- Discuss - Mailman 3

RE: OfficeTeam.com FP???
by Rob McEwen 01 Feb '05

01 Feb '05

RE: OfficeTeam.com FP??? A hand-typed legitimate mail sent to my client which my client is expecting is having problems because this message contains the domain name "officeTeam.com" and OfficeTeam.com is currently listed by SURBL. Should this be listed? If so, what are the "offenses" so can I understand how/why is is listed in SURBL? Thanks, Rob McEwen

2 1

RE: OfficeTeam.com FP???
by Rob McEwen 01 Feb '05

01 Feb '05

RE: OfficeTeam.com FP??? A hand-typed legitimate mail sent to my client which my client is expecting is having problems because this message contains the domain name "officeTeam.com" and OfficeTeam.com is currently listed by SURBL. Should this be listed? If so, what are the "offenses" so can I understand how/why is is listed in SURBL? Thanks, Rob McEwen

1 0

SURBL Server mostly back
by Jeff Chan 01 Feb '05

01 Feb '05

It too longer than it should, but there are now filters in place against the syn flood my server got on port 80 in addition to icmp attacks probably against DNS. They came from many different source addresses and were directed to my server only, so it was definitely a mildy competent DDOS attack. Peak traffic was about 20 Megabits, probably limited by the available network bandwidth. None of this significantly affected SURBL performance, and things should be operating normally again now. We will be taking steps to further reduce the effects of attacks like this. Until the SYN packets stop, the web site will remain down. Would anyone like to help mirror the largely static and relatively tiny SURBL web site? Jeff C. -- "If it appears in hams, then don't list it."

3 8

Re: Revisiting high-level 3.1 goals
by Jeff Chan 01 Feb '05

01 Feb '05

On Saturday, January 29, 2005, 11:29:28 PM, Daniel Quinlan wrote: > Jeff Chan <jeffc(a)surbl.org> writes: >> Can you give an estimate on when 3.1 is coming out? > Real soon now. OK, let's ask Raymond and Joe to remove the JP data from WS before your final pre-3.1 mass check. Should we do that now? >> One of the things we planned for it was to move JP data out of WS on >> the SURBL lists. > So, WS includes all of JP? Or, are JP entries individually considered > and added manually over time to WS? Or, is the problem something else? WS includes all of JP. They're simply added in right now. That's because 3.0.0 came out before you could add a separate rule for JP, and we wanted to get the benefit of JP into 3.0.0. Is there a separate rule for JP now? If not would you please add one? Jeff C.

8 24

John Delisle/ho/Ceridian is out of the office.
by John_Delisle＠ceridian.ca 01 Feb '05

01 Feb '05

I will be out of the office starting 01/31/2005 and will not return until 02/01/2005. Sorry, I'm away on course. If you require assistance, please see the NAS team, or Service Desk. I'll be back Friday. Thanks *********************************************************************************** This communication is intended to be received only by the individual(s) or entity(s) to whom or to which it is addressed, and contains information which is confidential, privileged and subject to copyright. Any unauthorized use, copying, review or disclosure is prohibited. Please notify the sender immediately if you have received this communication in error (by calling collect, if necessary) so that we can arrange for its return at our expense. Thank you in advance for your anticipated assistance and cooperation. Ce document est destinee aux seuls destinataires designes, personne ou groupe. Cette telecopie contient des renseignements confidentiels et est regie par les lois sur le droit d'auteur. Toute utilisation, copie, revue ou divulgation non autorisee de la presente est formellement interdite. Si vous avez recu cette telecopie et qu'elle ne vous etait pas destinee, veuillez communiquer immediatement avec l'expediteur, a frais vires si necessaire, afin que nous puissions prendre des dispositions a nos frais pour la recuperer. Nous vous remercions a l'avance de votre cooperation diligente. ***********************************************************************************

1 0

SURBL DOS
by Chris Santerre 01 Feb '05

01 Feb '05

I just got a call from Jeff. www.surbl.org is under what appears to be a DDOS attack :) Wheeeeeee!!! Which means.......not much. It has no effect on the SURBL lists. All it does it slowdown whitelist requests, and make it difficult for people to read about SURBL :) And Jeff won't be able to reply to people right away. I'm sure Jeff will post when the storm is over. He already had a backup site half done, so this will be fixed soon. A big thanks to all the public mirrors of SURBL! You are what keeps this running!! Chris Santerre System Admin and SARE/SURBL Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

4 4

Re: [SURBL-Discuss] Re: Revisiting high-level 3.1 goals
by Daniel Quinlan 30 Jan '05

30 Jan '05

> BTW Any ideas when the last mass check for 3.1 might happen? No, but it'll be announced in advance. -- Daniel Quinlan http://www.pathname.com/~quinlan/

1 0

RE: [SURBL-Discuss] I couldn't resist.....
by Chris Santerre 28 Jan '05

28 Jan '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, January 27, 2005 8:05 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] I couldn't resist..... > > >On Thursday, January 27, 2005, 12:05:49 PM, Frank Ellermann wrote: >> Chris Santerre wrote: > >>> No comments from Jeff? I guess he doesn't like the mascot? :) > >> Maybe he doesn't know why you call this animal "Sir Bill" ;-) > >Yeah, I think I like Sir Bull better, but a Bull running >around the Sewers could give spammers a nice surprise.... ;-) > LOL I'm trying to think of some way to make a funny pic out of "Sir Bull"! It ain't an easy one! --Chris

2 1

Re: [SURBL-Discuss] RFC: remove zone files from SURBL web site
by Jeff Chan 28 Jan '05

28 Jan '05

On Wednesday, January 26, 2005, 8:30:00 PM, Darrell (support(a)invariantsystems.com) wrote: > I know a lot of Declude users are doing it that way. Someone wrote a batch > file thats coupled with wget that pulls the zone file down and creates a > Declude body filter. To be honest this is no longer needed since invURIBL > was wrote that plugs into Declude. Hmm, at least there is an upgrade path for doing it the preferred way with DNS through your newer plug in for Declude. > I just wanted to make sure that when a date was set that I posted that info > out to the Declude forum to let those users know. Can you let them know we will remove it at the end of January and they should use the newer plug in instead? Cheers, Jeff C. -- "If it appears in hams, then don't list it."

2 1

RE: [SURBL-Discuss] I couldn't resist.....
by Chris Santerre 28 Jan '05

28 Jan '05

>-----Original Message----- >From: Doc Schneider [mailto:maddoc@maddoc.net] >Sent: Wednesday, January 26, 2005 5:56 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] I couldn't resist..... > > >Chris Santerre wrote: >> http://www.merchantsoverseas.com/wwwroot/gorilla/SURBL.jpg >> >> :) >> > >ROAR! HOWL! HAR! > >That is great Chris. > >-Doc No comments from Jeff? I guess he doesn't like the mascot? :) --Chris

4 3

RE: [SURBL-Discuss] I couldn't resist.....
by Chris Santerre 27 Jan '05

27 Jan '05

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Thursday, January 27, 2005 1:36 PM >To: SURBL Discussion list >Subject: RE: [SURBL-Discuss] I couldn't resist..... > > >Hi! > >>>> http://www.merchantsoverseas.com/wwwroot/gorilla/SURBL.jpg >>>> >>>> :) > >>> ROAR! HOWL! HAR! >>> That is great Chris. > >> No comments from Jeff? I guess he doesn't like the mascot? :) > >Ohhh, wasnt it a picture of Jeff ? ;) > > ;) > >Bye, >Raymond. Did you just say Jeff was hung like a ........ oh my this is getting OT :) --Chris

2 1

False Positive report for ob.surbl.org
by Matt Yackley 27 Jan '05

27 Jan '05

Hello, I received what I believe to be a false positive hit on the ob.surbl.org list, the following domain is listed: ohyeahcadMUNGED.com The URL was listed within the "CAD CAM CAE Newsletter" sent out by TenLinks Daily. This email was tagged as spam and submitted by the end user as a false positive. Cheers, Matt

2 1

Please use whitelist request address
by Jeff Chan 27 Jan '05

27 Jan '05

A reminder: please send whitelist requests and false positive reports to: whitelist at surbl dot org Thanks, Jeff C. -- "If it appears in hams, then don't list it."

1 0

RFC: remove zone files from SURBL web site
by Jeff Chan 27 Jan '05

27 Jan '05

I'd like to get rid of the sc and ws bind and rbldnsd zone files from the SURBL web site and replace them with a note asking people to use rsync instead. Does anyone have any comments on this? We don't want people grabbing the zone files from the web site since rsync is so much more efficient. Probably I would check the web logs and try to contact some of the folks trying this also. Jeff C. -- "If it appears in hams, then don't list it."

5 8

False positive? Ob.surbl.org
by Michele Neylon :: Blacknight Solutions 26 Jan '05

26 Jan '05

Hi I found what looks like a false positive in ob.surbl.org gm-linkMUNGED.com This is used by http://group-metrics.com for sending confirmation emails as part of their web service extension to GroupMail (http://infacta.com) I was about to start using the service for our own newsletter when I spotted the score. Michele Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html

1 0

I couldn't resist.....
by Chris Santerre 26 Jan '05

26 Jan '05

http://www.merchantsoverseas.com/wwwroot/gorilla/SURBL.jpg :) --Chris

2 1

RE: [SURBL-Discuss] MIT piranhas
by Chris Santerre 26 Jan '05

26 Jan '05

>-----Original Message----- >From: Theo Van Dinter > > >On Mon, Jan 24, 2005 at 09:55:01PM +0100, Frank Ellermann wrote: >> > "Oh you are from 'serbil'!" >> > Yeah, I had no idea people said it like that. Sounds like >> > gerbil with an 'S'! > >I think I'm one of the people he's talking about, but "Sir >Bull" ("serbil" >works too) is the version I've heard from pretty much everyone >(at least >US people...) > >It's an acronym, so I guess people could spell it out, but... >That takes too >long, and I'm lazy. ;) Thats what I've been doing the whole time. "S" "U" "R" "B" "L" :) Which has been a mouthful. I like the "sir bull" idea. It was more of a culture shock I guess. ;) --Chris

3 3

RE: [SURBL-Discuss] MIT piranhas
by Matthew.van.Eerde＠hbinc.com 26 Jan '05

26 Jan '05

Chris Santerre wrote: > Very deep discussion with someone, who then stumped me > simply by asking me what udp stood for. :) Unreliable Datagram Protocol, naturellement ;) Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer perl -e"map{y/a-z/l-za-k/;print}shift" "Jjhi pcdiwtg Ptga wprztg,"

1 0

Here it comes!
by Chris Santerre 25 Jan '05

25 Jan '05

Just got my first one today! Tax spam!! Get ready for the onslaught that is sure to follow this time of year. I'm thinking we may just see the possibility to Electronic Tax refund Phishing as well. Just something to start thinking about. --Chris

1 0

RE: [SURBL-Discuss] MIT piranhas
by Chris Santerre 25 Jan '05

25 Jan '05

>-----Original Message----- >From: Doc Schneider [mailto:maddoc@maddoc.net] >Sent: Tuesday, January 25, 2005 1:46 PM >To: Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] MIT piranhas > > >Jeff Chan wrote: > >[snip] > >>>> >>>>It's an acronym, so I guess people could spell it out, but... >>>>That takes too >>>>long, and I'm lazy. ;) >> >> >>>Thats what I've been doing the whole time. "S" "U" "R" "B" "L" :) >> >> >>>Which has been a mouthful. I like the "sir bull" idea. It >was more of a >>>culture shock I guess. ;) >> >> >> "Sir Bull" is how I pronounce it, but there's probably no right or >> wrong way since we made it up. >> >> What matters is that folks use it. ;-) >> > >I always say just the letters when I'm referring to it. > >Having read all the posts I got a huge giggle from "Sewer Bill" >Think is should actually be "Sewer Bull", though. >And no reference in there to William (Bill) Stearns! HAR! > >I know it SURBL is an acronym but can't recall what it does stand for? LOL I forget things like that all the time. You get so used to calling it by acronym, you forget what it means. SpamAssassin URL Realtime Black List. (Sewer Bull) I once had a complete conversation explaining how to block udp traffic. Very deep discussion with someone, who then stumped me simply by asking me what udp stood for. :) Couldn't remember to save my life. --Chris (LOL @ Steeler fans!)

1 0

RE: [SURBL-Discuss] MIT piranhas
by Matthew Wilson 25 Jan '05

25 Jan '05

Chris, I'm sure by "thrown up", you don't mean literally "throw up"... ;) Matthew -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Chris Santerre Sent: Tuesday, January 25, 2005 9:08 AM To: 'Jeff Chan'; 'SURBL Discussion list' Subject: RE: [SURBL-Discuss] MIT piranhas >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, January 24, 2005 8:51 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] MIT piranhas > > >On Monday, January 24, 2005, 5:35:32 PM, David Funk wrote: >> No, it's "sewer bill", the price that we have to pay to be able to >> flush the crap away. ;) > >LOL! ;-) > Dude that is great!! Should be thrown up on the surbl.org website as the "official" way to say it :) LOL @ Sewer bill! --chris _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: [SURBL-Discuss] MIT piranhas
by Chris Santerre 25 Jan '05

25 Jan '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, January 24, 2005 8:51 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] MIT piranhas > > >On Monday, January 24, 2005, 5:35:32 PM, David Funk wrote: >> No, it's "sewer bill", the price that we have to pay to be >> able to flush the crap away. ;) > >LOL! ;-) > Dude that is great!! Should be thrown up on the surbl.org website as the "official" way to say it :) LOL @ Sewer bill! --chris

1 0

MIT piranhas
by Chris Santerre 25 Jan '05

25 Jan '05

Well only one person mentioned URL blacklists in their presentation at MIT Friday. They simply mentioned they were one way to stop spam. (At one point I snuck up to the blackboard and wrote "SURBL.org" on it :) However in the hallways and during breaks MANY people got excited by my name tag. "Oh you are from 'serbil'!" Yeah, I had no idea people said it like that. Sounds like gerbil with an 'S'! Many people asked about hand checking and how we do it. I down played it an said we had a lot of data from another secret project that no one really know about. And that it helps us greatly. (I've BCC'd that project on this email so lets watch those replies people!!!) Anyway, the word "secret" seems to send people into a feeding frenzy of questions and "Can I join?" verbal diarrhea. To which I have to say, "If everyone joined, it wouldn't be a secret!" I just found that interesting. Lots of people happy with SURBL. And some possible connections of sharing data with other people. I'll speak more about that off list. I'll make another post reviewing the whole MIT conference. Chris Santerre System Admin and SARE/SURBL Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

6 5

RE: [SURBL-Discuss] Submission
by Chris Santerre 25 Jan '05

25 Jan '05

>-----Original Message----- >From: Frank Ellermann [mailto:nobody@xyzzy.claranet.de] >Sent: Sunday, January 23, 2005 7:47 AM >To: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] Submission > > >Jeff Chan wrote: > >> SC and AB use SpamCop reports as input. > >Okay, nothing to do here for SC users, normal spam >reports with SpamCop are good enough. > >> JP and OB use private traps as input. > >Also clear, stuff found by Joe etc. or by outblaze. > >> WS is a manual list. > >That's what I tested (resulting in a 403 + 404 ;-) > >> That said, I've updated the Lists document slightly >> to reflect this and added a FAQ entry also. >> http://www.surbl.org/faq.html#reporting > >Thanks. I've posted a pointer to this thread in the >SpamCop newsgroup. The most interesting SURBL for SC >reporters is probably PH, if they send their reports >to one of the PH addresses mentioned in your article > ><http://article.gmane.org/gmane.mail.spam.rbl.surbl/3754> Thanks for the headsup. It *appears* to be working, but I have special permissions. Can you double check for me. --Chris

3 2

Submission
by Frank Ellermann 23 Jan '05

23 Jan '05

Hi, something I saw in a SpamCop discussion: <news://news.spamcop.net/csv88p$met$1@news.spamcop.net> <http://news.spamcop.net/pipermail/spamcop-list/2005-January/096914.html> | I don't know of any other method of feeding spamvertised urls to any of | the subsections of surbl described here http://www.surbl.org/lists.html Apparently that FAQ isn't answered in the FAQ (?). Therefore I tried to find an answer, but that ended with a "403 forbidden" causing a "404 not found" for the URL <http://www.rulesemporium.com/cgi-bin/?report=1> So what is the answer for this FAQ ? Bye, Frank

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss