- Discuss - Mailman 3

HELP: RE: [SURBL-Discuss] ZDnet redirector still open.
by Chris Santerre 19 Mar '05

19 Mar '05

>-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Friday, March 18, 2005 9:36 AM >To: SUBL List >Subject: [SURBL-Discuss] ZDnet redirector still open. > > >Jeff, > >Could you pls make some extra noise so this hole gets closed. > >- or do we need to run an international press release? - or maybe some >extra pressure via Slashdot? > >Alex Maybe their competitors would like to run a story on it :) I know someone on SPAM-L list was trying to get it removed. Lets see what they say. I just dismantled an entire rack while everything was live. Boy was that fun! --Chris

3 2

ZDnet redirector still open.
by Alex Broens 18 Mar '05

18 Mar '05

Jeff, Could you pls make some extra noise so this hole gets closed. - or do we need to run an international press release? - or maybe some extra pressure via Slashdot? Alex

1 0

Recall: [SURBL-Discuss] Help for the Windows Guy!
by Jeff Baker 15 Mar '05

15 Mar '05

Jeff Baker would like to recall the message, "[SURBL-Discuss] Help for the Windows Guy!". All outbound email messages have been scanned for viruses and content with the e500 web appliance.

2 1

RE: [SURBL-Discuss] Help for the Windows Guy!
by Jeff Baker 15 Mar '05

15 Mar '05

Message to Kevin A. McGrail My apologies :(: for not getting back with you sooner. Other top-plate projects and out-of-state business, whew! I am very interested on the detailed information you have on implementing your tried-and-true methods for defending spam. I have a project to upgrade our McAfee e500 Webshield and SpamKiller to versions 3.x and it would be great to implement the solutions below. Our e500 sits inside our network, but should it sit in a DMZ and would this prevent receiving emails to invaliduser(a)thepantry.com? I would GREATLY Appreciate any detailed information you can spare! Thank you, Jeff Baker Network Systems Administrator Enterprise Backup Administrator The Pantry, Inc. Sanford, NC @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Kevin A. McGrail Sent: Wednesday, March 02, 2005 9:32 AM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] Help for the Windows Guy! Jeff: I think others looked at you wanting to run SA on Windows but I'm going to take a different tact since you are already running a linux box. In short, answer the question of how can I protect an exchange server from viruses & spam. First, I think you should look at Can-IT. They just released a "free as in beer" version for companies with less than 50 users. Otherwise the Can-IT Pro is a fabulous product and I always have to give them kudos for also releasing MIMEDefang as Open Source. http://www.roaringpenguin.com/ & http://www.roaringpenguin.com/anti_spam/free_canit.php Second, if you want to get into the nuts & bolts, you should run a linux box and install Sendmail 8.13.3 w/ Greet Pause & Bad Recipient Throttling, poprelayd-kam to blackhold the harvesting sites, then MIMEDefang, a milter written by the same people as CanIt. Have MD call SpamAssassin which implements SURBL. Add ClamAV or McAfee uvscan to the mix and you have great anti-viral features as well. Final step would be to configure LDAP on your linux box so you can "extend" the edge of your network to bounce bad emails ASAP. I've done this many many times and have instructions to help get you started if you want to take this avenue. Regards, KAM ----- Original Message ----- From: "Jeff Baker" <jeff.baker(a)thepantry.com> To: "SURBL Discussion list" <discuss(a)lists.surbl.org> Sent: Wednesday, March 02, 2005 8:42 AM Subject: RE: [SURBL-Discuss] Help for the Windows Guy! > > We use Exchange 2000 on our back-end server which is a Compaq DL380 > w/4gb memory. Currently we use McAfee's Groupshield on this unit. > > I'm not sure on an external call from Ex 2000. What was your experience > with spam before and after implementation of SA? > > -----Original Message----- > From: discuss-bounces(a)lists.surbl.org > [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Fred > Sent: Tuesday, March 01, 2005 5:34 PM > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] Help for the Windows Guy! > > I am one of the first to have jumped on this wagon, what type of mail > server > are you planning to install this in? Does it provide some way to tie in > an > external program? Each mail server is very different how they handle > this, > we used Vopmail and it provides what's called an "agent" which is a > batch > file you specify to be executed upon arrivial of mail. This works fine > but > you need to know how to program batch files... How you accomplish this > depends on what your mail server allows you to do. > It sure is easier setting up a freebsd box to run only e-mail and not > have > to worry about it for a long time! We haven't touched our mail servers > except to upgrade our clamAV once a year. > > When I ran SA under Win32, I had to keep a close eye on things to make > sure > they didn't blow up and let me assure you THEY WILL! > > Frederic Tarasevicius > Internet Information Services, Inc. > http://www.i-is.com/ > 810-794-4400 > > > Jeff Baker wrote: > > I want to implement SpamAssassin <http://spamassassin.apache.org/> 3 > > but I am just a Windows guy. I use McAfee's Spamkiller 2.7 on their > > e500 (linux) and it's just not doing the job. Someone please step me > > through the process of where and what to place SpamAssassin on. I see > > the wonderful reviews but this Windows guy knows nothing about linux. > > > > > > > > Thank anyone very much!!!! > > > > > > > > Jeff Baker > > > > Network Systems Administrator > > > > The Pantry, Inc. > > > > Sanford, NC 27330 > > > > jeff.baker(a)thepantry.com > > > > > > > > > > > > All outbound email messages have been scanned for viruses and content > > with the e500 web appliance. > > _______________________________________________ > > Discuss mailing list > > Discuss(a)lists.surbl.org > > http://lists.surbl.org/mailman/listinfo/discuss > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss > > > This message has been scanned for viruses and content with the e500 web > appliance. > > > > > > All outbound email messages have been scanned for viruses and content with the e500 web appliance. > > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss > _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss This message has been scanned for viruses and content with the e500 web appliance. All outbound email messages have been scanned for viruses and content with the e500 web appliance.

1 0

Spam Honeypot identification through SURBL
by Matthew Wilson 15 Mar '05

15 Mar '05

Jeff (and list), I'm worried that spammers can use SURBL to identify honeypot email servers by using unique subdomains. A spammer must merely send a unique subdomain URL to every address on their list, and if that unique subdomain is blacklisted in SURBL, they have identified a potential honeypot and will no longer send spam to that address/server. It is therefore my humble opinion that only the second-to-top domain name should be listed in SURBL, and not any of the subdomains. Thoughts? -Matthew Wilson

3 4

RE: [SPAM-TAG] Re: [SURBL-Discuss] A list of spammers urls
by Matthew.van.Eerde＠hbinc.com 15 Mar '05

15 Mar '05

Jeff Chan wrote: > On Friday, March 11, 2005, 2:30:05 PM, Matthew Eerde wrote: >> Jeff Chan wrote: >>> On Friday, March 11, 2005, 4:33:45 AM, Chris Edwards wrote: >>>> I wonder if there'd be much mileage in a SpamAssaassin feature to >>>> award points for any URLs that don't resolve ? >>> >>> In principle it's something that could be done, but the timeouts >>> encountered trying to resolve non-existent domains could make it >>> impractical. > >> Aren't the name resolution attempts done in parallel? > > Even if they are, there needs to be a reasonable timeout on > resolution set, like 10 seconds. That may not seem like a very > long delay, but it can keep open server memory allocations, etc. I see your point. "No such domain" and "no such entry at this domain" responses are very fast, though. Couldn't at least quick negative responses be worth points? Could use a timeout of one or two seconds to save server resources - with a timeout not being worth points at all. Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer perl -e"map{y/a-z/l-za-k/;print}shift" "Jjhi pcdiwtg Ptga wprztg,"

2 1

Fw: TKO Notice: Urgent Fraud Investigation
by Kevin A. McGrail 14 Mar '05

14 Mar '05

Is ebay running an open relay now???? See this phish below and look at this url! http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&Doma… Regards, KAM ----- Original Message ----- From: eBay(a)reply3.ebay.com To: kmcgrail(a)peregrinehw.com Sent: Wednesday, February 16, 2005 8:44 PM Subject: TKO Notice: Urgent Fraud Investigation Place or Update Credit Card on File Dear Kmcgrail(a)peregrinehw.com , This is your final warning about the safety of your eBay account. If you do not update your billing informations your access on eBay will be restricted and the user deleted. This might be due to either following reasons: - A recent change in your personal information (i.e. change of address) - Submiting invalid information during the initial sign up process. - An inability to accurately verify your selected option of payment due an internal error within our processors. Your credit card on file with eBay Card number: XXXX-XXXX-XXXX-4322 (Not shown for security purposes) Expiration date: 11/05 Please sign in to your eBay account and update your billing information: https://signin.ebay.com/saw-cgi/eBayISAPI.dll?SignIn&UsingSSL=1 If your account information is not updated, your ability to sell or bid on eBay will become restricted. Thank you, eBay Billing Department -------------------------------------------------------------------- eBay treats your personal information with the utmost care, and our Privacy Policy is designed to protect you and your information. eBay will never ask their users for personal information, such as bank account numbers, credit card numbers, pin numbers, passwords, or Social Security numbers in an email. For more information on how to protect your eBay password and your account, please visit User Account Protection. This eBay notice was sent to you based on your eBay account preferences and in accordance with our Privacy Policy. To change your notification preferences, click here. If you would like to receive this email in text format, click here. Copyright © 2005 eBay Inc. All Rights Reserved. Designated trademarks and brands are the property of their respective owners. eBay and the eBay logo are trademarks of eBay Inc.

5 5

[Slight OT] Dansguardian+SURBL
by RD 14 Mar '05

14 Mar '05

Hello SURBL Team, Anyone aware of dansguardian patch to support SURBL ? Thanks, RD

1 0

List of spamvertised sites sent via zombies, open proxies, etc.?
by Jeff Chan 13 Mar '05

13 Mar '05

Does anyone have or know about a list of spam-advertised URIs where the spam they appeared in was sent through open relays, zombies, open proxies, etc. In other words does anyone know of a list of spamvertised web sites or their domains that's been cross referenced to exploited hosts? We could use that information as a valuable tool for getting more records into SURBLs. Please let me know here or off list. :-) Cheers, Jeff C. -- "If it appears in hams, then don't list it."

3 9

RE: [SURBL-Discuss] Re: Was: List of spamvertised sites sent viazombies, open proxies, etc.?
by Matthew Wilson 13 Mar '05

13 Mar '05

Jeff, I'm confused... Why are you looking for historical snapshot or summary data when the nature of the message stream is to change continually? Surely any statistics that would correlate domains and XBL'ed hosts would only be good for a day or two at the most?? Matthew

2 1

RE: [SPAM-TAG] Re: [SURBL-Discuss] A list of spammers urls
by Matthew.van.Eerde＠hbinc.com 12 Mar '05

12 Mar '05

Jeff Chan wrote: > On Friday, March 11, 2005, 4:33:45 AM, Chris Edwards wrote: >> I wonder if there'd be much mileage in a SpamAssaassin feature to >> award points for any URLs that don't resolve ? > > In principle it's something that could be done, but the timeouts > encountered trying to resolve non-existent domains could make it > impractical. Aren't the name resolution attempts done in parallel? Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer perl -e"map{y/a-z/l-za-k/;print}shift" "Jjhi pcdiwtg Ptga wprztg,"

2 1

JP on rulesemporium
by Matthew Wilson 12 Mar '05

12 Mar '05

I'm curious as to why JP isn't queried on the rulesemporium.com SURBL checker?

2 1

A list of spammers urls
by Rakesh 11 Mar '05

11 Mar '05

Here is a list of urls that i compiled from spams. I queried sc.surbl.org, using them but didnt find them listed. Some of the domains are the randomly generated ones and might have became invalid as of now. However some of them are still working. I didnt knew where to report this list to, so I am posting it to this list and Jeff. http://get-internet-software.com/cgi-bin/rd.cgi?poKzgADTMS <http://get-internet-software.com/cgi-bin/rd.cgi?poKzgADTMS> http://surfer-support.com/w30/pikapika.html <http://surfer-support.com/w30/pikapika.html> http://sanguozhi10.com/tp/default.asp <http://sanguozhi10.com/tp/default.asp> http://pinghetang.com/ http://get-internet-software.com/w30/pikapika.html <http://get-internet-software.com/w30/pikapika.html> http://tempole.com http://bma.net.mypillsvalues.com <http://bma.net.mypillsvalues.com> http://rckksa.a6.defenses8093biz.us <http://rckksa.a6.defenses8093biz.us> http://pj.decatur9854rx.us http://nht.p.aye3054biz.us http://i.p.aye3054biz.us http://rd.a6.defenses8093biz.us <http://rd.a6.defenses8093biz.us> http://rem.decatur9854rx.us http://xanb.su.aye3054biz.us http://pd.abk.crucify8156pi11.us <http://pd.abk.crucify8156pi11.us> opp.dacemhad.us <http://opp.dacemhad.us> images.dacemhad.us <http://images.dacemhad.us> http://q.m.crucify8156pi11.us http://popupblocker-software.com/w30/pikapika.html <http://popupblocker-software.com/w30/pikapika.html> http://history-cleaner-software.com <http://history-cleaner-software.com> http://www.spyware-killer-software.com <http://www.spyware-killer-software.com> http://images.NCatalpa2m.biz/ http://Passionvin.biz -- Regards, Rakesh B. Pal Emergic CleanMail Team. Netcore Solutions Pvt. Ltd. ======================================================================== It doesn't matter who you are, it's what you do that takes you far ======================================================================== ---------------------------------------------------------- Netcore Solutions Pvt. Ltd. Website: http://www.netcore.co.in Spamtraps: http://cleanmail.netcore.co.in/directory.html ----------------------------------------------------------

4 15

RE: [SURBL-Discuss] Spam Honeypot identification through SURBL
by Chris Santerre 10 Mar '05

10 Mar '05

>-----Original Message----- >From: Matthew Wilson [mailto:matthew@boomer.com] >Sent: Thursday, March 10, 2005 12:01 PM >To: Jeff Chan; SURBL Discussion list >Subject: [SURBL-Discuss] Spam Honeypot identification through SURBL > > >Jeff (and list), > >I'm worried that spammers can use SURBL to identify honeypot email >servers by using unique subdomains. A spammer must merely >send a unique >subdomain URL to every address on their list, and if that unique >subdomain is blacklisted in SURBL, they have identified a potential >honeypot and will no longer send spam to that address/server. > >It is therefore my humble opinion that only the second-to-top domain >name should be listed in SURBL, and not any of the subdomains. > >Thoughts? > >-Matthew Wilson I make it a point to not list subdomains. Only the main domains get listed by me. If one got in, it was an oversight. When some submissions come in from certain projects, I will purposely delay their addition to SURBL, so that spammers can't time them with spam runs. But frankly the domains come from so many different sources, it doesn't matter much. --Chris

1 0

RE: [SURBL-Discuss] RFC: Updated list removal statement
by Chris Santerre 08 Mar '05

08 Mar '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, March 08, 2005 4:35 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] RFC: Updated list removal statement > > >On a related note, I've updated the list removal statement on the >SURBL web site to include: >__ > > http://www.surbl.org/lists.html > >List Removal > >All of the data in SURBL lists come from external data sources. >None of the SURBL lists come from data created here, so generally >speaking to get a record off a list you should contact that data >source as described earlier under each list. However, for the sc >and ab lists you may send a removal request to whitelist at surbl >dot org. > > Note: Before reporting false positives, please check that > they are actually on SURBL lists. This can be done for > example with a name resolution or by using the SURBL+ > checker tool. There is an intermittent bug with SpamAssassin > that appears to show FPs when none actually exist. (See > SpamAssassin Bugzilla id=3997.) > >When sending a removal request, please include: > > 1. Full and complete contact information for your organization > including street address and telephone numbers, > 2. Information about your sending servers such as IP addresses, > 3. A sample message with full, sent headers and full message > body including URIs, > 4. A brief description of your organization or a link to one, > 5. Your organization's published mail practices, especially > its published anti-spam policies, or links to them. > >If your organization does not publish and actually practice an >anti-spam policy, it should. Please send your request from your >organization's domain. Requests sent from Hotmail, Yahoo, gmail, >etc. accounts may not be considered. >__ > >How does this look to everyone? Too strict? Not strict enough? >Too little info? Too much? How about: "Be prepaired to explain any UBE that is found to contain your domain." "Understand that you ARE responsible for the actions of your affiliates." "If you purchased a list which contains harvested addresses and use them in a mailing, then you are commiting a crime." "'Just unsubscribe!', is NOT a valid response!" --Chris

1 0

RE: [SURBL-Discuss] Spammer Anti-SURBL tactic
by Chris Santerre 08 Mar '05

08 Mar '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, March 08, 2005 2:22 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Spammer Anti-SURBL tactic > > >On Monday, March 7, 2005, 9:07:37 PM, Steven Champeon wrote: > >> Speaking of anti-SURBL tactics, I got this turdlet today (snippet >> of HTML email below): > >> <DIV>We are giving out Free Import / Export / Wholesales/ >Distributers / >> Retailers  Contact Database</DIV> >> <DIV> </DIV> >> <DIV>If You interested Pls get at Following URL</DIV> >> <DIV> </DIV> >> <DIV><A >onmouseover="window.status='http://www.impexp-data.com';return true;" >> onmouseout="window.status=' ';return true;" >> href="http://indigisys.com/chawla1/open.htm" target=_blank>Business = >> Database</A> </DIV> >> <DIV> </DIV> >> <DIV>Free Business / Marketing Tools ( Free SMS to All >over world Unl= >> imited ) </DIV> >> <DIV><A >> >onmouseover="window.status='http://www.impexp-data.com/sms';ret >urn true;" >> onmouseout="window.status=' ';return true;" >> href="http://indigisys.com/chawla1/open.htm" >target=_blank>FREE SMS = Tools >> </A></DIV> > >> It *looks* like whoever owns indigisys.com wants to hide the fact >> that they're actually indigisys.com by pretending to be >impexp-data.com, >> which doesn't exist. Does SURBL's lookup code catch this? > >SpamAssassin 2.64 running SpamCopURI seems to check both domains: > >debug: checking url: http://indigisys.com/chawla1/open.htm >debug: returning cached data : indigisys.com.multi.surbl.org >-> ARRAY(0x9351f4c) >debug: Receieved match prefix: 127.0.0 >debug: Receieved mask: 32 >debug: no match > >debug: checking url: http://www.impexp-data.com';return >debug: returning cached data : >impexp-data.com.multi.surbl.org -> ARRAY(0x9386f58) >debug: Receieved match prefix: 127.0.0 >debug: Receieved mask: 32 > >As does SpamAssassin 3.0.1: > >debug: URIDNSBL: query for indigisys.com took 0 seconds to >look up (multi.surbl.org.:indigisys.com) >debug: URIDNSBL: query for impexp-data.com took 0 seconds to >look up (multi.surbl.org.:impexp-data.com) > > >Those are the only SURBL applications I have easy access to, so I >don't know how others may handle them. SpamAssassin does the >right thing. :-) > Not only that, but the SARE rules look for this trick as well. Everytime they try to get around something, spammers end up painting themselves in a corner. --Chris

1 0

RFC: Updated list removal statement
by Jeff Chan 08 Mar '05

08 Mar '05

On a related note, I've updated the list removal statement on the SURBL web site to include: __ http://www.surbl.org/lists.html List Removal All of the data in SURBL lists come from external data sources. None of the SURBL lists come from data created here, so generally speaking to get a record off a list you should contact that data source as described earlier under each list. However, for the sc and ab lists you may send a removal request to whitelist at surbl dot org. Note: Before reporting false positives, please check that they are actually on SURBL lists. This can be done for example with a name resolution or by using the SURBL+ checker tool. There is an intermittent bug with SpamAssassin that appears to show FPs when none actually exist. (See SpamAssassin Bugzilla id=3997.) When sending a removal request, please include: 1. Full and complete contact information for your organization including street address and telephone numbers, 2. Information about your sending servers such as IP addresses, 3. A sample message with full, sent headers and full message body including URIs, 4. A brief description of your organization or a link to one, 5. Your organization's published mail practices, especially its published anti-spam policies, or links to them. If your organization does not publish and actually practice an anti-spam policy, it should. Please send your request from your organization's domain. Requests sent from Hotmail, Yahoo, gmail, etc. accounts may not be considered. __ How does this look to everyone? Too strict? Not strict enough? Too little info? Too much? Jeff C. -- "If it appears in hams, then don't list it."

1 0

RE: [SURBL-Discuss] Nice article on SURBL and note about weekends .....
by Chris Santerre 08 Mar '05

08 Mar '05

Wow this is even a better article! <http://etdeliverability.typepad.com/chips_deliverability_tips/2004/10/brand _names_und.html> Perhaps we should get in touch with the people of Pivotal Veracity?? Check out this paragraph: "How does this affect you? My friends at Pivotal Veracity who offer phenomenal new technology for tracking email deliveries to top ISP's recently completed a study on the topic of SURBL's and deliverability. They found that emails containing a blocked URL were blocked entirely at 5 of the 20 ISP's tested, while 7 ISP's moved the email to the bulk folder. Also, their tests showed that emails with blocked URL's were filtered to bulk or discarded at 50% of medium to larger enterprises. Pivotal Veracity's new product, eBrand Monitor (also offered via ExactTarget's Inbox Detective), helps companies detect blocking before it causes problems." For those keeping count, that leaves 8 ISPs that need a LART ;) I suspect this is why Jeff always yells at me to get our FP rate lower! But I love how the article ends. Clearly shows legit companies that they need to keep track of their affiliates, because they can and will hurt their brand. --Chris

2 1

Nice article on SURBL and note about weekends.....
by Chris Santerre 08 Mar '05

08 Mar '05

I was surfing for something else while waiting for two machines to reboot. Found this... http://daryl.learnhouston.com/?p=143 I like people who like us :) Also a side note: I know sometimes updates over the weekend run a little slower, I am still working on some ideas to speed that up on my end. But to try to counter act this a little, ANY, and I mean ANY and ALL domains submitted over the weekend, go thru a MUCH more rigourus research then the weekday. I figure if spammers are trying to take advantage of people being away for the weekend, then I'm going to look at those domains MUCH more closely. For instance, for the domains reported this weekend that fell into my bucket, I added about 35 times the amount from researching them all! Thats the price they pay for trying to be sneaky! ;) --Chris

2 1

Spammer Anti-SURBL tactic
by David B Funk 08 Mar '05

08 Mar '05

I'm seeing a new spam varient that is clearly designed to get past SURBL. It is an HTML message that contains many (50~100) 'invisible' links; links that have no target text, just: <A href="http://garbage.sitename.tld"></A> The intention is clear, they want to fill up the 20 'slots' of the spamcop_uri_limit with their junk links so the real "payload" URL can slip past unchecked. That's playing a statistical game, there's a 1 in 20 chance of the "payload" getting picked by the randomizer but that means that 95% slip by. To add insult to injury, they're tossing in random "\r" (ASCII-CR) characters into the "payload" hostname to try to break spamassasin's URI parsing. Is it time to create rules to penalize large numbers of 'invisible' links? The one thing that has me worried is that people may just start cranking up the spamcop_uri_limit value to do a brute-force response to this trash (or have a simple-minded client that doesn't have that kind of limit). This will add an ever-increasing load on the SURBL dns servers. I'm already seeing a steady-state average of 130 queries/second against my two servers (with spikes in the 150~175) range. The trend has been a steady increase (passed the 100 Q/S mark last fall). -- Dave Funk University of Iowa <dbfunk (at) engineering.uiowa.edu> College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 #include <std_disclaimer.h> Better is not better, 'standard' is better. B{

8 13

RE: [SURBL-Announce] Welcoming new public name server
by Chris Santerre 07 Mar '05

07 Mar '05

> >We'd like to welcome and thank the addition of a new public >SURBL name server g3.surbl.org administered by: > > Panagiotis Christias of National Technical University > of Athens in Greece > Ooopa! One more for the Uzo! Thanks guys! We really appreciate the servers! --Chris

1 0

updates on permuted-hits.out.txt??
by Alain 06 Mar '05

06 Mar '05

Hi I don't see changes inside : http://www.surbl.org/permuted-hits.out.txt Is there an update frequency or is it done manual? I think those are from before the WS/JP split. I also haven't seen results from after the the WS/JP split, has someone results (or did I miss these? Thanks in advance Alain

2 1

Re: [SPAM-TAG] SURBL missing this spam
by David B Funk 05 Mar '05

05 Mar '05

On Fri, 4 Mar 2005, Jeff Chan wrote: > On Friday, March 4, 2005, 5:12:28 PM, Theo Dinter wrote: > > On Fri, Mar 04, 2005 at 05:10:42PM -0800, Jeff Chan wrote: > >> The URI is a little unusual, with a missing port number after the > >> colon: > >> > >> http://crazyrxl0wprices-MUNGED.com:/ > >> > >> Maybe that syntax is throwing off SA? > > > Yeah, it does look like a bug somewhere in 3.0.x. 3.1 catches it fine, > > fwiw. > > > 3.0: > > debug: URIDNSBL: domains to query: > > > 3.1: > > debug: uridnsbl: domains to query: crazyrxl0wprices.com > > Thanks Theo, > Given that it's apparently fixed in 3.1 should we make a > bugzilla? Might it be worth reviewing that the expression or > code was specifically fixed to explain this (better) behavior? > Or would that be unnecessary? For those still running SA 2.6* + SpamCopURI-0.22 The following ONE character patch fixes this bug: *** SpamCopURI.pm-orig Thu Aug 5 14:58:59 2004 --- SpamCopURI.pm Fri Mar 4 21:22:37 2005 *************** *** 276,282 **** # URI doesn't always put the port in the right place # so we strip it off here ! $url{host} =~ s/:[0-9]+$// if $url{host}; # Cleanup for urls that come in with a dot in the front --- 276,282 ---- # URI doesn't always put the port in the right place # so we strip it off here ! $url{host} =~ s/:[0-9]*$// if $url{host}; # Cleanup for urls that come in with a dot in the front (IE just change that '+' to a '*' ;) -- Dave Funk University of Iowa <dbfunk (at) engineering.uiowa.edu> College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 #include <std_disclaimer.h> Better is not better, 'standard' is better. B{

1 0

Re: [SPAM-TAG] SURBL missing this spam
by Bill Landry 05 Mar '05

05 Mar '05

----- Original Message ----- From: "Jeff Chan" <jeffc(a)surbl.org> > On Friday, March 4, 2005, 3:47:04 PM, martin smith wrote: > > I must have received this spam 12 times or more in the last 24 hours and > > even though its listed on the SURBL, spamassassin fails to match it against > > them. > > When I submit the spams to spamcop it parses the url everytime. > > SURBL seems to work on all other spams, just wondering if they have found a > > way to avoid spamassassin catching the URL. > > > Martin > > The URI is a little unusual, with a missing port number after the > colon: > > http://crazyrxl0wprices-MUNGED.com:/ > > Maybe that syntax is throwing off SA? Ah, good catch, I hadn't even noticed the trailing ":". Bill

1 0

Re: SURBL missing this spam
by Bill Landry 05 Mar '05

05 Mar '05

----- Original Message ----- From: "Bill Landry" <billl(a)pointshare.com> > > I must have received this spam 12 times or more in the last 24 hours and > > even though its listed on the SURBL, spamassassin fails to match it > against > > them. > > When I submit the spams to spamcop it parses the url everytime. > > SURBL seems to work on all other spams, just wondering if they have found > a > > way to avoid spamassassin catching the URL. > > > > Martin > > Hmmm, that does seem strange. Didn't get caught here, either. However: > > crazyrxl0wprices.com.multi.surbl.org. 2100 IN A 127.0.0.114 > > So http://crazyrxl0wprices.com is listed on several of the SURBL multi > lists. Let's see if this message gets flagged or not... Yep, caught by all SURBL multi lists that compound to equal 127.0.0.114: URIBL_AB_SURBL, URIBL_JP_SURBL, URIBL_OB_SURBL, URIBL_SC_SURBL Don't know why the domain was not flagged on the message you forwarded to the SA list, it clearly showed up in the message source file. Bill

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss