedback on Chris' findings? Engineering a date of registration engine is probably my next project. It could be used as a general tool within SURBLs. (If anyone has an existing tool to share, it could definitely help.) Jeff C. __ Some possible xs. FP's for you... ets.org NANAS 27 - mostly mailto's by the look of it. no SBL/XBL - no spamcop Created On:10-Oct-1994 javaworld.com NANAS 7 - all old, no SBL/XBL no spamcop Created On: 1995-Nov-22 disneyland.com - no brainer? 91x.net - NANAS DODGY - Looks like a URL service - http://91i.net/index.shtml - Also on multi. - no spamcop - No XBL/SBL - Creation Date: 19-sep-2003 atspace.com NANAS 12 - host with a few small issues - look ok - NO XBL/SBL/spamcop - Creation Date: 16-jan-2004 dante.net - NANAS 18 - ISP with a few issues - look ok - NO sbl/xbl/spamcop - Created 1993 epolitix.com - NANAS 0 - no xbl/sbl/spamcop - look ok - created 1999 hopto.org - NANAS DODGY but it belongs to no-ip.com who are cool. kit.net - NANAS VERY DODGY - Looks like a URL service though. Listed on multi. created 1997 no xbl/sbl/spamcop I wouldn't like to call it ham at this point as it appears to have a hosting issue atm. peak.org - NANAS DODGY - Looks like an ISP with a few issues to me, nice spam filter logo - no XBL/SBL/spamcop created 21-Dec-1994 qq.com - looks like a portal rather than spammers - no xbl/sbl - NANAS 134 - created 04-may-1995 researchandmarkets.com - NANAS 18 - no xbl/sbl/spamcop - created 1992

1 0

xs.surbl.org
by David Coulson 23 Apr '05

23 Apr '05

I have this zone loaded on my three name servers - I tried to e-mail Jeff, but his mail server incorrected performed a SPF query against an internal IP in the mail headers rather than against the IP which actually connected to surbl.org to deliver the message. David

2 1

RE: [SURBL-Discuss] xs.surbl.org preliminary results
by Owen, Daniel 22 Apr '05

22 Apr '05

Correction I just realized that these numbers are slightly skewed. I drop any e-mail that SA scores above a 20.9 . So all of the numbers should probably be slightly higher. As far as FPs go I don't see FPs being affected at all. I just wanted to add the note in since it means that the XS rules may have a higher strike percentage than this indicates. I'm considering letting everything come through tagged without dropping anything for a 24 hour period just to see what the real one day numbers are. Beyond this testing it would be helpful for me just to see how much mail I really am blocking. If I decide to do that it'll be sometime mid next week. -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Owen, Daniel Sent: Friday, April 22, 2005 11:56 AM To: SURBL Discussion list; Jeff Chan Subject: RE: [SURBL-Discuss] xs.surbl.org preliminary results More stats. I'll continue to do these internally but unless something interesting comes up I probably won't post stats on a daily basis unless someone wants to see them. 4/21/05 total e-mails: 9059 total strikes: 1226 (13.5% of total e-mail) spam strikes: 1225 ham strikes: 1 (see details below) total messages marked as spam (all rules): 6917 (76.4% of total e-mail) total messages marked as spam (all rules) also marked by XS: 1187 also in: URIBL_AB_SURBL: 244 URIBL_OB_SURBL: 956 URIBL_PH_SURBL: 0 URIBL_SC_SURBL: 872 URIBL_WS_SURBL: 1008 URIBL_JP_SURBL: 1077 NOT in any one of the above: 107 (.087% of total XS strikes) The false positive: This was a mailing list posting. The sender was sending through input-MUNGE.com which has a standard disclaimer that includes input-MUNGED.com. Looking at news.admin.net-abuse.sightings I see several reports of advanced-inputMUNGED.com. Could that be it? I also see 3 that appear to have numerous garbage URLs included but they are 2003 and 2004 so they should not be the issue. Anyway. It's the first false positive I have seen using the XS list. URIBL_WS_SURBL also hits this one. This email contains privileged and confidential information intended only for the use of the person to whom it is directed and intended. Any reproduction, dissemination or other use of this email by anyone who is not the intended recipient is strictly prohibited. If you have received this email in error, you should advise the sender immediately and delete the email from your mail box. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: [SURBL-Discuss] xs.surbl.org preliminary results
by Owen, Daniel 22 Apr '05

22 Apr '05

More stats. I'll continue to do these internally but unless something interesting comes up I probably won't post stats on a daily basis unless someone wants to see them. 4/21/05 total e-mails: 9059 total strikes: 1226 (13.5% of total e-mail) spam strikes: 1225 ham strikes: 1 (see details below) total messages marked as spam (all rules): 6917 (76.4% of total e-mail) total messages marked as spam (all rules) also marked by XS: 1187 also in: URIBL_AB_SURBL: 244 URIBL_OB_SURBL: 956 URIBL_PH_SURBL: 0 URIBL_SC_SURBL: 872 URIBL_WS_SURBL: 1008 URIBL_JP_SURBL: 1077 NOT in any one of the above: 107 (.087% of total XS strikes) The false positive: This was a mailing list posting. The sender was sending through input-MUNGE.com which has a standard disclaimer that includes input-MUNGED.com. Looking at news.admin.net-abuse.sightings I see several reports of advanced-inputMUNGED.com. Could that be it? I also see 3 that appear to have numerous garbage URLs included but they are 2003 and 2004 so they should not be the issue. Anyway. It's the first false positive I have seen using the XS list. URIBL_WS_SURBL also hits this one. This email contains privileged and confidential information intended only for the use of the person to whom it is directed and intended. Any reproduction, dissemination or other use of this email by anyone who is not the intended recipient is strictly prohibited. If you have received this email in error, you should advise the sender immediately and delete the email from your mail box.

1 0

RE: [SURBL-Discuss] RE: Research wanted: age of spam gang URI dom ains
by Chris Santerre 22 Apr '05

22 Apr '05

Agreed John. What I saw was patterns, and the dates of the domains involved in the patterns corelated. It wasn't anything worth tagging off of, but an interesting bit of data none the less. When you get what appears to be 3 different spammers, with spam runs within days of each other, all using domains that have connections in their data...it gets the mind a wondering :) --Chris >-----Original Message----- >From: John_Delisle(a)ceridian.ca [mailto:John_Delisle@ceridian.ca] >Sent: Friday, April 22, 2005 10:27 AM >To: SURBL Discussion list >Cc: discuss-bounces(a)lists.surbl.org; SURBL Discuss; SpamAssassin Users >Subject: Re: [SURBL-Discuss] RE: Research wanted: age of spam gang URI >domains > > >Even if data re average age of the domains, wouldn't they just start >registering them earlier so as to not match that pattern? > >John Delisle, CISA >Senior Network Analyst, Network and Security Team >Information Systems & Technology Management Dept. >Ceridian Canada Ltd >600 - 125 Garry St >Winnipeg, MB >R3C 3P2 >204-975-5909 > > > > >Chris Santerre <csanterre(a)MerchantsOverseas.com> >Sent by: discuss-bounces(a)lists.surbl.org >04/22/2005 08:05 AM >Please respond to >SURBL Discussion list <discuss(a)lists.surbl.org> > > >To >"'Jeff Chan'" <jeffc(a)surbl.org>, SURBL Discuss ><discuss(a)lists.surbl.org>, >SpamAssassin Users <users(a)spamassassin.apache.org> >cc > >Subject >[SURBL-Discuss] RE: Research wanted: age of spam gang URI domains > > > > > > > > >>-----Original Message----- >>From: Jeff Chan [mailto:jeffc@surbl.org] >>Sent: Thursday, April 21, 2005 7:46 PM >>To: SURBL Discuss; SpamAssassin Users >>Subject: Research wanted: age of spam gang URI domains >> >> >>Does anyone have research or references for the age profiles of >>domains appearing in the URIs of spam gang (i.e. Ralsky, Lindsay, >>Richter, etc.) spams? In other words, how old are the domains of >>sites being spamvertised *by spam gangs*? (By age I mean how >>long ago they were (most recently) created.) >> >>Jeff C. > >Off the top of my nogging, I've seen the major guys be about >1-3 days from >registering. > >However...... > >I also saw a pattern a few spammers using ones registered 3 >months prior. >This is when I began to theorise that there was possibly a spam domain >service. Someone simply registering domain names full time, >then selling >them out to other spammers. I started researching the idea, >then got busy >on >other stuff. > >When things settle I'll try to pick back up on the research. >Sorry I don't >have any hard data for you. > >--Chris >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Testing: xs.surbl.org (CBL Data)
by Alex Broens 22 Apr '05

22 Apr '05

Guys, Jeff's little XtraSmall (CBL Data) lust, ehhhmm, list seems to be catching quite a bit of trash. give it a try: urirhsbl URIBL_XS_SURBL xs.surbl.org. A 2 body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL URL listed in XS SURBL - TEsting tflags URIBL_XS_SURBL net score URIBL_XS_SURBL 1.5 Score to your taste !!!!! Pretty sure Jeff is anxious to get FP reports. h2h Alex -- // no grey data here - its pi11z .-) //

6 8

Re: Discuss Digest, Vol 13, Issue 27
by Robert Menschel 22 Apr '05

22 Apr '05

> Message: 2 > Date: Thu, 21 Apr 2005 08:42:39 -0700 > From: "Bret Miller" <bret.miller(a)wcg.org> > Subject: [SURBL-Discuss] RE: missed URI redirector > To: "SURBL Discussion list" <discuss(a)lists.surbl.org> > Message-ID: <2fca43fc9d365a479a389643a1dbd138(a)mail.wcg.org> > Content-Type: text/plain; charset="us-ascii" >> just got this in a spam >> >> <A href="h >> t >> tp:/ >> /r.lycos.com/r/vn_swditarrx_csmqempf/http://cympgebdnrMUNGED.o >> rg&aeglnl0 >> oepml18w32zd6%2Ezin >> ciccg >> cag%2Ecom/"> >> <IMG >> SRC="cid:qlysaynv_milhjoua_qtobefxh" border="0" ALT=""></A> > Actually, I've been getting tons of spam with this lycos redirector over > the last week. Sure wish they'd close it down or we'd find a way to > parse redirector URIs for the real URI. FWIW, I've added the Lycos and ZDNet redirectors to the 70_sare_uri1.cf file I maintain with SARE. We'll have a mass-check of them in the next few days to determine a reasonable score, and hopefully publish early next week. Bob Menschel

1 0

missed URI redirector
by Matthew Wilson 22 Apr '05

22 Apr '05

just got this in a spam <A href="h t tp:/ /r.lycos.com/r/vn_swditarrx_csmqempf/http://cympgebdnrMUNGED.org&aeglnl0 oepml18w32zd6%2Ezin ciccg cag%2Ecom/"> <IMG SRC="cid:qlysaynv_milhjoua_qtobefxh" border="0" ALT=""></A>

4 3

Research wanted: age of spam gang URI domains
by Jeff Chan 22 Apr '05

22 Apr '05

Does anyone have research or references for the age profiles of domains appearing in the URIs of spam gang (i.e. Ralsky, Lindsay, Richter, etc.) spams? In other words, how old are the domains of sites being spamvertised *by spam gangs*? (By age I mean how long ago they were (most recently) created.) Jeff C. -- "If it appears in hams, then don't list it."

1 0

RE: [SURBL-Discuss] xs.surbl.org preliminary results
by Owen, Daniel 21 Apr '05

21 Apr '05

This is a different data set. 4/20/05 midnight to midnight CDT total e-mails: 6477 total strikes: 1513 (23.4% of total e-mail) spam strikes: 1513 ham strikes: 0 total messages marked as spam (all rules): 4210 (65% of total e-mail) total messages marked as spam (all rules) also marked by XS: 1478 also in: URIBL_AB_SURBL: 447 (29.5% of XS hits) URIBL_OB_SURBL: 1120 (74% of XS hits) URIBL_PH_SURBL: 0 URIBL_SC_SURBL: 1160 (76.7% of XS hits) URIBL_WS_SURBL: 1124 (74.3% of XS hits) URIBL_JP_SURBL: 1416 (93.6% of XS hits) NOT in any of the above: 61 (.041% of XS hits) Hey if it proves to be fairly FP proof that's 61 less emails I have to deliver per day after I raise the score a bit) -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Raymond Dijkxhoorn Sent: Thursday, April 21, 2005 2:23 PM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] xs.surbl.org preliminary results Hi! > total strikes: 204 > spam strikes: 204 > ham strikes: 0 > > total messages marked as spam (all rules): 1495 > total messages marked as spam (all rules) also marked by XS: 204 Would be interesting to check if those would have been picked up by (for example) JP, eg other SURBL lists. If its duplicates all over then it wont help much. I did a compare on the zonefiles but not that much fresh ones inside. So far.... Bye, Raymond. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss This email contains privileged and confidential information intended only for the use of the person to whom it is directed and intended. Any reproduction, dissemination or other use of this email by anyone who is not the intended recipient is strictly prohibited. If you have received this email in error, you should advise the sender immediately and delete the email from your mail box.

1 0

Re: [SURBL-Discuss] missed URI redirector
by List Mail User 21 Apr '05

21 Apr '05

zinciccgcag. com is part of the multitrade group and their attempt to move into the US. The registration address is false (does not exist) - report them to both wdprs and rfci. Also the name servers in ccpatoncejk. biz have a false postal code (and probably more) - also report to wdprs and rfci. For examples see: http://www.rfc-ignorant.org/tools/detail.php?domain=multitrade-corp.com&sub… and http://www.rfc-ignorant.org/tools/detail.php?domain=ddagraniale.com&submitt… Paul Shupak track(a)plectere.com

1 0

xs.surbl.org preliminary results
by Owen, Daniel 21 Apr '05

21 Apr '05

2 sets of hit rates follow. I'll try to find time to send my results on a daily basis as long as the info is useful. As you will see from the message volume this is a fairly small office. All messages are from the Internet. In other words no internal e-mail traffic is counted in any of these numbers. I am using the XS as a 1.5 point spam assassin rule in production so it may have pushed some of these over the top. My cutoff score of 5.8. For the numbers that follow I hand sorted anything that had less than 10 SA points. I rarely ever see a false positives so I'm fairly certain of these numbers. We are very sensitive to false positives so we run a pretty conservative rule base, but I do have some hand crafted rules that have high values that can push a message's spam score through the roof. The difference in strike rate between days is interesting but it's not the same time period. For the future I'll hit the same time period each day even if that means skipping the most recent data. That should show trending better. Of course it could be something else entirely pushing the first set of numbers up. Only time will tell. Set 1: time range 4/19/05 18:22 to 4/20/05 15:19 central time 4514 total e-mails spam strikes: 1783 ham strikes: 0 Set 2: time range 4/20/05 15:20 to 4/21/05 9:57 central time 2027 total e-mails total strikes: 204 spam strikes: 204 ham strikes: 0 total messages marked as spam (all rules): 1495 total messages marked as spam (all rules) also marked by XS: 204 Daniel This email contains privileged and confidential information intended only for the use of the person to whom it is directed and intended. Any reproduction, dissemination or other use of this email by anyone who is not the intended recipient is strictly prohibited. If you have received this email in error, you should advise the sender immediately and delete the email from your mail box.

2 1

[OT] More mirrors needed for New URIBL lists
by Chris Santerre 21 Apr '05

21 Apr '05

We are almost ready to go live with the new lists. However we need more mirrors...err...about 8 more to be safe! Please contact me offlist if you would like to provide a mirror. The more we get , the less traffic for everyone. :) Semi-public Submissions for the black and gray lists are coming soon. Chris Santerre System Admin and SARE/URIBL Ninja http://www.rulesemporium.com Disclaimer: The statements and opinions or URIBL.com are those of URIBL.com only. Any statements and opinions included in this post are not those of SURBL.com or its members. We are not responsible if URIBL.com gets your cat pregnant.

1 0

SMILE !
by Alex Broens 20 Apr '05

20 Apr '05

Talking about redirs... http://r.aol.com/cgi/redir-complex?url=http://www.penthouse.com Alex

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss