- Discuss - Mailman 3

Re: [SURBL-Discuss] [SURBL-Announce] ANNOUNCE: Some two-level-tlds accented characters changed to IDN
by Michele Neylon :: Blacknight 11 Apr '11

11 Apr '11

Interesting issue Has SURBL got anything in place to deal with IDN ccTLDs? ie. where the actual extension is an IDN as well? Regards Michele On 4 Apr 2011, at 16:54, SURBL Announcement list [READONLY] wrote: > Anthony Howe noticed that gcc was complaining about ISO 8859-1 > accented characters used in the two-level-tlds file. With his kind > help, we converted those to equivalent IDN representation. Diffs are: > > 278c278 > < aéroport.ci > --- >> xn--aroport-bya.ci > 893c893 > < drøbak.no > --- >> xn--drbak-wua.no > 1955c1955 > < lea?gaviika.no > --- >> xn--leagaviika-52b.no > 2835c2835 > < osterøy.no > --- >> xn--ostery-fya.no > 3554c3554 > < tysvær.no > --- >> xn--tysvr-vra.no > 3587c3587 > < unjárga.no > --- >> xn--unjrga-rta.no > 3650c3650 > < vegårshei.no > --- >> xn--vegrshei-c0a.no > > As a practical matter this should have little operational impact since > those domains are obscure and unlikely to be abused. Nonetheless, we > thank Anthony for the correction. > > _______________________________________________ > Announce mailing list > Announce(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/announce Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.com/ http://blog.blacknight.com/ http://blacknight.mobi/ http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 UK: 0844 484 9361 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

3 2

removal does not work!?
by Dominic John Rack 15 Mar '11

15 Mar '11

hi, one of my customers has problems sending email to certain recipients. he found out, that his domain "seegerundkollegen.de" is listed on surbl which might be the reason for mails being rejected. i have thoroughly checked the server and cleaned up all problematic files. there definitely had been ftp-abuse so we altered all ftp-accounts also. the server is clean and secure now. we have requested removal from the surbl ph-list about ten days ago - no effect up to now! the domain is still listed L what can we do to solve this issue quickly? it is really important to free this domain! regards. dominic john rack ............................................ mediatects . media architecture and design

3 2

how to contact
by Jason DeGraf 15 Feb '11

15 Feb '11

your whitelist"surbl.org address does not work

1 0

multi.surbl.org.rbldnsd download
by Jeff Poling 31 Jan '11

31 Jan '11

I recently became responsible for our SURBL system. Last week or firewall changed and the SURBL system had issues with the rsync process. We corrected the firewall issues, but I am still seeing the following: You are connected to rsync40 receiving file list ... done multi.surbl.org.rbldnsd rsync error: received SIGUSR1 or SIGINT (code 20) at rsync.c(231) rsync error: received SIGUSR1 or SIGINT (code 20) at main.c(965) I am kind of at a loss as to what is going on. . .any insight is greatly appreciated! Thanks, Jeff

2 1

SpamAssassin
by Eric Lamison 19 Jan '11

19 Jan '11

I'm using SpamAssassin to test for problems with our email and I'm getting warnings about being on SURBL blacklists. When I do a lookup though, it says the server is not listed. Any suggestions as to what the problem is? From SpamAssassin: 1.7 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: logicalwebco.net] 4.5 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist [URIs: logicalwebco.net] 1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist [URIs: logicalwebco.net] 0.8 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist Thanks, Eric Lamison

2 1

Re: [SURBL-Discuss] please forwarding to the webmaster: many links are broken on surbl.org
by gilles＠jmhsa.ch 27 Dec '10

27 Dec '10

Bonjour. Je serai de retour au bureau après les fêtes, soit le 3 janvier. Merci de vous adresser en mon absence à societes(a)jmhsa.ch. Hallo, ich bin zurück im Büro nach den Festtagen am 3. Januar und bitte Sie, sich in der Zwischenzeit an societes(a)jmhsa.ch zu wenden.

1 0

please forwarding to the webmaster: many links are broken on surbl.org
by Martin Schiftan www.blocklist.de 27 Dec '10

27 Dec '10

Hello, on the Website there are a lot of Links broken: http://www.surbl.org/links -> http://www.surbl.org/nameservers-output.html -> http://www.surbl.org/datafeed/ http://www.surbl.org/contact -> Look-Up-Link in the second section refers to http://lookup/ and on all Sites: -> http://www.surbl.org/public-dns.html also i have stop to read, the website is to broken and not complete. Please forwarding this mail to the Webmaster to fix the links and redirects. Because webmaster(a)surbl.org or a other default address does not works. Thanks. Martin Schiftan http://www.blocklist.de/en/ Fail2Ban Reporting Service

2 1

Новое сообщение
by Vovan 13 Dec '10

13 Dec '10

http://samec.org.ua/

1 0

historical data
by Likarish, Peter F 01 Dec '10

01 Dec '10

Hello all, I'm a member of a university research team looking at identifying malicious content online. We're interested in acquiring a list of all malicious URIs seen in the last 6-8 months. Does SURBL maintain historical data? Is there any way to get access to this data? Please let me know if I need to direct my query elsewhere or if anyone has suggestions. Thanks much, Peter Likarish

1 0

RFC: Changing zone files to wildcarded data format
by SURBL Role 25 Nov '10

25 Nov '10

The proposed change: In order to more effectively blacklist abused subdomains, we would like to get feedback on changing the SURBL zone file data format to use wildcards. Currently the records look like this canonically: domain.com (actual result codes not shown) For wildcarding under rbldnsd, the record would look like this: .domain.com For wildcarding under BIND, the record would expand to two: *.domain.com domain.com The above would be the case if both domain.com and all of its subdomains were to be listed, which is the equivalent functional case now. For the BIND version of the zone file, it would generally mean a doubling of file size. In the highly unusual, exceptional case that only an unqualified domain were to be listed, the future record would look like for both rbldnsd and BIND: domain.com In the new case that a subdomain would be listed, the record would look like this for both rbldnsd and BIND: subdomain1.domain.com subdomain2.domain.com subdomain3.domain.com Impact on list data: This change would allow SURBL to list more compromized subdomains of otherwise legitimate sites without impacting the unqualified domain. As a result, this could lead to more complete coverage of cracked domains and abused hosts and facilitate better detection of unsolicited messages that mention such sites. Currently SURBL does list some abused subdomains, but only for a relatively limited number of major hosts such as sites at Microsoft, Google, Yahoo, etc. This change would potentially allow any subdomain to be listed. Application support of subdomain handling: To support the checking of subdomains, applications using SURBL data would need to be modified to send the fully qualified domain to the DNS resolver, assuming the typical DNS query method of lookup were used. Due to the wildcarding of domains generally, the change in applications to support subdomains could be a simple as not reducing domains down to their registered (unqualified) level, i.e., just sending all fully-qualified domains and letting the wildcard in the DNS zone match them. In a sense this makes the design of the SURBL applications simpler since they would no longer need to reduce domains. For example the two- and three-level-tld lookup tables would no longer need to be used, simplifying operations somewhat. Impact on existing nameservers: The last time this subject was raised, the recalled conclusion was that caching in nameservers would not be adversely affected since wildcarded responses are treated correctly in cache for both rbldnsd and BIND. It would be good to get a confirmation of this, otherwise there could be performance or resource impacts in nameservers. Another potential impact is that BIND zone files would be approximately twice as large as they are presently since BIND doesn't support a singular, combined record type for a wildcarded subdomain and its parent domain, unlike rbldnsd. (See the examples above.) This could increase zone file transfer or rsync times for example. This could also increase BIND resource utilization. Most nameservers use rbldnsd, however. rbldnsd systems may be less affected. The impact on rbldnsd zone file size is much less than the doubling in BIND, for example. Other impacts: One less obvious issue is that a change in zone file format could adversely impact applications that use the zone file not in a nameserver. For example reading the data into a database may require that some filtering be added in order to remove the leading dot, or to identify the records differently in the database. They may also need to handle subdomains more generally or in a different way than they currently do. Applications in general may need to be updated to take advantage of the proposed subdomain data. On the other hand, this change should be backward compatible in that wildcarded domains would continue to match queries reduced under the original (current) paradigm. In other words unmodified applications should continue to work as before, with the downside that they would not detect subdomains handled the new way. What other impacts could there be? What other changes would be needed? Would the added subdomain listing capability justify the various impacts, particularly on application design? Request for comments: Given the potential impacts, it seems prudent to ask for comments on the proposed change. Feedback is welcomed. Additional examples: For a full domain owned by the bad guy the listing would be: .badguy.com (rbldnsd) *.badguy.com (BIND) badguy.com (BIND) For a cracked subdomain, the listing would be: cracked.legitimate.com legitimate.com would not be listed. domain.com would almost never be listed in the rbldnsd file, but almost always in BIND. domain.com would usually not be listed for a cracked file, except in the very unusual case that these were bad: domain.com (unqualified) subdomain1.domain.com subdomain2.domain.com but this was good: NOTLISTED.domain.com (which would not be listed)

5 7

Phishtank Data and SURBL?
by Johnson, Ken 21 Oct '10

21 Oct '10

We have been having an increase in the number of phishing messages that slip through our antispam solution. We currently use Can-IT which includes an instance of SpamAssasin which has active scanning on for SURBL. We recognize that no current solution is going to be 100% effective - however one of the most recent phishing messages that got through was for a link which appeared to already be in phishtank.com data (see http://www.phishtank.com/phish_detail.php?phish_id=1068849) We had been working to see if we could incorporate phishtank.com data in the Can-IT environment to add one more source of blocks for these messages to plug some more holes when we noticed per http://www.phishtank.com/friends.php that SURBL appeared to already be listed as using (in some way) phishtank data. We presumed that http://www.surbl.org/lists.html#ph probably used it - but tests seem to have test messages with that url receiving no points inbound. Further testing on the SURBL lookup returned that w3t.org wasn't listed (which makes sense as the underlying url above is a shortener so it's only the extended url that is listed in phishtank and worth flagging on - does SURBL only accept root domains for listing? Basically we're just trying to figure out if this is a config error on our part or a misunderstanding on our part of how SURBL uses phishtank.com data and/or classifies reported phishing sites and subdirectories in the first place. Thanks in advance for any insight! Ken Johnson Information Technology LeTourneau University

2 1

portion of my domain name is List
by David Fletcher (SAN) 14 Oct '10

14 Oct '10

Hello, My domain is Sandestin.com. We are having some issues of our emails being blocked as spam. The message is 552 tin.com found in SURBL: Blocked, tin.com on lists [ws], See: http://www.surbl.org/lists.html. My domain isn't on the lookup but tin.com. Where do you think this issue lies? Is it SURBL or the spam filtering that is using surbl? David Fletcher I.T. Dept

3 2

Rejected content by multi.surbl.org
by Shattuck, Will 19 Jul '10

19 Jul '10

Hi all, One of my users sent email someone and received a rejected notice. Here it is: host mx01.lastspam.com[64.15.150.3] said: 550-5.7.1 rejected content, black listed 2010.In by multi.surbl.org. #762 #895 (m6F1MY037314479000) The attachments being sent were a 38 KB Excel file, and 1 MB PowerPoint. I understand that SURBL checks for websites and URLs inside the email, but I can't seem to find anything about SURBL lists rejecting content. I'm inquiring as we need to make sure these attachments get to the recipient. Thanks, Will

5 8

Detail information for listing / Removal request
by 127.0.0.1＠gmx.de 13 Jul '10

13 Jul '10

Hello, is there any page i can verify the source mails or urls which has led to the listing of the domain "ncsrv.de" at SURBL? This domain is used as a alternative url for almost every server in our network (server1 ... server99999.ncsrv.de), so websites are available even no customer domain is routed on the certain server. We use this domain also as internal identifier, also included in the host name configuration. As you will understand a full control over every URL used in unsolicited messages is almost impossible because we have a lot of root systems, so we can not shut down every listed URLs immediately. Is there a possibility to check for new entries at SURBL automatically so we can respond to that issue? Thanks, Rafael -- GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01

3 9

How to delist from the SURBL list?
by SnipURL Editor 30 Jun '10

30 Jun '10

Hi, I have tried to send an email from the Lookup page, but that email is bouncing. What am I missing? Whom can I contact to get my IP unlisted, given that it's now been a month since it's been wrongly put in the list? Thanks Shanx

5 8

www.jmhsa.ch
by Gilles Robert 04 Jun '10

04 Jun '10

Hello, Why do I have such message from my program antispam : 1 .5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist > * [URIs: jmhsa.ch] I did check, our site jmhsa.ch is not blacklisted by ws_surbl.... Can anyone help me ? Thanks and regards. Gilles Les Sociétés JMH Cassarde 4 2000 Neuchâtel Tél. ++41.32.729.00.20 Fax ++41.32.729.00.29 www.jmhsa.ch societes(a)jmhsa.ch

3 2

Re: [SURBL-Discuss] Email Rejected due to Multi.surbl.org (Duane Wolf)
by Wolf, Duane A. 28 Apr '10

28 Apr '10

Well luckily I'm the mail administrator on both sides of this issue! :) What I found was that my firewall on the receiving side has a feature that utilizes uribl. Disabling this feature stopped the email rejections. Upon further investigation into this (with the help of some others folks) it was determined that uribl might have changed the way they do their blacklist notifications now. It looks like their "whitelists" (i.e. those that should not be blocked) also return results now - which is probably why the uribl feature blocks the email. http://uribl.com/about.shtml >From what I can see, their whitelist is not included in the multi list or its not working. I maybe off base on this but wanted to post what I have found so far. I am currently catching up on all the suggestions and info presented so far. Thanks again for everybody's help. Duane ------------------------------ _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss End of Discuss Digest, Vol 66, Issue 3 **************************************

2 1

Email Rejected due to Multi.surbl.org
by Wolf, Duane A. 27 Apr '10

27 Apr '10

I've been researching an issue where emails are getting rejected with these NDR errors: An error occurred while trying to deliver this message to the recipient's e-mail address. Microsoft Exchange will not try to redeliver this message for you. Please try resending this message, or provide the following diagnostic text to your system administrator. The following organization rejected your message: smoothwall. _____ Sent by Microsoft Exchange Server 2007 Diagnostic information for administrators: #552 www.w3.org in multi.surbl.org: 74.63.164.174 ## #552 www.w3.org in multi.surbl.org: 204.232.162.153 ## If I'm reading this correctly the emails are being rejected cause the multi.susrbl.org found a reference to w3.org in a HTML email?? How can this be fixed/removed/corrected? Thanks, Duane

4 3

How do I register two-level freehosting domains?
by Victor Popov 09 Apr '10

09 Apr '10

Hello everyone, I am a freehosting sysadmin and we are providing free registration of a 3-level domain within our 2-level domains. As registration is free, some abuse is possible, but it does not appear to be fair to list entire 2-level domain because of some abusers, which would list innocent sites within same domain. I am wondering, how our domains can be included in http://www.surbl.org/tld/two-level-tlds ? I see similar freehosting domain in this file, such as by.ru, chat.ru, front.ru, hotbox.ru, hotmail.ru, land.ru and others. Here is the list of our freehosting domains: aiq.ru al.ru bip.ru bos.ru dax.ru dem.ru dtn.ru far.ru fud.ru hobi.ru hop.ru metastock.ru pips.ru rxt.ru supercharts.ru tora.ru vipcentr.ru vipshop.ru viptop.ru vov.ru wallst.ru webservis.ru A right contact suggestions for this question or other hint would be appreciated. -- Best regards, Victor Popov mailto:vpopov@centre.ru

1 0

New SURBL TLD Files
by Bill Landry 03 Mar '10

03 Mar '10

Hi List, I noticed in Spamassassin bugzilla: https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6335 that there are 2 new TLD files available for uses with SURBL: "two-level-tlds" and "three-level-tlds". However, I am wondering where these files should be placed and if they need to be renamed and have .cf appended to them like the "90_2tld.cf" file URIBL supplies? Thanks in advance for any guidance or feedback. Regards, Bill

3 5

Get detail information why domain is blocked
by Michael Ruf (Inxmail GmbH) 19 Feb '10

19 Feb '10

Hi, one of our domains (inxserver.com) is blocked, list is ab.surbl.org. Is it possible to get detailed information why the domain is blocked. I've already used the form on surbl.org to request removal of the entry. Best whishes Michael -- ISP Relations & Privacy ------------------------------------------------------ Inxmail GmbH Wentzingerstr. 21, 79106 Freiburg, Germany Tel: +49 761 296979-0, Fax: -9 michael.ruf(a)inxmail.de, www.inxmail.de Handelsregister Freiburg, HRB 5870 Ust.-ID: DE198371679 Geschäftsleitung: Martin Bucher, Peter Ziras ------------------------------------------------------ Inxmail Professional kostenlos testen: http://www.inxmail.de/jetzt-testen Tipps und Tricks für E-Mail-Marketers: http://www.inxmail.de/newsletter Inxmail kompakt in 140 Zeichen: http://www.twitter.com/inxmail_gmbh

2 1

Question about listed domains
by Matthew C. Stith 11 Feb '10

11 Feb '10

All, Is there a way to find out why domains have been listed on the SURBL list? If someone can contact me off list with details as to how I can go about finding this information I would apprciate it. Regards, Matt Matthew Stith Postmaster II Rackspace Hosting Email and Apps Division matthew.stith(a)rackspace.com

2 1

URL shortener abuse data
by Ron Guerin 21 Dec '09

21 Dec '09

As I've mentioned here before, I write an open source URL shortening service. I also operate one publicly since that was the only way I was ever going to get useful real world data to work with. To look at the code though, you'd think I run an anti-abuse system that also shortens URLs. So goes the Internet I guess. While I have a tiny number of users relative to any URL shortening service you've ever heard of, a couple of thousand people have downloaded the software, and I'm aware of a couple of dozen public installations. Between all the ones that may be out there, we might just produce enough abuse data to make it worth someone's while to use it. As I'm about to do a lot of work on the software in preparation for a new release, I'd like to get anyone's thoughts about the following: 1. Interest: Is anyone interested in using URI abuse data produced by URL shorteners? 2. Ideal way to supply the data: I'd rather supply it to SURBL or some other well-run URI BL for inclusion in an existing URI BL service than operate one for this purpose. I'm looking to use anything that remotely resembles standards for everyone's sake, rather than re-invent the wheel. 3. Trust/Reputation: I've discovered on a couple of occasions that I'd been using on my mail server abuse data from shoddily run operations, and frankly this is much much worse than getting some spam. I don't intend to be Yet Another Irresponsible BL Operator running an absentee automated blocklist data source. Yet, in order to have enough data to be worth sending somewhere, I'm going to need to accept input from my users, both of the service, and of the source code. I plan on doing something similar to Craigslist whereby people can report abuse from the web site and a certain number of complaints will disable the redirection. As for my source code users, I think I need some kind of reputation system. Any thoughts about this would be appreciated. - Ron

2 1

Re: [SURBL-Discuss] [SURBL-Announce] Most Abused TLDs report added
by Kris Deugau 03 Nov '09

03 Nov '09

SURBL Announcement list [READONLY] wrote: > SURBL has added a report of Most Abused TLDs. This is a daily count of > the TLDs most commonly appearing in SURBL data and is an indication of > relative abuse levels. > > http://www.surbl.org/tld-subtotals.head Some interesting numbers, but what might be more interesting is to see the *percentage* of domains in each TLD - .com domains may be highest on the list, but I suspect there are far more .com domains overall as well, and the percentage of abused .net and .info domains is much closer to the .com (possibly higher). -kgd

2 1

I seem to have been blacklisted for a few hours
by Steven W. Orr 15 Oct '09

15 Oct '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Now it seems to be fixed before I could even finish writing the request to be removed from the blacklist. I was in [[SURBL Lookup Result: syslang.net is on SURBL lists: WS Back to SURBL Lookup Page ]] Do I get to find out why I was blacklisted? I'm one of the good guys, but I suppose all the badguys say that too. Seriously, am I entitled to an answer? This is the first time it has happened and I've been running for over 10 years. It's a non-commercial community opt-in mailinglist. There's a wiki with recommendations for local services by the registered members of the list. And I do apologise if this is a frequent question, but I saw no way to get this answer myself. TIA - -- Time flies like the wind. Fruit flies like a banana. Stranger things have .0. happened but none stranger than this. Does your driver's license say Organ ..0 Donor?Black holes are where God divided by zero. Listen to me! We are all- 000 individuals! What if this weren't a hypothetical question? steveo at syslang.net steven orr -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkrXXQ4ACgkQRIVy4fC+NySZmgCfWVLkMCcmcThVE45mpmT742/E uuAAnAp7J7nz4Ze3ZWTDMA8A4ORTvAJH =kBNZ -----END PGP SIGNATURE-----

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss