- Discuss - Mailman 3

RE: [SURBL-Discuss] Hi I'm new and I like SURBL
by Paul Schwarz 07 Dec '04

07 Dec '04

I'm using XWall and this is what it states: ----------------------------------------------------------- GreyListing GreyListing spam filter, based on http://projects.puremagic.com/greylisting The GreyListing method looks at three pieces of information about any particular mail delivery attempt: The IP address of the host attempting the delivery The envelope sender address The envelope recipient address >From this an unique triplet for identifying a message is created and if this triplet was never been seen before, or the sender is not excluded or on the white list, then the message delivery is refused with a temporary failure. Any normal SMTP server will reschedule the message and will resend it after some time ( usually 10 - 15 minutes ). Spammers however are sending applications designed specifically for spamming. These applications usually adopt the fire-and-forget methodology. That is, they attempt to send the spam to one or several MX hosts for a domain, but then never attempt a true retry as a real SMTP server would. There are some misbehaving mail servers that have a problem with GreyListing and XWall automatically excludes them. You will find the list at GreyListing Exclusions Note: Make sure your backup MX SMTP also runs XWall or any other SMTP server that support GreyListing or else the spammer will bypass XWall by sending to XWall first and then to the backup MX. Max triplets to gather Defines how many triples XWall should member Initial delay of a previously unknown triplet Lifetime of triplets that have allowed mail to pass Lifetime of triplets that have not yet allowed a mail to pass Defines the time interval of the triples Show detailed triplet description (last seen, time elapsed) If this is enabled XWall shows a detailed description about the status of the triplet, including the last seen and elapsed time. ----------------------------------------------------------- -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan Sent: Tuesday, December 07, 2004 1:10 AM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] Hi I'm new and I like SURBL On Monday, December 6, 2004, 8:54:09 PM, Joseph Burford wrote: (Paul Schwarz writes:) >> Is anyone else recommending or not recommending greylisting and what are >> your experiences. Seems like surbl should get more effective over the > Greylisting rocks, however I've been building a greylist whitelist to > help get over the problem of various people who run non-compliant systems. > So with a good list of trusted netblocks not to greylist, it is even > more effective. I've been sharing this with a few people, if you or > anyone else is interested please mail me offlist. OK I think there may be some confusion about the term 'greylisting' here. Greylisting is one of those terms that can mean different things in different contexts. In this case, it looks like: 1. Paul may be referring to putting marginal spams into a separate mail folder or mailbox so that they can be checked manually for spamminess, then delivered or deleted. Perhaps Paul can clarify if that's what he meant. 2. Joseph means using blocklists based on 'grey' criteria, i.e. domains are mentioned in some legitimate mail and also some spams. Jeff C. -- "If it appears in hams, then don't list it." _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

RE: [SURBL-Discuss] www.rulesemporium.com down?
by Thomas Kinghorn [MTNNS -Rosebank] 07 Dec '04

07 Dec '04

Same result. Looks down. Tom -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Martin Sent: 07 December 2004 11:29 AM To: discuss(a)lists.surbl.org Subject: [SURBL-Discuss] www.rulesemporium.com down? Or is it just here? Thanks / Martin _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: Non-Clickable URI's
by Chris Santerre 07 Dec '04

07 Dec '04

>-----Original Message----- >From: RD [mailto:bitoy@lawin.pinoy.org] >Sent: Friday, December 03, 2004 8:21 PM >To: Spamassassin List >Subject: Non-Clickable URI's > > >Hello List, > >I've seen spams where spammers are using >"Cut&Paste_this_URL_to_your_browser" method reason why spamassassin >won't trigger SURBL database lookup. > >Is there a known workaround to catch this non-clickable URIs >and trigger >SURBL lookup? This is in the form of www . domain . com It was mentioned on the SURBL list, and I wrote a quick and dirty SA rule for it. Initial tests were dissmal. Found 2 ham: > http :// www . drugstore . com / ivd0324 > header copied into the body of a forward: > X-Scanned-By: MIMEDefang 2.28 (www . roaringpenguin . com / mimedefang) Also hit 12 spam out of around 70k. A little more testing needed. But I think this shows that it isn't worth the rule. The links break and require end lusers to not only copy and paste, but edit the link to remove the spaces. Clearly more then most users would do. --Chris

2 1

RE: [SURBL-Discuss] Re: a few URL blacklist sources
by Chris Santerre 06 Dec '04

06 Dec '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Monday, December 06, 2004 1:19 PM >To: quinlan(a)pathname.com >Cc: SURBL Discuss >Subject: [SURBL-Discuss] Re: a few URL blacklist sources > > >> http://moinmaster.wikiwikiweb.de/BadContent > >Apparently, this is now just a copy of mt-blacklist: > > http://www.jayallen.org/comment_spam/ > >It looks a little stagnant, but my previous cooperation suggestion >stands. :-) Thanks DQ. Looks like some good sources. I'll talk to Jeff and see if we can come up with something. I know he will want to put this thru a test of some sort to reduce FPs. But a great idea. --Chris

1 0

RE: [SURBL-Discuss] Web page
by Chris Santerre 06 Dec '04

06 Dec '04

Sweet! Thanks! --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 8:54 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Web page > > >On Friday, December 3, 2004, 8:31:51 AM, Chris Santerre wrote: >> Do we list all the programs that curently support SURBL on >the web site? It >> seemed to escape my eyes if it is. > >There was a partial list on the Quick Start page under "Additional >programs using SURBLs", which I've just updated. > > http://www.surbl.org/quickstart.html > >"Additional programs using SURBLs > >Many programs now support SURBLs including sendmail, qmail, >qmail-ldap, exim, exchange, Policy Patrol, MailScanner, Declude >Junkmail, Merak Mail Server, MDaemon, GEE Whiz, SpamBouncer, >ALOAHA, ASTPS, NEMX Power Tools, XWall, ORFilter, STAT AntiSpam, >MTS Professional, Trash Finder, and more. Please see the News and >Links sections for more information." > >The main list is on the Links page: > > http://www.surbl.org/links.html > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Web page
by Chris Santerre 04 Dec '04

04 Dec '04

Do we list all the programs that curently support SURBL on the web site? It seemed to escape my eyes if it is. --Chris

2 1

RE: [SURBL-Announce] SURBL patches for qmail and qmail-ldap
by Chris Santerre 03 Dec '04

03 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 10:15 AM >To: SURBL Announce >Subject: [SURBL-Announce] SURBL patches for qmail and qmail-ldap > > >Pieter Droogendijk has written patches for qmail and qmail-ldap >to support SURBLs: > *sniff* our little baby, is growing up so fast! ;) --Chris

1 0

RE: [SURBL-Discuss] What are the chances of FP on Newsletters and Order Confs.
by Chris Santerre 03 Dec '04

03 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 12:19 AM >To: Paul Schwarz >Cc: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] What are the chances of FP on Newsletters >and Order Confs. > *snip* > >In a nutshell our false positive rate is very low. Our policies >help that, and you can help by reporting any false positives >you may find to us. Our rate of false positive reports is very >low, probably less than one per day. A comment on this. This FP rate is arguable in my eyes. Anyone on the SURBL list knows Jeff and I have a difference of opinion as to what an FP is :-) (Much love for Jeff!) If a legit newsletter sends to a spamtrap, then is that truely an FP? Think about that, let it simmer, eat something, think about it some more, then answer it. (You don't have to answer that one Jeff, I know....) But we follow the SURBL contributor rules whether we like them or not. WWJD= What would Jeff do? ;) I have to admit, it bothers me that Theo's stats show the WS list in second lowest place for FPs. Damit it! We want to be the lowest FP rate of them all!!! Call it a freindly competition. We are close, so close. --Chris

1 0

RE: [SURBL-Discuss] Spammers Workaround
by Chris Santerre 03 Dec '04

03 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 2:45 AM >To: RD >Cc: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Spammers Workaround > > >On Thursday, December 2, 2004, 11:02:26 PM, RD RD wrote: >> I just thought that an additional feature for SpamcopURI to scan the >> message for a non-clickable links/domains that is present it >SURBL would >> be a nice add-on. > >SpamAssassin probably already does quite a bit of deobfuscation >to detect URIs and domains in them. I think it may look for >www.domain.com already, but I don't know about www . domain . com >You could look at the source code or ask them.... > Actually I see a nice pattern to look for. I will right an SA rule for this and post it later today for testing. But if people are stupid enough to fall for spams, then they are too stupid to remove the spaces, and these links are useless. :) --Chris (I'm a toys-r-us kid!)

1 0

Spammers Workaround
by RD 03 Dec '04

03 Dec '04

Hello List, Somehow spammers are using below's method to get around SURBL. I can create a simple body rule but might end-up having a huge list like the bigevil list. Any suggestions how to beat this type of spam? Subject: Rx Meds to go From: "zasrybf" <zasrybf(a)yahoo.com> Date: Wed, 01 Dec 2004 19:15:43 -0700 To: <Undisclosed Recipients> Total confidentiality with hundreds of different drug products in stock. Your very best prescription medications online. www. rxandyou. com (Copy and Paste this address to your browser) Thanks in advance. -RD

3 6

What are the chances of FP on Newsletters and Order Confs.
by Paul Schwarz 03 Dec '04

03 Dec '04

Hi Guys, just wondered if using SURBL will block IT Dept, HR Dept and such newsletters that people get. We get a lot of those in our depts. Also what are the chances of blocking a confirmation emails for something someone orders, etc And also Airlines Just feeling a little leery of using SURBL for a risk of false positives. Seems like a lot of newsletters outsource to companies that could look like spammers. I know it won't block and person to person email but can you help me feel more comfortable about SURBL ? Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100 www.starktruss.com

5 5

Lycos Screensaver that attacks Spammers
by Kevin A. McGrail 03 Dec '04

03 Dec '04

Below is an interesting article from The Washington Post where it details a new screensaver from Lycos. The screensaver visits websites while your computer is idle that are referenced in SPAM and make it to a bad spammers list. This is done in an attempt to limit the website ability to server traffic efficiently by causing extra traffic. While I question the 100% legality of such a tactic, it DOES make sense that we could make a SURBL site-still-online-verification-list that would cause an LWP request to URLs per incoming email. This could be used to verify that websites are still online which is valid and is done in response only to email received at your server. Perhaps this information wouldn't be used Real-time to prevent mail server delays but simply collected in the background and reported to a central service. If it has the added benefit of costing spammers extra money or slowing down their site, they should throttle their improper email outbound having a direct 1:1 correlation. Thoughts? KAM http://www.washingtonpost.com/ac2/wp-dyn/A22311-2004Nov30?language=printer Lycos Offers Program to Attack Spammers By Daniel Woolls The Associated Press Tuesday, November 30, 2004; 9:50 PM MADRID, Spain -- At the risk of breaching Internet civility, a European Web portal is offering its visitors a weapon against spam: a screensaver program that tries to choke spam servers by flooding them with junk traffic. As of Tuesday, about 65,000 people have signed up for the controversial tool from the German-based Lycos Europe, whose sites get 20 million users monthly. The company insists the technique is legal - it says the culprit servers are simply choked a bit, not completely asphyxiated - and dismissed concerns that its "Make Love not Spam" offensive can further clog the world's digital pipeline. Still, computer experts are worried. "You don't stop a bad thing by being bad yourself," said David Farber, former chief technologist at the U.S. Federal Communications Commission. "The idea of somebody coming and hitting you and you hitting back, you both end up very hurt. It just aggrevates an already serious problem." When a computer with the free Lycos screensaver is idle, the program sends junk commands to Web sites identified by Lycos as selling products pitched in spam. When done in masse, this eats up precious bandwidth, causing the sites to overload and slow down. The goal, said Lycos Europe spokesman Kay Oberbeck, is to "show the owners of such spam Web sites that there is massive interest of thousands of users who are not willing to just give up against more and more spam each day." The targets generally are not the servers used to do the actual mailings; these days, those servers are most often legitimate ones co-opted into spamming by viruses and worms. Lycos chooses its targets by reviewing lists of suspect sites identified by independent spam monitors such as SpamCop. The company said it checks each manually to make sure it genuinely carries products promoted by spam, though Oberbeck acknowledged the risk of going after a legitimate site that has been hijacked by a spam-spewing site. He said Lycos takes care not to crash spam servers altogether, ensuring that they will never go below 5 percent bandwidth. Thus, he said, the offensive isn't the same as denial-of-service attacks commonly used by hackers to incapacitate Web sites. Cyberspace activism - such as virtual sit-ins in which computer users gang together and use automated tools to flood a Web site - is not entirely new, said Dorothy Denning, a professor of defense analysis at the Navy Postgraduate School in Monterey, Calif. But in this case a for-profit company is the driving force. "The interesting question is whether or not that company might be liable under some law, and would probably be liable, certainly, at least under a lawsuit by the spammers," she said. Denning believes any impact on spamming will be minor at best. Though spam sites have to pay for bandwidth required for the extra traffic, she said, "the cost off adding extra bandwidth may be worth the reward that comes from spamming." © 2004 The Associated Press

4 5

Nullsoft .com FP?
by Chris_Barton＠McAfee.com 03 Dec '04

03 Dec '04

Hi, I just noticed nullsoft .com was listed in the sc list. They are the people behind WinAmp Etc & Now owned by AOL. Could one of you review it please? Registered in 1997 and not updated for almost a year. I have a sample showing it was used as link fodder in a cheap s/w spam. Chris.

2 1

Discuss: WAS: SURBL+ Checker Submission
by Chris Santerre 03 Dec '04

03 Dec '04

I stripped the header for this discussion. Is this a spam domain or an attempt to poison SURBL. It is obviously a spam, but is domain bogus? >-----Original Message----- >Subject: SURBL+ Checker Submission > > >Date: Fri Nov 26 02:45:48 2004 > >Applicable List: URIBL:ws.surbl.org >Reported URI/IP: com.info >Rating: Black - 100% spam > >Email Source: >---------------------------------------- > *SNIP* > by ra093.prone.absorptive.skeptic.yahoo.com > (InterMail vB.5.%RNDDIGIT2.%RNDDIGIT2.%RNDDIGIT2 >369-%RNDDIGIT15-9-%RNDDIGIT15-%RNDDIGIT15-%RNDDIGIT510) with ESMTP > id ><%RNDDIGIT515.%RNDUCCHAR355029.ny29-mail.nail.date.net.cable.ro >gers.com@autism> > for <export(a)blnotts.com>; Thu, 25 Nov 2004 20:24:06 -0500 >Message-ID: ><04710%RNDLCCHAR15%RNDDIGIT15%RNDLCCHAR15$%RNDDIGIT17535jf702$% >RNDDIGIT15ms53hme10@bask> >Reply-To: "privacy" <tvwghz(a)yahoo.com> >From: "privacy" <tvwghz(a)yahoo.com> >To: <export(a)blnotts.com> >Subject: cure for anxioty, for the pr1ce of a newspaper a day. >Date: Fri, 26 Nov 2004 05:24:06 +0400 >MIME-Version: 1.0 >Content-Type: multipart/alternative; > boundary="--65897551847182532" > >----65897551847182532 >Content-Type: text/html; >Content-Transfer-Encoding: quoted-printable > ><html> ><body text=3Dblack bgcolor=3Dwhite link=3Dblue alink=3Dblue >vlink=3Dblue> ><center> >Wanted to try Cialis but thought it was >way too expe= >nsive >for you? >You can do that now! Cialis at only $1.90 per dose. >Your best deals are <a >href=3D"http://hesatosser.com.info/?wid=3D100005">H= >ERE</a> > >You have enjoyed Viagra and wish for a >longer effect= >? >Cialis can make it happen. >UNBELIEVABLE! CIALIS AT ONLY $1.90 PER DOSE > >Say NO! to planning sex for hours in advance and your disappointment >after "a missed dose". You don't have to be content with a four hour >action of an regular pill. Get CIALIS now to ensure the whole day of >joyful sexual intimacy for you and your partner. > >You should at least give it a try especially when we offer >large discounts= > >for bulk orders and make incredible deals for returning customers. > > ><a href=3D"http://hesatosser.com.info/?wid=3D100005"> >Get it now > ></a> > > > size=3D"1"><a= > href=3D"http://http://hesatosser.com.com/nomore.html">Go >here</a> to stop= > this from being delivered ></body></html> > >----65897551847182532-- > > >---------------------------------------- >

3 2

RE: [SURBL-Discuss] Discuss: WAS: SURBL+ Checker Submission
by Chris Santerre 02 Dec '04

02 Dec '04

>-----Original Message----- >From: David B Funk [mailto:dbfunk@engineering.uiowa.edu] >Sent: Thursday, December 02, 2004 5:10 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Discuss: WAS: SURBL+ Checker Submission > > >On Thu, 2 Dec 2004, Chris Santerre wrote: > >> I stripped the header for this discussion. Is this a spam >domain or an >> attempt to poison SURBL. It is obviously a spam, but is domain bogus? >> >> >-----Original Message----- >> *SNIP* >> >[snip..] >> >href=3D"http://hesatosser.com.info/?wid=3D100005">H= >> >ERE</a> >[snip..] >> ><a href=3D"http://hesatosser.com.info/?wid=3D100005"> >> >Get it now >[snip..] >> > href=3D"http://http://hesatosser.com.com/nomore.html">Go >> >here</a> to stop= > >Neither, it's broken spam-ware. The actual pill-spam-site >is "hesatosser .com" (which is listed in SURBL ;). > >"*.com.com" is a valid domain name, belongs to CNet, clearly >not spam. "*.com.info" isn't even a valid domain at all. > Thanks dave, that is what I thought. Helped to hear it from someone else :) --Chris

1 0

RE: What is up with surbl.org?
by Chris Santerre 02 Dec '04

02 Dec '04

>-----Original Message----- >From: Mark [mailto:admin@asarian-host.net] >Sent: Thursday, December 02, 2004 3:43 PM >To: users(a)spamassassin.apache.org >Subject: What is up with surbl.org? > > >How come surbl.org has a "Bad" status at rating.cloudmark.com? (see >below). This is not good. > Jealousy? :) Maybe they are related to that fifth dentist? Perhaps Jeff should contact them with a "What up, dude?" email? --Chris (Why won't this javalin lock on target!!!!!) NOTE: I think we should make everyone who uses SURBL buy a copy of Joint Operations and play with us ;) Halo is for small thinking people!

2 1

MISC: Is this why google is looking to hire antispam people?
by Chris Santerre 02 Dec '04

02 Dec '04

Cnet article: http://tinyurl.com/3mgxd Perhaps google should look into using SURBL? Maybe just the phishing part of it? Anyone have a google contact? " Phishers lie in wait for Google searchers Traditionally, phishing scammers have lured their victims to fraudulent Web sites by sending official-looking e-mails that are ostensibly from well-known companies asking users to 'verify' their user names and passwords. Now many are setting up legitimate looking e-commerce sites that disguise links to malicious software as pictures of goods on sale, CyberGuard said Wednesday. Paul Henry, a senior vice president at CyberGuard, said that when Web shoppers search the Internet looking for products they want to buy, they could be directed to a plausible e-commerce site that instructs them to "Click here to download images" of the product. Henry said that instead of linking to pictures of the advertised product, the links point to a self-extracting ZIP file that installs a Trojan horse on the victim's computer. The program could then steal personal and financial information. ......... ... " Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

RE: [SURBL-Discuss] What are the chances of FP on Newsletters and Order Confs.
by Paul Schwarz 02 Dec '04

02 Dec '04

I don't use SA, I use XWall for Exchange and can't set the score of a SURBL... So I only have the choice to mark the subject or just send a DSN. Right now I send a DSN b/c it's useless to forward the spams to the individuals IMHO. I'm not sure what you mean about "Confirmation emails would contain links to your own domain." Actually I'm a spam killer ninja (jr that is) Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100 -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Chris Santerre Sent: Thursday, December 02, 2004 10:59 AM To: 'SURBL Discussion list' Subject: RE: [SURBL-Discuss] What are the chances of FP on Newsletters and Order Confs. >-----Original Message----- >From: Paul Schwarz [mailto:Paul.Schwarz@starktruss.com] >Sent: Thursday, December 02, 2004 10:12 AM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] What are the chances of FP on Newsletters and >Order Confs. > > >Hi Guys, just wondered if using SURBL will block IT Dept, HR Dept and >such >newsletters that people get. We get a lot of those in our depts. > >Also what are the chances of blocking a confirmation emails for >something >someone orders, etc And also Airlines > >Just feeling a little leery of using SURBL for a risk of false >positives. >Seems like a lot of newsletters outsource to companies that could look >like spammers. > >I know it won't block and person to person email but can you help me >feel more comfortable about SURBL ? > Greetings Paul, SURBL should block NONE of these. (Well we don't block anything, we flag, but you know what I mean.) We whitelist airlines. Confirmation emails would contina links to your own domain. You are not a spammer, are you? If you aren't, you won't get listed. If it is an order from to your company it is the same. You can always lower the score of SURBL and try it out if you are worried. But you will be VERY happy with it. 4 out of 5 Dentists approve of SURBL. But we don't count the fifth one, because his parents were cousins ;) Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: [SURBL-Discuss] What are the chances of FP on Newsletters and Order Confs.
by Chris Santerre 02 Dec '04

02 Dec '04

>-----Original Message----- >From: Paul Schwarz [mailto:Paul.Schwarz@starktruss.com] >Sent: Thursday, December 02, 2004 10:12 AM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] What are the chances of FP on Newsletters and >Order Confs. > > >Hi Guys, just wondered if using SURBL will block IT Dept, HR >Dept and such >newsletters that people get. We get a lot of those in our depts. > >Also what are the chances of blocking a confirmation emails >for something >someone orders, etc And also Airlines > >Just feeling a little leery of using SURBL for a risk of false >positives. >Seems like a lot of newsletters outsource to companies that >could look like >spammers. > >I know it won't block and person to person email but can you >help me feel >more comfortable about SURBL ? > Greetings Paul, SURBL should block NONE of these. (Well we don't block anything, we flag, but you know what I mean.) We whitelist airlines. Confirmation emails would contina links to your own domain. You are not a spammer, are you? If you aren't, you won't get listed. If it is an order from to your company it is the same. You can always lower the score of SURBL and try it out if you are worried. But you will be VERY happy with it. 4 out of 5 Dentists approve of SURBL. But we don't count the fifth one, because his parents were cousins ;) Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

list of TLDs
by Daniel Quinlan 02 Dec '04

02 Dec '04

I got a long list of TLDs from John Levine, he made no promises about accuracy (quite the opposite), so I suspect there are some mistakes, but I yield it to you. Please let us know if any TLDs should be added to the SpamAssassin URIBL module, though. ;-)

4 3

using local cache?
by Ronan 02 Dec '04

02 Dec '04

hi i posted a mail similar to this on the spamassassin list but its more appropriate to this list... how do i check that my local multi.surbl.org bind file that i put into our DNS is the one being checked when doing SURIBLs lookups? Is there anyway to check who is checking DNS records? I do a spamassassin --lint -D and there is no mention of which DNS server its querying... any other hints?? ronan -- Regards Ronan McGlue ============== Analyst/Programmer Information Services Queens University Belfast BT7 1NN

1 0

RE: [SURBL-Discuss] FP: rgc3.net
by Chris Santerre 02 Dec '04

02 Dec '04

>-----Original Message----- >From: Rob McEwen (PowerView Systems) [mailto:rob@powerviewsystems.com] >Sent: Wednesday, December 01, 2004 2:19 PM >To: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] FP: rgc3.net > > >RE: rgc3.net > >After looking into this some more, I also found it in the >header of a legitimate OfficeDepot newsletter > 1) Its in the header, so don't worry. 2) Total scumbags! http://spews.org/html/S975.html 3) OfficeDepot should be notified. 4) I think this was discussed on Spam-L, that they were fooling legit companies. 5) You will see om-xxxxx.rgcx.net in many headers of spam. 6) If you need more, I'd ask the Spam-L guys. RSK could educate you ;) I believe Playboy actually used them until they found out they were scum. --Chris

3 2

RE: Image Composition Analysis
by Chris Santerre 02 Dec '04

02 Dec '04

Yeah this is a definite candidate for SURBL. This is the Huntsville-consulting spam gang: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL20528 353+ domains diretly linked. This is going to be the next trend. The final destination of this pron spam was throatstuffers . com, but it used a throw away domain of marlacell . com as a forwarder. Not directly either. That domain simply hosted a mirrored page of throatstuffers . com. We are seeing an increase in throw away domains being used to reroute to other domains that will NEVER show up directly in a spam. All in attempts to get passed SURBL. No biggy, the more pople that submit and manage SURBL the faster they get added. However there has been discussion on blocking the final destinations via web proxy's and host files. I think we will begin to see an increase in companies blocking these IPs or domains at the firewall or proxy server. Its actually helping some antispammers. We are able to tie more spammers together thru looking at who is trying to get passed SURBL thru throw away domains. Some of the small guys are only rogues of the bigger ones. We got people watching spammers six ways from Sunday. Funny how much they don't realise we know ;) --Chris >-----Original Message----- >From: Smart,Dan [mailto:SmartD@VMCMAIL.com] >Sent: Wednesday, December 01, 2004 4:57 PM >To: spamassassin-users(a)incubator.apache.org >Subject: RE: Image Composition Analysis > > >Attached is the spam that got through. I changed the porn URL to not >offend. It's a little mangled as it was forwarded by the user >via Outlook, >and tags got mangled by my Sanitizer. > >I capture the headers of all files, and here is what they look >like. The >bayes = 0 is what got this through. > ><<Dan>> > >======================================== >From filter Wed Nov 3 01:29:14 2004 >Return-Path: <Bebeskbs(a)kmanus.com> >Received: from great.amberalist.com (great.amberalist.com >[209.200.9.222]) > by dalton.vul.com (Vulcan E-mail Relay) with SMTP id 56BD89BB2C > for <xxxxxxx(a)vmcmail.com>; Wed, 3 Nov 2004 01:29:14 >-0600 (CST) >Received: from mail pickup service by kmanus.com with >Microsoft SMTPSVC; > Wed, 3 Nov 2004 14:17:54 -0800 >Received: from 194.3.74.35 by by7fd.bay7.kmanus.com with HTTP; > Wed, 3 Nov 2004 14:17:54 GMT >X-Originating-IP: [194.3.74.35] >X-Originating-Email: [Bebeskbs(a)kmanus.com] >X-Sender: Bebeskbs(a)kmanus.com >From: Bebe <Bebeskbs(a)kmanus.com> >To: XXXXX <XXXXXXX(a)vmcmail.com> >Subject: re: our appreciation >Date: 3 Nov 2004 14:17:54 -0500 >Mime-Version: 1.0 >Content-type: text/html >Message-ID: <SR0-81197F1166274AB5A8701DBB47173D6E(a)kmanus.com> >X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on >dalton.vul.com >X-Spam-DCC: : dalton 1182; Body=1 Fuz1=1 Fuz2=1 >X-Spam-AWL: Auto_Whitelist= >X-Spam-Status: No, hits=1.7 required=6.5 >tests=BAYES_00,CP_RANDOMWORD_10, > HTML_MESSAGE,MIME_HTML_NO_CHARSET,MIME_HTML_ONLY,OB_URI_RBL, > RCVD_IN_SBL,SARE_HTML_FSIZE_1ALL,WS_URI_RBL autolearn=no >version=2.64 >X-Spam-Level: * >Status: RO >X-Status: >X-Keywords: >X-UID: 1219 > >====================================== ><<Dan>> > > > > >> -----Original Message----- >> From: John Andersen [mailto:jsa@pen.homeip.net] >> Sent: Wednesday, December 01, 2004 2:45 AM >> To: spamassassin-users(a)incubator.apache.org >> Subject: Re: Image Composition Analysis >> >> On Tuesday 30 November 2004 01:27 pm, Smart,Dan wrote: >> >> > Catching image only E-mail with pornographic images is >> really difficult. >> > My users are offended when they get one, and wonder how I >> could not >> > catch it. Explaining that the document was text, filled >with bayes >> > poison, and the one porn image with no porn words in the document >> > doesn't seem to have much of an impression on them. >> >> Open the image with a text editor and challenge them to >> determine if it is spam or not. >> >> Really, people this dumb should not be turned loose on the internet. >> >> -- >> _____________________________________ >> John Andersen >> > >

3 2

FP: rgc3.net
by Rob McEwen (PowerView Systems) 01 Dec '04

01 Dec '04

Potential False Positive: If found the following in a header of an e-mail that was a legitimate Realtor.com/HomeStore newsletter: rgc3.net Examine e-mail here: http://www.pvsys.com/fp.txt (I know that SURBL is not suppose to be used to check headers... but this still raises a red flag that this domain would be found in such a legit newsletter) Thanks, Rob McEwen

2 1

Re: [SURBL-Discuss] FP: rgc3.net
by Rob McEwen (PowerView Systems) 01 Dec '04

01 Dec '04

RE: rgc3.net After looking into this some more, I also found it in the header of a legitimate OfficeDepot newsletter Rob McEwen

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss