- Discuss - Mailman 3

Rookie Question
by Kevin A. McGrail 03 Jan '05

03 Jan '05

OK. It's a silly question but I'd like to start submitting more of the SPAM I hand-filter for inclusion in the SURBL lists. For example, I'm being inundated with offers for free watches linking to http://*.nepel-MUNGED.com/ which redirects to http://www.online-replica-store-MUNGED.com/. What is the best process for me to take a known SPAM and get the ball rolling on something like this? Regards, KAM

7 21

DoS Question
by Kevin A. McGrail 01 Jan '05

01 Jan '05

> This isnt something to discuss on the SURBL list, but it looks like you > either have a dictionary attack going on. I'm sorry. I should clarify on list (though I do appreciate the offer of off-list support) All of these connections do not seem to proceed past the connection startup phase. I am very used to dictionary attacks having hosted sites and DNS that bring ire from Spammers (formerly www.spamassassin.org and currently just DNS, an SURBL public nameserver, RelayRegistry.org, anti-SPAM How-To's, etc). This looks like a VERY large distributed Denial of Service attack. The reason I posted here and I believe it is relevant because it might be against SURBL nameservers and I'm hoping to hear if others are seeing the same issue. Regards, KAM

3 3

DoS Question
by Kevin A. McGrail 01 Jan '05

01 Jan '05

Anyone else seeing massive sendmail connections seemingly for the sole purpose of a denial of service? This is less than one minute or two after a sendmail restart and we've been seeing this issue since app 6AM today. Regards, KAM 15991 ? S 0:00 sendmail: accepting connections 16001 ? S 0:00 sendmail: Queue runner@00:05:00 for /var/spool/clientmqueue 16003 ? S 0:00 sendmail: server localhost.localdomain [127.0.0.1] startup 16011 ? S 0:00 sendmail: Queue runner@02:00:00 for /var/spool/slow-mqueue 16012 ? SN 0:00 sendmail: ./j019qwZv004520 a.mx.bmkblurb.com.: user open 16015 ? S 0:00 sendmail: server dxbmiint3.emirates.com [194.170.246.36] startup 16016 ? S 0:00 sendmail: server [202.54.102.156] startup 16018 ? S 0:00 sendmail: server [211.104.187.50] startup 16019 ? S 0:00 sendmail: server [220.120.62.88] startup 16021 ? S 0:00 sendmail: server ll194-2-26-197-204-194.ll194-2.iam.net.ma [194.204.197.26] startup 16022 ? S 0:00 sendmail: server [84.43.33.20] startup 16023 ? S 0:00 sendmail: server 82-131-132-2.vnet.hu [82.131.132.2] startup 16024 ? S 0:00 sendmail: server 64-48-158-104-den-01.cvx.algx.net [64.48.158.104] startup 16025 ? S 0:00 sendmail: server 82-41-19-162.cable.ubr03.edin.blueyonder.co.uk [82.41.19.162] startup 16027 ? S 0:00 sendmail: server ip-cust10018.telefonica-ca.net [216.184.126.18] (may be forged) startup 16028 ? S 0:00 sendmail: server [211.114.176.195] startup 16029 ? S 0:00 sendmail: server [220.125.52.195] startup 16030 ? S 0:00 sendmail: server 210-20-54-62.rev.home.ne.jp [210.20.54.62] startup 16034 ? S 0:00 sendmail: server [4.27.171.43] startup 16035 ? S 0:00 sendmail: server 13Cust29.VR2.NYC4.broadband.uu.net [63.13.166.29] startup 16038 ? S 0:00 sendmail: server localhost.localdomain [127.0.0.1] startup 16040 ? S 0:00 sendmail: server pD9E2C8C3.dip.t-dialin.net [217.226.200.195] startup 16041 ? S 0:00 sendmail: server [222.185.250.34] startup 16042 ? S 0:00 sendmail: server host013.acernautic.com [216.108.233.13] startup 16043 ? S 0:00 sendmail: server [61.172.244.215] startup 16044 ? S 0:00 sendmail: server [220.123.210.157] startup 16045 ? S 0:00 sendmail: server pool-68-163-234-71.bos.east.verizon.net [68.163.234.71] startup 16046 ? S 0:00 sendmail: server host73-186.pool8256.interbusiness.it [82.56.186.73] startup 16047 ? S 0:00 sendmail: server [210.113.49.67] startup 16048 ? S 0:00 sendmail: server c68.112.186.179.fdl.wi.charter.com [68.112.186.179] startup 16049 ? S 0:00 sendmail: server 228.70-84-59.reverse.theplanet.com [70.84.59.228] (may be forged) startup 16060 ? S 0:00 sendmail: server localhost.localdomain [127.0.0.1] startup 16061 ? S 0:00 sendmail: server [218.208.242.167] startup 16062 ? S 0:00 sendmail: server bay102-f10.bay102.hotmail.com [64.4.61.20] startup 16063 ? S 0:00 sendmail: server [65.78.254.163] startup 16064 ? S 0:00 sendmail: server 24571.bhz.virtua.com.br [200.167.245.71] startup 16065 ? S 0:00 sendmail: server [211.179.138.196] startup 16066 ? S 0:00 sendmail: server [61.166.13.4] startup 16068 ? S 0:00 sendmail: server APuteaux-153-1-40-49.w82-124.abo.wanadoo.fr [82.124.132.49] startup 16069 ? S 0:00 sendmail: server [218.233.17.169] startup 16070 ? S 0:00 sendmail: server c-24-13-203-45.client.comcast.net [24.13.203.45] startup 16071 ? S 0:00 sendmail: server bounces.ibumblebee4.com [206.71.52.13] startup 16072 ? S 0:00 sendmail: server [218.235.101.219] startup 16074 ? S 0:00 sendmail: server 181.red-213-37-181.user.auna.net [213.37.181.181] (may be forged) startup 16077 ? S 0:00 sendmail: server hermes.apache.org [209.237.227.199] startup 16078 ? S 0:00 sendmail: server dsl-201-128-126-70.prod-infinitum.com.mx [201.128.126.70] (may be forged) startup 16079 ? S 0:00 sendmail: server n1a.bulk.scd.yahoo.com [66.94.237.35] startup 16080 ? S 0:00 sendmail: server [211.185.22.81] startup 16081 ? S 0:00 sendmail: server lamx36.havagreatday.com [66.63.182.36] startup 16083 ? S 0:00 sendmail: server [211.115.116.19] startup 16084 ? S 0:00 sendmail: server [218.104.80.23] startup 16085 ? S 0:00 sendmail: server n22a.bulk.scd.yahoo.com [66.94.237.51] startup 16086 ? S 0:00 sendmail: server ns2.cube-technos.co.jp [60.32.0.83] startup 16091 ? S 0:00 sendmail: server mxsmfpool23.ebay.com [66.135.209.220] startup 16093 ? S 0:00 sendmail: server c906d0d1.virtua.com.br [201.6.208.209] startup 16100 ? S 0:00 sendmail: server [198.172.80.180] startup 16102 ? S 0:00 sendmail: server customer-reverse-entry.69.59.181.180 [69.59.181.180] (may be forged) startup 16104 ? S 0:00 sendmail: server 24571.bhz.virtua.com.br [200.167.245.71] startup 16105 ? S 0:00 sendmail: server mail6.surgant.com [64.0.201.121] startup 16106 ? S 0:00 sendmail: server [198.172.80.74] startup 16107 ? S 0:00 sendmail: server c-24-13-203-45.client.comcast.net [24.13.203.45] startup 16108 ? S 0:00 sendmail: server bay1-f26.bay1.hotmail.com [65.54.245.26] startup 16109 ? S 0:00 sendmail: server [193.129.96.138] startup 16110 ? S 0:00 sendmail: server c24.183.51.76.mad.wi.charter.com [24.183.51.76] startup 16111 ? S 0:00 sendmail: server 8.7.152.3.westgrep.info [8.7.152.3] startup 16112 ? S 0:00 sendmail: server [61.3.224.82] startup 16113 ? S 0:00 sendmail: server usen-221x253x207x69.ap-US01.usen.ad.jp [221.253.207.69] startup 16114 ? S 0:00 sendmail: server [61.177.95.216] startup 16115 ? S 0:00 sendmail: server tethys.herbagebunk.com [208.250.5.245] startup 16116 ? S 0:00 sendmail: server [216.63.195.133] startup 16117 ? S 0:00 sendmail: server cpe-069-134-008-168.carolina.rr.com [69.134.8.168] startup 16118 ? S 0:00 sendmail: server VA1-1B-u-0483.mc.onolab.com [62.42.5.228] startup 16119 ? S 0:00 sendmail: server [211.230.32.103] startup 16120 ? S 0:00 sendmail: server [218.80.102.233] startup 16122 ? S 0:00 sendmail: server adsl-67-39-207-175.dsl.bcvloh.ameritech.net [67.39.207.175] startup 16123 ? S 0:00 sendmail: server [218.14.146.51] startup 16124 ? S 0:00 sendmail: server [220.75.182.138] startup 16129 ? S 0:00 sendmail: server [220.75.220.84] startup 16132 ? S 0:00 sendmail: server [219.136.83.187] startup 16133 ? S 0:00 sendmail: server n5a.bulk.scd.yahoo.com [66.94.237.39] startup 16135 ? S 0:00 sendmail: server pool-68-162-185-58.pitt.east.verizon.net [68.162.185.58] startup 16136 ? S 0:00 sendmail: server h8024847078.dsl.speedlinq.nl [80.248.44.78] (may be forged) startup 16137 ? S 0:00 sendmail: server [221.15.5.43] startup 16141 ? S 0:00 sendmail: server [220.119.63.191] startup 16142 ? S 0:00 sendmail: server outmail-01.effectivesendinga.com [209.216.105.19] startup 16143 ? S 0:00 sendmail: server pcp07278419pcs.alico01.fl.comcast.net [69.139.62.88] startup 16144 ? S 0:00 sendmail: server [201.255.46.109] startup 16145 ? S 0:00 sendmail: server [198.172.80.157] startup 16146 ? S 0:00 sendmail: server [218.54.136.85] startup 16147 ? S 0:00 sendmail: server [221.8.150.220] startup 16149 ? S 0:00 sendmail: server [82.230.221.86] startup 16152 ? S 0:00 sendmail: server [219.240.209.90] startup 16153 ? S 0:00 sendmail: server c-24-1-43-131.client.comcast.net [24.1.43.131] startup 16155 ? S 0:00 sendmail: server e82-103-142-136s.easyspeedy.com [82.103.142.135] (may be forged) startup 16156 ? S 0:00 sendmail: server ACB6EDEF.ipt.aol.com [172.182.237.239] startup 16157 ? S 0:00 sendmail: server roc-24-169-121-161.rochester.rr.com [24.169.121.161] startup 16158 ? S 0:00 sendmail: server [218.80.30.226] startup 16160 ? S 0:00 sendmail: server [61.61.177.163] startup 16161 ? S 0:00 sendmail: server mail8.ghhijk.com [207.170.98.40] startup 16162 ? S 0:00 sendmail: server [70.214.144.253] startup 16163 ? S 0:00 sendmail: server AReims-108-1-2-130.w81-53.abo.wanadoo.fr [81.53.229.130] startup 16164 ? S 0:00 sendmail: server mta1.true.com [69.56.167.147] startup 16165 ? S 0:00 sendmail: server out014pub.verizon.net [206.46.170.46] startup 16166 ? S 0:00 sendmail: server dc2.dig-net.com [64.95.116.52] startup 16168 ? S 0:00 sendmail: server sccrmhc12.comcast.net [204.127.202.56] startup 16170 ? S 0:00 sendmail: server mail5.fundowntheroad.com [207.170.100.101] startup 16173 ? S 0:00 sendmail: server n12a.bulk.scd.yahoo.com [66.94.237.20] startup 16174 ? S 0:00 sendmail: server [217.23.183.22] startup 16175 ? S 0:00 sendmail: server AAmiens-151-1-34-3.w83-192.abo.wanadoo.fr [83.192.180.3] startup 16176 ? S 0:00 sendmail: server ppp-62-235-124-50.tiscali.be [62.235.124.50] startup 16177 ? S 0:00 sendmail: server [218.25.114.128] startup 16181 ? S 0:00 sendmail: server 22315.bsb.virtua.com.br [200.167.223.15] startup 16187 ? S 0:00 sendmail: server res-66-169-17-252.spa.sc.charter.com [66.169.17.252] startup 16188 ? S 0:00 sendmail: server [61.178.209.21] startup 16193 ? S 0:00 sendmail: server notfound [83.246.112.45] (may be forged) startup 16194 ? S 0:00 sendmail: server FLH1Adt069.tky.mesh.ad.jp [60.236.81.69] startup 16195 ? S 0:00 sendmail: server outmail-01.beerbellybargaina.com [206.71.58.12] startup 16196 ? S 0:00 sendmail: server s5.blackjackpresents.com [65.123.250.108] (may be forged) startup 16197 ? S 0:00 sendmail: server 198.red-82-158-48.user.auna.net [82.158.48.198] (may be forged) startup 16198 ? S 0:00 sendmail: server c90644d4.virtua.com.br [201.6.68.212] startup 16199 ? S 0:00 sendmail: server 217172.bsb.virtua.com.br [200.167.217.172] startup 16200 ? S 0:00 sendmail: server [211.97.156.50] startup 16201 ? S 0:00 sendmail: server cablelink5-82-77-151-202.rdstm.ro [82.77.151.202] (may be forged) startup 16202 ? S 0:00 sendmail: server [200.167.58.83] startup 16204 ? S 0:00 sendmail: server adsl-65-42-242-7.dsl.lgtpmi.ameritech.net [65.42.242.7] startup 16205 ? S 0:00 sendmail: server cm05.edoca.com [66.63.170.45] (may be forged) startup 16208 ? S 0:00 sendmail: server [203.90.160.30] startup 16209 ? S 0:00 sendmail: server cablelink5-82-77-151-202.rdstm.ro [82.77.151.202] (may be forged) startup 16216 ? S 0:00 sendmail: server adsl-69-109-31-184.dsl.renocs.nvbell.net [69.109.31.184] startup 16217 ? S 0:00 sendmail: server user-0cej18t.cable.mindspring.com [24.233.133.29] startup 16221 ? S 0:00 sendmail: server lamx33.havagreatday.com [66.63.182.33] startup 16223 ? S 0:00 sendmail: server [218.52.79.116] startup 16224 ? S 0:00 sendmail: server customer-reverse-entry.69.59.181.180 [69.59.181.180] (may be forged) startup 16225 ? S 0:00 sendmail: server [218.80.102.233] startup 16226 ? S 0:00 sendmail: server outmail-01.centralreliability.com [209.216.105.11] startup 16227 ? S 0:00 sendmail: server modemcable020.183-131-66.mc.videotron.ca [66.131.183.20] startup 16228 ? S 0:00 sendmail: server [219.252.195.7] startup 16232 ? S 0:00 sendmail: server 200-161-19-79.dsl.telesp.net.br [200.161.19.79] startup 16233 ? S 0:00 sendmail: server modemcable214.51-200-24.mc.videotron.ca [24.200.51.214] startup 16234 ? S 0:00 sendmail: server [61.8.211.107] startup 16236 ? S 0:00 sendmail: server hnllhi1-ar8-4-11-077-069.dsl-verizon.net [4.11.77.69] startup 16238 ? S 0:00 sendmail: server n17a.bulk.scd.yahoo.com [66.94.237.46] startup 16239 ? S 0:00 sendmail: server anetrelay2f.authorize.net [64.94.119.18] startup 16241 ? S 0:00 sendmail: server gailleton-1-82-67-6-76.fbx.proxad.net [82.67.6.76] startup 16242 ? S 0:00 sendmail: server ZQ206213.ppp.dion.ne.jp [222.13.206.213] startup 16244 ? S 0:00 sendmail: server adsl-215-218-32.aep.bellsouth.net [68.215.218.32] startup 16245 ? S 0:00 sendmail: server [211.207.196.53] startup 16246 ? S 0:00 sendmail: server c-24-22-47-253.client.comcast.net [24.22.47.253] startup 16247 ? S 0:00 sendmail: server 82-46-253-39.cable.ubr03.smal.blueyonder.co.uk [82.46.253.39] startup 16248 ? S 0:00 sendmail: server out008pub.verizon.net [206.46.170.108] startup 16249 ? S 0:00 sendmail: server host122-48.pool80181.interbusiness.it [80.181.48.122] startup 16250 ? S 0:00 sendmail: server [61.52.37.201] startup 16251 ? S 0:00 sendmail: server cindyloo.teamworksmedia.com [198.63.216.71] startup 16252 ? S 0:00 sendmail: server 206-81-80-237.spokane.acetechusa.com [206.81.80.237] (may be forged) startup 16253 ? S 0:00 sendmail: server ppp-61.91.78.246.revip.asianet.co.th [61.91.78.246] startup 16254 ? S 0:00 sendmail: server [221.233.211.66] startup 16255 ? S 0:00 sendmail: server bb-195-172-49-251.ukonline.co.uk [195.172.49.251] startup 16256 ? S 0:00 sendmail: server outmail-01.centralreliabilityc.com [209.216.105.14] startup 16257 ? S 0:00 sendmail: server 68.domain.tld [207.157.69.68] (may be forged) startup 16258 ? S 0:00 sendmail: server [211.227.149.108] startup 16259 ? S 0:00 sendmail: server 129.red-213-37-90.user.auna.net [213.37.90.129] (may be forged) startup 16260 ? S 0:00 sendmail: server YahooBB218112124022.bbtec.net [218.112.124.22] startup 16261 ? S 0:00 sendmail: server net-152-111-125-52.mweb.co.za [152.111.125.52] (may be forged) startup 16262 ? S 0:00 sendmail: server c-134-80-77.f.dial.de.ignite.net [62.134.80.77] startup 16266 ? S 0:00 sendmail: server [200.103.60.144] startup 16275 ? S 0:00 sendmail: server [61.255.23.78] startup 16277 ? S 0:00 sendmail: server 1.tfmbuysc.com [63.214.155.18] (may be forged) startup 16278 ? S 0:00 sendmail: server 17923191.rjo.virtua.com.br [200.179.231.91] startup 16279 ? S 0:00 sendmail: server 200141086157.user.veloxzone.com.br [200.141.86.157] startup 16294 ? S 0:00 sendmail: ./j01GF1xj016294 [127.0.0.1]: client greeting 16296 ? S 0:00 sendmail: server localhost.localdomain [127.0.0.1] startup 16297 ? S 0:00 sendmail: server user-0cet0mq.cable.mindspring.com [24.238.130.218] startup 16298 ? S 0:00 sendmail: server mail6.ghhijk.com [207.170.98.14] startup 16299 ? S 0:00 sendmail: server mail6.fundowntheroad.com [207.170.100.102] startup 16300 ? S 0:00 sendmail: server mail2.fundowntheroad.com [207.170.100.100] startup 16301 ? S 0:00 sendmail: server [210.204.11.200] startup 16302 ? S 0:00 sendmail: server mail1.fundowntheroad.com [207.170.100.97] startup 16303 ? S 0:00 sendmail: server mail3.fundowntheroad.com [207.170.100.98] startup 16304 ? S 0:00 sendmail: server mail6.fundowntheroad.com [207.170.100.102] startup 16305 ? S 0:00 sendmail: server mail4.villner.com [207.182.156.21] startup 16306 ? S 0:00 sendmail: server mail14.villner.com [207.182.156.31] startup 16307 ? S 0:00 sendmail: server mail17.villner.com [207.182.156.34] startup 16308 ? S 0:00 sendmail: server imr-m03.mx.aol.com [64.12.138.201] startup 16309 ? S 0:00 sendmail: server d4.dafoggle.com [66.154.112.244] startup 16310 ? S 0:00 sendmail: server e6.erfooble.com [66.154.112.86] startup 16311 ? S 0:00 sendmail: server [60.176.251.236] startup 16312 ? SN 0:00 sendmail: ./j01EAF5Z009256 vc.ghul-group.com.: user open 16313 ? S 0:00 sendmail: server [211.158.54.142] startup 16314 ? S 0:00 sendmail: ./j01G90ZZ015842 [127.0.0.1]: client greeting 16315 ? S 0:00 sendmail: server localhost.localdomain [127.0.0.1] startup 16316 ? S 0:00 sendmail: server dsl093-044-153.sac1.dsl.speakeasy.net [66.93.44.153] startup 16317 ? S 0:00 sendmail: server imr-m03.mx.aol.com [64.12.138.201] startup 16318 ? S 0:00 sendmail: server imr-d06.mx.aol.com [205.188.159.7] startup 16323 ? S 0:00 sendmail: server imr-d05.mx.aol.com [205.188.156.66] startup 16324 ? S 0:00 sendmail: server ppp93-67.dsl-pun.eth.net [61.11.93.67] (may be forged) startup 16325 ? S 0:00 sendmail: server [210.204.11.200] startup 16326 ? S 0:00 sendmail: server [219.251.146.109] startup 16327 ? S 0:00 sendmail: server [220.86.153.216] startup 16328 ? S 0:00 sendmail: server [222.79.166.130] startup 16330 ? S 0:00 sendmail: server [65.169.182.69] startup 16332 ? S 0:00 sendmail: server 200-187-213-184.brt.dialuol.com.br [200.187.213.184] startup 16333 ? S 0:00 sendmail: server [200.195.48.163] startup 16334 ? S 0:00 sendmail: server [200.167.58.83] startup 16335 ? S 0:00 sendmail: server [219.248.223.170] startup 16336 ? S 0:00 sendmail: server [211.116.25.117] startup 16337 ? S 0:00 sendmail: server [200.166.30.2] startup 16338 ? S 0:00 sendmail: server [60.222.36.251] startup 16339 ? S 0:00 sendmail: server dhcp024-209-077-079.woh.rr.com [24.209.77.79] startup 16340 ? S 0:00 sendmail: server lamx33.havagreatday.com [66.63.182.33] startup 16341 ? S 0:00 sendmail: server [221.146.163.52] startup 16342 ? S 0:00 sendmail: server pcp01451742pcs.chmbrs01.pa.comcast.net [68.83.40.197] startup 16343 ? S 0:00 sendmail: server adsl-68-255-77-60.dsl.lgtpmi.ameritech.net [68.255.77.60] startup 16344 ? S 0:00 sendmail: server d172.dhcp212-198-132.noos.fr [212.198.132.172] startup 16345 ? S 0:00 sendmail: server dup-148-221-127-252.prodigy.net.mx [148.221.127.252] startup 16346 ? S 0:00 sendmail: server 201-1-168-214.dsl.telesp.net.br [201.1.168.214] (may be forged) startup 16347 ? S 0:00 sendmail: server meaningful.inboxrebates3.com [67.134.43.8] startup 16348 ? S 0:00 sendmail: server 200-98-109-253.tlf.dialuol.com.br [200.98.109.253] startup 16350 ? S 0:00 sendmail: startup with 218.198.33.24 16355 ? S 0:00 sendmail: server pcp07278419pcs.alico01.fl.comcast.net [69.139.62.88] startup 16357 ? S 0:00 sendmail: server 200-168-11-193.dial-up.telesp.net.br [200.168.11.193] (may be forged) startup

2 1

help checking domain please
by Chris Santerre 30 Dec '04

30 Dec '04

OK, I have a hunch it may be spam. It was submitted to SURBL and it pretty much looks like spam, But hard to tell. Anyone help me out? http://www.ijting.com/index.asp?partner=dora Chris Santerre System Admin and SARE/SURBL Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.296 / Virus Database: 265.6.6 - Release Date: 12/28/04

3 4

RE: [SURBL-Discuss] Proflowers again, was: Send Holiday Flowers f or $24.99 plus Beautiful Glass Vase from Proflowers (fwd)
by Chris Santerre 30 Dec '04

30 Dec '04

>>> We've seen piles of spam promoting proflowers.com in the >past two days, >>> all containing asandox.com uris and arriving via an >asandox.com relay. >>> IMO asando.com (http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20781) is >> the uri that should be blocked, not proflowers.com. > > Thank you. That is exactly the right way to reason things. > If asando_ is the actual spamming affiliate or whatever, > then they should be the ones to block. " It raises an interesting philosophical question; is the original company that paid for the compaign and benefits from the sales responsible? I don't claim to have an all-seeing answer, and would like to hear other people's opinions. Cheers, - Bill " Stupid LookOut didn't quote your email :) Anyway......... It depends on the company. I believe _some_ clearly know they are hiring a spammer on the grounds that they can deny knowing it. I believe this percentage is rising. There are a few who don't know they are hiring spammers. Trying to figure out which is which is tough. But in this particular case, the correct thing was done by not listing the flower company. Add then to a watch list. If they show up on radar again, launch the stinger!! --Chris -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.296 / Virus Database: 265.6.6 - Release Date: 12/28/04

2 1

RE: [SURBL-Discuss] Zone File Rsync Server?
by Chris Santerre 29 Dec '04

29 Dec '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Tuesday, December 28, 2004 1:35 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Zone File Rsync Server? > > >Hi! > >> I have to get an ACL setup on the firewall that allows rsync >only to the >> surbl rsync server(s). I have not been able to find >documented anywhere >> what I/P's or server names to use. Can someone point me to >a document >> that provides this information? I would want to rsync multi >(hope this >> request makes sense :-)) >> >> Thanks for any help you can provide. > >You only get the IP once you are allowed to rsync, before that, its >useless to get the IP. We dont list the IP publicly with a >reason, so we >wont post if here either. > First rule of fight club........ ;) --Chris -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.296 / Virus Database: 265.6.6 - Release Date: 12/28/04

1 0

Zone File Rsync Server?
by Johnson, Robert F 28 Dec '04

28 Dec '04

I have to get an ACL setup on the firewall that allows rsync only to the surbl rsync server(s). I have not been able to find documented anywhere what I/P's or server names to use. Can someone point me to a document that provides this information? I would want to rsync multi (hope this request makes sense :-)) Thanks for any help you can provide.

3 2

Proflowers again, was: Send Holiday Flowers for $24.99 plus Beautiful Glass Vase from Proflowers (fwd)
by William Stearns 24 Dec '04

24 Dec '04

Good afternoon, all, We discussed proflowers earlier this year. To quote Jeff: > It also seems they're at least trying to cut back on spamming if we > accept the decrease in recent NANAS sightings. I just received 4 more spams from them, one attached. Perhaps they just get quiet between holidays? I'd like to place one vote for blacklisting them. Opinions? Cheers, - Bill --------------------------------------------------------------------------- "What is the most effective Windows NT remote management tool? A car." -- Network Intrusion Detection, An Analyst's Handbook 2nd Edition, 2000 Stephen Northcutt et al, page 147 (Courtesy of Rodrigo Goya <lucent(a)securenet.com.mx>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

5 8

RE: [SURBL-Discuss] phishing attempt
by Matthew Wilson 24 Dec '04

24 Dec '04

Jeff, I don't know if you ever got access to anti-phishing's phish archive; but if you didn't, you might put up a donation link on your site and solicit contributions that would specifically go toward paying for access to their database, for at least 1 year. Of course, if their database isn't updated as quickly as yours or isn't helpful for the first year, then you obviously wouldn't continue it... Just an idea... Matthew Wilson

2 1

phishing attempt
by Mariano Absatz 24 Dec '04

24 Dec '04

Hi David et al. Just got this phishing attempt referencing: http://211.235.248.74:280/index.php?Ihwt=NBKFdEjFBJRXqkQblivPGRDGUPJEYgMMTy… Cc-ing SURBL just FYI. The complete message is at the bottom. -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com Received: from louiskoo.com ([219.251.237.182]) by prxy6.uba.ar (8.12.10/8.12.10) with ESMTP id iBNB6ZEc035962 for <baby(a)ccc.uba.ar>; Thu, 23 Dec 2004 08:06:37 -0300 (ART) Received: from tcfexpress.com (tcfexpress.com [207.250.12.89]) by louiskoo.com with esmtp id 0D0E50BB10 for <baby(a)ccc.uba.ar>; Thu, 23 Dec 2004 14:07:24 +0300 Reply-To: TCF <support-auto23(a)tcfexpress.com> Message-ID: <110101c4e8df$85ab0d5f$624d22dc(a)tcfexpress.com> From: TCF Support <support-auto53(a)tcfexpress.com> To: Baby <baby(a)ccc.uba.ar> Subject: Debit Card Attention! Date: Thu, 23 Dec 2004 14:07:24 +0300 MIME-Version: 1.0 Content-Type: text/html X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.4682 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 X-GMX-Antivirus: 0 (no virus found) Return-Path: <support-auto53(a)tcfexpress.com> <html> <head><title>TCF - Bank</title></head><body> Dear TCF Client, Information to your attention: our bank is switching to newest transactions security standards. TCF ATM services utilize advanced security technology to protect your personal financial information. This security update will be effective immediately. <a href="http://211.235.248.74:280/index.php?Ihwt=NBKFdEjFBJRXqkQblivPGRDGUPJEYgMMTy…">Please click on this reference.</a> This security upgrade will be effective immediately and requires our customers to update their ATM card information. Thank you for contacting TCF. TCF Security Dept. </body> </html>

2 1

http://www.web-o-trust.org/
by Daniel Quinlan 23 Dec '04

23 Dec '04

(oops, that was sent before I was finished) This whitelist is probably a bit more directly usable than some of my suggestions. I don't know why I didn't think of it before, but Russell Nelson suggested it to me (it's his creation, of course). It should be fairly trivial (and I think there might be a tool for this) to walk the web-o-trust tree, produce a "lowest depth seen" for each domain and then start working through it. I don't know if there are bad entries if you go too deep on the tree. By the way, did I mention why I'm so keen on your whitelist? Once domain authentication becomes a reality, it will be a great source for whitelisting of authenticated senders. I believe Justin has looked at web-o-trust some, so I've copied him on the message. Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

2 1

Re: MIT Spam conference
by Daniel Quinlan 21 Dec '04

21 Dec '04

William Stearns <wstearns(a)pobox.com> writes: > I'll be attending the MIT spam conference this year, Jan 21st, > 9-5. Details at http://www.spamconference.org/ . The registration is > free, but they suggest an early registration before the conference fills > up. Last year, it was awesome to meet up with SpamAssassin developers and other anti-spam folks, but the MIT spam conference itself was disappointing for the second year in a row. It: - was full of poorly reviewed papers of anecdotal information - was unbelievably cold (both inside and outside) - uncomfortable to sit in circa-1965 wood chairs > I'd love a chance to meet other people working on spamassassin and > surbl. Is anyone else planning on attending? I'd love to meet you and other SURBL/SA people. If you want to attend a peer-reviewed anti-spam conference with heating, a pleasant climate, and comfortable seating, I can definitely recommend CEAS. If you're ever in the SF Bay Area and would like to get together, drop me a line. I've met with Jeff a few times. Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

2 1

SURBL and listing abuse address
by Nick Askew 21 Dec '04

21 Dec '04

Hi, I have MDaemon installed and lately it has been working wonders to reject spam. However I've noticed that all it does is bounces the mail back to the person who supposedly sent it. Now we all know that it is almost always some innocent address or a fake address and so best case the bounce is pointless and worst case some innocent person is being bombarded with mails. I'm relatively new to all this so please forgive me if this has been suggested before or indeed if it is simply possible with other mail servers. It occurs to me that we could list the various abuse addresses of the ISP hosting the black listed site and this could be returned when a match is found. If the server software then bounced the mail not to the sender but to the abuse address we would seriously start to affect these ISP's. It seems to me this is not like the lycos solution because we are only sending a mail when we receive a mail that mentions a spam url. The result is that the more spam they send the more mails they receive from us, the less spam they send the less mail they will receive and no innocent addresses are affected. There is a drawback to SURBL and that is that someone could end up black listed wrongly. This mechanism would add insult to injury but lets face it if I wanted to get at xyz.com I'd send out a bunch of spam as if it came from jdoe(a)xyz.com advertising xyz.com and wait for the them to appear on the black list and then send out more spam and now watch their ISP get really upset with them as the bounced messages end up with them. Nick

3 5

RE: [SURBL-Discuss] SURBL and listing abuse address
by Chris Santerre 21 Dec '04

21 Dec '04

>-----Original Message----- >From: Nick Askew [mailto:Nick@Askew.nl] >Sent: Monday, December 20, 2004 3:42 PM >To: 'SURBL Discussion list' >Subject: RE: [SURBL-Discuss] SURBL and listing abuse address > > >> > I'm relatively new to all this so please forgive me if this >> has been >> > suggested before or indeed if it is simply possible with >other mail >> > servers. It occurs to me that we could list the various abuse >> > addresses of the ISP hosting the black listed site and this >> could be >> > returned when a match is found. If the server software >then bounced >> > the mail not to the sender but to the abuse address we >> would seriously >> > start to affect these ISP's. >> >> Most of these domains either dont have abuse addresses, nor >> care about any abuse email that rolls their way (the're just >> dummy domains who only exist for a month to spam, then die).. >> What you are suggesting is going to result in my server >> queueing the message (rather than just returning a 5xx half >> way through the SMTP conversation) and sending it to a >> (probably bogus) abuse address, which will bounce.. >> >Yes I suppose if you simply perform a whois on the IP address of the >site you will end up with some spammer that does not care if >you post to >abuse or postmster. However I would think that most spam domains are >purchased off other ISP's so after a while perhaps it would be possible >to change the listed address to that of the ISP's ISP and so on until >someone takes notice. > >I'm sure that actually fetching the content of the site would work to >deter people from sending out their URL as spam but it would lead to a >new problem. Every machine in the world using SURBL (and let's face it >that should be everyone, it works so well) could be used for a DoS >attack just by sending an email (OK the domain would need to be in >SURBL). Discussing ideas is always good :) A quicker method instead of looking at the spamvertised site, is to look at the whois info for the spam domain. Something being worked on now. All SURBL entries are manually added by a human. Well, some guys ride the border of 'human'. We'll just say biped. :-) --Chris

2 1

RE: [SURBL-Discuss] SURBL and listing abuse address
by Matthew Wilson 21 Dec '04

21 Dec '04

Nick, This isn't a topic for the SURBL discussion list. Please submit your complaint to the MDaemon forums at http://lists.altn.com/WebX?14@189.fwM8arWQnvI.0@.ee88f61 -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Nick Askew Sent: Monday, December 20, 2004 1:46 PM To: discuss(a)lists.surbl.org Subject: [SURBL-Discuss] SURBL and listing abuse address Hi, I have MDaemon installed and lately it has been working wonders to reject spam. However I've noticed that all it does is bounces the mail back to the person who supposedly sent it. Now we all know that it is almost always some innocent address or a fake address and so best case the bounce is pointless and worst case some innocent person is being bombarded with mails. I'm relatively new to all this so please forgive me if this has been suggested before or indeed if it is simply possible with other mail servers. It occurs to me that we could list the various abuse addresses of the ISP hosting the black listed site and this could be returned when a match is found. If the server software then bounced the mail not to the sender but to the abuse address we would seriously start to affect these ISP's. It seems to me this is not like the lycos solution because we are only sending a mail when we receive a mail that mentions a spam url. The result is that the more spam they send the more mails they receive from us, the less spam they send the less mail they will receive and no innocent addresses are affected. There is a drawback to SURBL and that is that someone could end up black listed wrongly. This mechanism would add insult to injury but lets face it if I wanted to get at xyz.com I'd send out a bunch of spam as if it came from jdoe(a)xyz.com advertising xyz.com and wait for the them to appear on the black list and then send out more spam and now watch their ISP get really upset with them as the bounced messages end up with them. Nick _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

3 2

Re: [SURBL-Discuss] SURBL and listing abuse address
by Rob McEwen (PowerView Systems) 20 Dec '04

20 Dec '04

Nick, "Joe Jobs" happen all the time. Usually via a virus which plays "musical chairs" with the address book and sometimes via a spammer maliciously attacking someone. Also, MANY or MOST of these viruses DO contain affiliate URLs and large portion of these ARE SURBL-listed. Therefore, your plan will hurt innocent parties very, very often (not just in cases where someone was wrongly listed in SURBL). But, your intentions are sound and maybe a workable idea will result from this discussion. Rob McEwen

1 0

MIT Spam conference
by William Stearns 18 Dec '04

18 Dec '04

Good day, all, I'll be attending the MIT spam conference this year, Jan 21st, 9-5. Details at http://www.spamconference.org/ . The registration is free, but they suggest an early registration before the conference fills up. I'd love a chance to meet other people working on spamassassin and surbl. Is anyone else planning on attending? Cheers, - Bill --------------------------------------------------------------------------- "God grant me the senility to accept the things I cannot change, The frustration to try to change things I cannot affect, and the wisdom to tell the difference." (Courtesy of Mike Ricketts <rickettm(a)ox.compsoc.net>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

2 1

Re: [SURBL-Discuss] RE: MIT Spam conference
by Matt Yackley 17 Dec '04

17 Dec '04

Chris Santerre said: > > All registered. Unless we get some meltdown here, or my car feezes on the > way like last year, I'll be there! However, being a ninja, you won't see me! > :) J/K, my goal is to get my eyeball as close to the webcast camera. Just > so when I come home I can DL the movie and say "There is my eyeball!!!!" > > Do we get to bring air horns? > > Chris Santerre I'm planning on attending as well. -matt

1 0

RE: [SURBL-Discuss] Thunderbird and SURBL?
by Tim A 17 Dec '04

17 Dec '04

> -----Original Message----- > From: Jeff Chan <jeffc(a)surbl.org> > Date: Thu, 16 Dec 2004 16:35:20 -0800 > Subject: Re: [SURBL-Discuss] Thunderbird and SURBL? > To: Chris Santerre <csanterre(a)merchantsoverseas.com> > Cc: "tim-surbl(a)kosmo.com" <tim-surbl(a)kosmo.com>, SURBL Discussion list > <discuss(a)lists.surbl.org> > ...snip... > >>We have high regards for the SURBL folks and it is in the mix > >>of many methods we use to combat spam at SimpleFilter. We have a > >>POP3 and SMTP service that uses the same backend anti-spam > >>engine and can be used from Thunderbird as it works with any POP3 > >>email client. The SMTP service has some additional features I > >>won't go into here. > >> > > > Hi Tim! > > > Are you saying you will check during download and not download the messege > > if it thinks it is spam? Cause that would give you an A+ in my book! > > And a D+ in my book. It's more efficient to do these checks in > the mail server. If every POP3 user started checking all of > their mail against SURBLs (or other RBLs) our name servers would > start melting. Can we get an A+ re-instated!!! :) Everything is done on the server. We provide a service for POP3 not a client program of any sorts. > Tim, If you're going to do this, please make sure your program > is internally caching the lookups pretty heavily. For example, > make sure it's not checking the same domain more than once per > message (if it appears multiple times in the same message for > example). We are and have been caching lookups. > > > And secondly, please make sure you have a local whitelist! We have seen > > other companies using SURBL that don't whitelist the top doamins, like > > yahoo.com, w3.org, google.com,........ Those kinds of domains should be > > skipped from being looked up. > > Yes, please whitelist (don't check) say the top 100-200 of our > most often hit whitelist entries: > > http://www.surbl.org/dns-queries.whitelist.counts.txt > > That will save many unnecessary DNS queries. Will look into this.

2 1

RE: [SURBL-Discuss] Thunderbird and SURBL?
by Tim A 17 Dec '04

17 Dec '04

> -----Original Message----- > From: Jeff Chan <jeffc(a)surbl.org> > Date: Thu, 16 Dec 2004 16:45:49 -0800 > Subject: Re: [SURBL-Discuss] Thunderbird and SURBL? > To: SURBL Discuss <discuss(a)lists.surbl.org> > > > On Thursday, December 16, 2004, 4:35:20 PM, Jeff Chan wrote: > > It's more efficient to do these checks in > > the mail server. If every POP3 user started checking all of > > their mail against SURBLs (or other RBLs) our name servers would > > start melting. > > > Tim, If you're going to do this, please make sure your program > > is internally caching the lookups pretty heavily. For example, > > make sure it's not checking the same domain more than once per > > message (if it appears multiple times in the same message for > > example). > > OK Minor correction, I see that SimpleFilter is a POP3 proxy > service and not a client program. In other words, it is a > centralized server through which POP traffic passes. Please > still do: ...snip... Sorry, didn't see this when replied to the previous msg. Thanks for the correction. Tim

1 0

RE: MIT Spam conference
by Chris Santerre 17 Dec '04

17 Dec '04

>-----Original Message----- >From: William Stearns [mailto:wstearns@pobox.com] >Sent: Friday, December 17, 2004 3:53 PM >To: ML-spamassassin-talk; ml-surbl-discuss >Cc: William Stearns >Subject: MIT Spam conference > > >Good day, all, > I'll be attending the MIT spam conference this year, Jan 21st, >9-5. Details at http://www.spamconference.org/ . The registration is >free, but they suggest an early registration before the >conference fills >up. > I'd love a chance to meet other people working on >spamassassin and >surbl. Is anyone else planning on attending? > Cheers, > - Bill All registered. Unless we get some meltdown here, or my car feezes on the way like last year, I'll be there! However, being a ninja, you won't see me! :) J/K, my goal is to get my eyeball as close to the webcast camera. Just so when I come home I can DL the movie and say "There is my eyeball!!!!" Do we get to bring air horns? Chris Santerre System Admin and SARE/SURBL Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

RE: [SURBL-Discuss] not spam URL - http://www.templatezone.com/
by Chris Santerre 17 Dec '04

17 Dec '04

*sploooge!* >> >>Against my draconian seasond crank beliefs ,I would vote to >Whitelist them. >> >>--Chris > >While it's against my draconian seasoned crank beliefs, too, we're >getting legitimate mail from one of our suppliers that uses one of >their templates, which has the URL embedded. > >-->Russ With undetectible stealth movement, I drew my katana and slashed templatezone from the SURBL list. ANd with my Shurikan of justice, have thrown them into the whitelist. In a puff of smoke.... I am gone. You saw nothing! :)

1 0

RE: [SURBL-Discuss] not spam URL - http://www.templatezone.com/
by Chris Santerre 17 Dec '04

17 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, December 16, 2004 7:10 PM >To: Russ Ringer >Cc: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] not spam URL - >http://www.templatezone.com/ > > >On Thursday, December 16, 2004, 3:41:33 PM, Russ Ringer wrote: >> http://www.templatezone.com/ is just a place to get templates >> It should not be in SURBL > >They look like a legitimate business, but also sell some kind of >mailing software: > > http://www.templatezone.com/html-email-software/high-impact-email.asp > >"Affordable email marketing for business professionals > >Energize your email marketing messages with High Impact eMail >3.0. Get your recipient's attention. Get noticed. Stand out. Get >the results you want." > > >I lean towards whitelisting, but might like to hear why the WS >guys originally added them (long ago): > >/home/wstearns/black-wstearns-sa-blacklist.200406281446.domains >:templatezone.com > >Any comments WS folks? While I think any company that sells mass email software that is used to send spam should be blacklisted, this case isn't straight black. Their software isn't one of the larger ratware packages, and it is more legit. Yes it has been used to send spam. No doubt about that. But those seem to have other, more evil, URLs in them. So we could hit off of those. Against my draconian seasond crank beliefs ,I would vote to Whitelist them. --Chris

2 1

RE: [SURBL-Discuss] Thunderbird and SURBL?
by Chris Santerre 17 Dec '04

17 Dec '04

>-----Original Message----- >From: Tim A [mailto:tim-surbl@kosmo.com] >Sent: Thursday, December 16, 2004 4:37 PM >To: discuss(a)lists.surbl.org >Subject: RE: [SURBL-Discuss] Thunderbird and SURBL? > > >> -----Original Message----- >> From: Jeff Chan <jeffc(a)surbl.org> >> Date: Mon, 13 Dec 2004 17:21:59 -0800 >> Subject: Re: [SURBL-Discuss] Thunderbird and SURBL? >> To: "SURBL Discussion list (E-mail)" <discuss(a)lists.surbl.org> >> >> On Monday, December 13, 2004, 8:14:51 AM, Chris Santerre wrote: >> > Thinking out loud.... >> >> > Anyone have contact with thunderbird devs? Could a pop >proxy be used to >> > check emails being downloaded by thunderbird on SURBL, >then decline to >> > download the ones that hit? Obviously with whitelist bypasses? >> >> > Then the user could use a web client to delete spams without >> > downloading? Or >> > whatever..... >> >> That's an interesting idea, but it could generate more DNS >> traffic than our name servers can handle. It's probably >> better to do these kinds of things in a centralized way >> on mail servers to take advantage of DNS caching, etc. >> more strongly. > >Since we provide a service to do just this using SURBL >hopefully this isn't taken as a spam to this list. I thought >it would be >useful for folks at SURBL and list members to know who use >SURBL. Perhaps a list should be kept somewhere listing folks making >use of SURBL. > >We have high regards for the SURBL folks and it is in the mix >of many methods we use to combat spam at SimpleFilter. We have a >POP3 and SMTP service that uses the same backend anti-spam >engine and can be used from Thunderbird as it works with any POP3 >email client. The SMTP service has some additional features I >won't go into here. > Hi Tim! Are you saying you will check during download and not download the messege if it thinks it is spam? Cause that would give you an A+ in my book! And secondly, please make sure you have a local whitelist! We have seen other companies using SURBL that don't whitelist the top doamins, like yahoo.com, w3.org, google.com,........ Those kinds of domains should be skipped from being looked up. We do have a list on surbl.org. Granted it isn't very prominent. :) Perhaps Jeff will add you? --Chris

2 2

not spam URL - http://www.templatezone.com/
by Russ Ringer 17 Dec '04

17 Dec '04

http://www.templatezone.com/ is just a place to get templates It should not be in SURBL

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss