- Discuss - Mailman 3

Perl/PHP Guru required,
by Alex Broens 23 Nov '04

23 Nov '04

Guys, Need someone to write a perl or php script to parse the ws zone and pipe the entries into a mysql DB. any takers? Pls contact me off list Thanks Alex PS: this is NOT for commercial use - would make my URI data submissions more reliable and easier to handle. // can't program to save my life but can handle amazon wishlists //

2 1

Suggestion for surbl-checker on rulesemporium
by Martin 23 Nov '04

23 Nov '04

Hi, I have a suggestion for the surbl-checker att rulesemporium.com. What do you think of adding a date when a certain link were added to the surbl list(s). My users report spam not catched in a public folder on our server, once a day i submit all reported spam to the surbl-checker to see if it's blocked or not. Most of the time the spam are blocked, but it would be nice if i could see a date/time when the link was blocked. :) Thanks in advance / Martin

2 2

ws updating again
by Jeff Chan 23 Nov '04

23 Nov '04

The problems with ws.surbl.org not updating for the past day or so have been corrected. It looks like there was a bug in the updated rsync or linux distro that Bill had installed on his server. When he reverted back to an earlier version, rsync started working correctly again. Jeff C. -- "If it appears in hams, then don't list it."

1 0

abusebutler data back
by Jeff Chan 23 Nov '04

23 Nov '04

The ab.surbl.org data was missing for a few days while Andy Warner moved his AbuseButler colo server, but it's back up again, and AB is live again. Jeff C. -- "If it appears in hams, then don't list it."

1 0

RE: [SURBL-Discuss] general questions.....
by Chris Santerre 23 Nov '04

23 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, November 19, 2004 5:38 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] general questions..... > > >On Thursday, November 18, 2004, 12:13:26 PM, Chris Santerre wrote: >> About 15% of the spams I get are not in SURBL, but are by >the time I try to >> add :) > >Ask Terry Sullivan sometime what the theoretical maximum >detection rate of a collective spam classification system might >be. He had some research showing it maxes out at around 85%. >So we're probably already pretty close to the theoretical >limits of this type of system. Me thinks I need to google for more data on this :) > >> I have not done any study of domains that continue to try to >spam despite >> being in SURBL. Any numbers on these? Possibly the >most/longest hit domain >> in SURBL lookups?? > >> SHould we post the top 25 lookups to SURBL? > >You mean like: > > http://www.surbl.org/dns-queries.blocklist.counts.txt > Perfect! This is what I mean, block port 80 (or all ports for that matter) for Hits Domain 1875 imgehost.com Hosted by Electric Lightwave, eli.net. Domain List matching dns_a of 67.50.118.130 48 total matches * 1: 123onlinecash.com * 2: 500fastcash.com * 3: absoluteroi.com * 4: americash-online.com * 5: azooimages.com * 6: camasterd.com * 7: cashadvancenow.com * 8: cashbackvalues.com * 9: cashbuzz.com * 10: cbvmasterd.com * 11: costamasterd.com * 12: cvcmasterd.com * 13: d1masterd.com * 14: dabogus.com * 15: directdepositcash.com * 16: efastcashloans.com * 17: egcmasterd.com * 18: epointmasterd.com * 19: equity1auto.com * 20: equityoneauto.com * 21: ezcash-online.com * 22: fast-funds-online.com * 23: fastcashandgas.com * 24: fastcashusa.com * 25: financialhosting.com * 26: hostimages.net * 27: imagedataserver.com * 28: imagesbyaz.com * 29: imgehost.com * 30: imgserver.net * 31: inamasterd.com * 32: lighteningcash.com * 33: mbcashmasterd.com * 34: mycash-online.com * 35: myonlinepayday.com * 36: oledirect.com * 37: oledirect2.com * 38: oneclickcash.com * 39: paydaycity.com * 40: pclmasterd.com * 41: ptymasterd.com * 42: sellingsource.com * 43: smartshopperonline.com * 44: steaksofstlouis.com * 45: tpmasterd.com * 46: webfastcash.com * 47: xenlog.com * 48: yourfastcash.com By blocking port 80 (or all) at the firewall for this IP address, you don't have to worry about them getting new domain names. Only the worst cases should be blocked. If you have 48 spam domains on one host, you suck as an ISP :) I seriously would like to hear the ISP's argument for being unblocked on this one. --Chris

3 4

Phishing attempt
by Mariano Absatz 23 Nov '04

23 Nov '04

Hi David et al. for some reason my Thunderbird severed the topmost headers (including trace headers) for this message (see bottom) I got this weekend. However, it seems to me it's a phishing attempt from 210.127.248.68... the page doesn't seem to be up, anyway. Checking in http://www.rulesemporium.com/cgi-bin/uribl.cgi the address only hit sc. Regards. -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com From: "SunTrust Access Review" <holdaccount0115nf93797(a)suntrust.com> To: <baby(a)baby.com.ar> Subject: Banking Online Message IDXXX003014585815 Date: Fri, 19 Nov 2004 02:12:23 +0300 MIME-Version: 1.0 Content-Type: text/html; Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal <html> <head> <title>SunTrust Account Access</title> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"> </head> <body bgcolor=3D"#FFFFFF" text=3D"#000000"> <table width=3D"940" border=3D"0" cellpadding=3D"0" cellspacing=3D"0"> <tr> <td colspan=3D"2" height=3D"66" valign=3D"top"><img src=3D"http://www.r= ogueweb.com/logo_home.gif" width=3D"171" height=3D"66"></td> <td width=3D"562"></td> <td width=3D"107"></td> </tr> <tr> <td height=3D"9" width=3D"26"></td> <td width=3D"245"></td> <td></td> <td></td> </tr> <tr> <td height=3D"176"></td> <td colspan=3D"2" valign=3D"top"> <p>Dear <b>Valued Customer,</b></p> <p> SunTrust Banks Inc., is committed to maintaining a safe environme= nt for our customers. To protect the security of your account, SunTrus= t Banks Inc., employs some of the most advanced security systems in the wor= ld and our anti-fraud teams regularly screen the SunTrust system for u= nusual activity.</p> <p>We are contacting you to remind you that on Nov. 17, 2004 our Acco= unt Review Team identified some unusual activity in your account. In ac= cordance with SunTrust's User Agreement and to ensure that your account has = not been compromised, access to your account was limited. Your account = access will remain limited until this issue has been resolved.</p> <p>We encourage you to log in and perform the steps necessary to rest= ore your account access as soon as possible. Allowing your account acce= ss to remain limited for an extended period of time may result in furt= her limitations on the use of your account and possible account closure= . Click here to unlock your <a href=3D"http://210.127.248.68/personal/check= ing/OnlineBanking/Internet_Banking/index.php">online access.</a></p> </td> <td></td> </tr> <tr> <td height=3D"26"></td> <td></td> <td></td> <td></td> </tr> <tr> <td height=3D"95"></td> <td colspan=3D"2" valign=3D"top"> Thank you for your prompt attention t= o this matter. Please understand that this is a security measure meant to he= lp protect you and your account. We apologize for any inconvenience. <p>Sincerely,<br> Suntrust Banks Inc., Account Review Department</p> </td> <td></td> </tr> <tr> <td height=3D"18"></td> <td></td> <td></td> <td></td> </tr> </table> </body> </html>

2 1

RE: [SURBL-Discuss] general questions.....
by Chris Santerre 22 Nov '04

22 Nov '04

>-----Original Message----- >From: David B Funk [mailto:dbfunk@engineering.uiowa.edu] >Sent: Saturday, November 20, 2004 12:31 AM >To: surbl(a)alexb.ch; SURBL Discussion list >Subject: Re: [SURBL-Discuss] general questions..... > > >On Thu, 18 Nov 2004, Alex Broens wrote: > >> Rob McEwen (PowerView Systems) wrote: >> >>Have any of you seen fewer spams? I don't see many these days. >> > >> > >> > Chris, >> > >> > Overall, I'm getting less and less spam. I think that >SURBL is getting better, some graymarketers are cleaning up >their acts, and my rules-based filering is also improving. >> > >> > However, a few days ago, I started getting slammed with >mortgage spam using the following domains: >> > >> > dalehaym.biz >> >> This I sent to SURBL on 2004-11-16 09:11:10 GMT +1 >> Why it never made it to the list is above me. >> >> Alex > >I think that something is wrong with the WS-surbl feed. >None of the entries that I've submitted in the past few days >have shown up in the ws.surbl list, usually they're posted >in less than an hour. > Actually thre is still a slight problem. One of the contributors on the submission list is swamped with work, and away from keyboard. We are having some technical issues removing him from the submission list. So he got a bunch that never got added. He forwarded them to me today. I will go thru. We are hoping to fix the problem soon. --Chris

1 0

general questions.....
by Chris Santerre 21 Nov '04

21 Nov '04

Have any of you seen fewer spams? I don't see many these days. About 15% of the spams I get are not in SURBL, but are by the time I try to add :) I have not done any study of domains that continue to try to spam despite being in SURBL. Any numbers on these? Possibly the most/longest hit domain in SURBL lookups?? SHould we post the top 25 lookups to SURBL? This way people can look at maybe denying these by IP at firewall? --Chris (I am an anal-retentive and highly-clueful well-motivated maniac.) ;)

6 6

Re: [SURBL-Discuss] general questions.....
by Rob McEwen (PowerView Systems) 20 Nov '04

20 Nov '04

> Have any of you seen fewer spams? I don't see many these days. Chris, Overall, I'm getting less and less spam. I think that SURBL is getting better, some graymarketers are cleaning up their acts, and my rules-based filering is also improving. However, a few days ago, I started getting slammed with mortgage spam using the following domains: dalehaym.biz dalehay.biz daleqhay.biz damphenm.biz darbherm.biz darbhero.biz darbkher.biz rbkher.biz (& others) An example spam is found here: http://www.pvsys.com/recentspamsample.txt In this example, the domain is: darbherm.biz ...but darbherm.biz doesn't resolve to anything. However, usa.darbherm.biz DOES resolve. (Of course, you have to go to the actual URL to get to a substantive page... see actual e-mail). (1) Could the fact that the baseline domain doesn't resolve have tricked us into thinking that these were no longer active? (2) Also, in a not-quite-applicable but related thought, should we rethink the policies for removing "dead" domains out of SURBL if they STILL appear in spams. For example, suppose a virus sends out the same spam for a now defunct domain over and over again... shouldn't such a domain STILL be listed in SURBL? Finally, maybe these particular domains I listed at the top of this message are not in SURBL because of having legit uses? But I must say that this particular "series" of spam came all of a sudden and ferociously frequent. For example, a couple of my clients would be getting at least a couple of dozen of these SAME e-mails **per day** if I hadn't adjusted my rules based filter to screen these out. Clearly, this kind of behavior where the spam is sent repeatedly each day is NOT playing by the rules. Rob McEwen

4 3

RE: [SURBL-Discuss] general questions.....
by Chris Santerre 19 Nov '04

19 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, November 19, 2004 9:50 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] general questions..... > > >On Friday, November 19, 2004, 6:39:31 AM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>> I have not done any study of domains that continue to try to >>>spam despite >>>> being in SURBL. Any numbers on these? Possibly the >>>most/longest hit domain >>>> in SURBL lookups?? >>> >>>> SHould we post the top 25 lookups to SURBL? >>> >>>You mean like: >>> >>> http://www.surbl.org/dns-queries.blocklist.counts.txt >>> > >> Perfect! This is what I mean, block port 80 (or all ports >for that matter) >> for > >> Hits Domain >> 1875 imgehost.com > >> Hosted by Electric Lightwave, eli.net. > >> Domain List matching dns_a of 67.50.118.130 >> 48 total matches > >> * 1: 123onlinecash.com >> * 2: 500fastcash.com >[...] > >Uh, but that won't block the spam.... > This one is a reply to Rob as well. No, I'm thinking outside our 'norm'. This is not the sending IP. This is the hosting IP. You are correct in saying this will not stop spam coming. Unless SA starts to tag by looking up the IP of the URL. Which a certain ninja has been working on ;) This will stop any ads from showing up in the spam. This will allow others to black this so there users don't click on the junk being spamed. This will also say to ISPs, "Clean up your act, or no one will pay to be hosted by you anymore!". Its more an offensive strike against spam, rather then always being defensive. --Chris

1 0

RE: [SURBL-Discuss] general questions.....
by Chris Santerre 19 Nov '04

19 Nov '04

Oh....I meant deny port 80. Not MX. Sorry. --Chris >-----Original Message----- >From: Rob McEwen (PowerView Systems) [mailto:rob@powerviewsystems.com] >Sent: Thursday, November 18, 2004 3:27 PM >To: SURBL Discussion list >Subject: RE: [SURBL-Discuss] general questions..... > >maybe denying these by IP at firewall? Also, the IP address of the sending server is NOT necessarily the IP address of the NameServer the domain is assigned to. (Or maybe I'm misunderstanding you altogether) Also... I don't mean to be so negative... certainly, this is the kind of brainstorming that leads to great ideas. I'm just double-checking your ideas :) Rob McEwen _______________

1 0

RE: [SURBL-Discuss] general questions.....
by Rob McEwen (PowerView Systems) 19 Nov '04

19 Nov '04

> Hits Domain > 1875 imgehost.com > Hosted by Electric Lightwave, eli.net. > Domain List matching dns_a of > 48 total matches Chris, Just to help me understand you better, is the actual **sending server** for these particular spams always (or even mostly) "67.50.118.130" when looking at "real world" data? The reason that I ask is because the sending server is not necessarily the same server/IP as the IP address that the domain name itself resolves to. This is important because the sending server's IP is what gets checked with regular RBL blocking. Rob McEwen

1 0

RE: [SURBL-Discuss] general questions.....
by Chris Santerre 19 Nov '04

19 Nov '04

> >SHould we post the top 25 lookups to SURBL? This way people can look at >maybe denying these by IP at firewall? > >--Chris >(I am an anal-retentive and highly-clueful well-motivated maniac.) ;) AN example to my own question: 63.251.163.112 Domain List matching dns_a of 63.251.163.112 308 total matches * 1: 01890.com * 2: 07078.com * 3: 1by.net * 4: 1dq.com * 5: 2000greatings.com * 6: 247ezmoney.com * 7: 24host-2.net * 8: 24newsengine.com * 9: 2night.us * 10: 2us.org * 11: 4hermail.com * 12: 4omni.com * 13: 4usamail.com * 14: 4yourmarriage.net * 15: 4yournextbiz.com * 16: 820.com * 17: a-pinups.com * 18: aaafes.com * 19: aaazzz.com * 20: abstractionists.com * 21: accesstosuccess.biz * 22: aclama.com * 23: acrosage.com * 24: acsalaksa.net * 25: activefactory.com * 26: actnownames.com * 27: acution.com * 28: addlebrain.com * 29: adultcompanion.com * 30: adultsite.com * 31: adulttryouts.com * 32: advanced-web.com * 33: affiliatewithus.com * 34: affordable-mortgages.com * 35: agoramail.com * 36: albuquerquedental.com * 37: algonquin.info * 38: allamar.com * 39: allamericancontracting.com * 40: allgameradio.com * 41: americenter.com * 42: ammoniac.com * 43: anaheimrealestateagent.com * 44: analssex.com * 45: angelpixiedust.com * 46: anglicanmail.com * 47: apchetes.com * 48: apenis.com * 49: appian.org * 50: apps21.com * 51: argentina-w3.com * 52: artcanjam.com * 53: asafir.com * 54: asatru.net * 55: aspert.com * 56: athomemoviebiz.net * 57: atlanta-grind.com * 58: atlnatic.net * 59: attcanda.net * 60: attglobel.net * 61: avchinaweb.com * 62: awesomebusiness.com * 63: b-max.com * 64: b2bnow.com * 65: babes4fre.com * 66: babulka.com * 67: bajajtempo.com * 68: ballercons.com * 69: bang4yourbuck.info * 70: barbaralebeau.com * 71: baretits.com * 72: beauty-rich.com * 73: best-lolita.com * 74: best-sources.com * 75: bestdentalplan.biz * 76: bestialityonline.com * 77: bestlifehealth.com * 78: bestwebdeals.org * 79: better-life.net * 80: bettiepaige.com * 81: bidnpay.com * 82: bidnwear.com * 83: big-booty-hoes.com * 84: big-marketing.com * 85: bigcheet.com * 86: bignm.com * 87: bigxxxlist.com * 88: binddatetv.com * 89: biovalidity.com * 90: bizcoach.net * 91: bizmaker.net * 92: blastmyeresume.com * 93: blucatrell.com * 94: bob999.com * 95: boobsscan.com * 96: boostmycredit.com * 97: brazilianflipflops.com * 98: brazillianbabes.com * 99: burkina98.com * 100: burleighenterprises.com * 101: burlesque.com * 102: buy-angel.com * 103: buysoftware.com * 104: cabelspeed.net * 105: cahir.com * 106: california-mortgage.net * 107: callrewards.com * 108: candidvoyeurs.com * 109: candlesmart.com * 110: casaemcampos.com * 111: casinoemporium.com * 112: cassiya.com * 113: castlemontains.com * 114: cdiweb.us * 115: celebretyjustice.com * 116: cellulartoday.com * 117: chao-shuang.com * 118: chasebenefits.com * 119: checkthisoutnow.com * 120: china-a2z.com * 121: china-hk-trade.com * 122: china1888.com * 123: chortle.org * 124: cigarette.net * 125: cilinedion.com * 126: cilpart.com * 127: city-of-coventry.com * 128: cj1.net * 129: classreuions.com * 130: clickfm.com * 131: climatecast.com * 132: clubbuckscard.com * 133: clubclayshooting.com * 134: clubteam.net * 135: cluj.com * 136: cmargolis.com * 137: coconut-wireless.com * 138: cojeco.net * 139: colegenet.com * 140: comccast.net * 141: comovender.com * 142: compactscales.com * 143: concensuswins.com * 144: coolgal.net * 145: couple-sex.com * 146: coxrr.com * 147: credit-fix.net * 148: credtcards.com * 149: crimsonweb.com * 150: crowberry.com * 151: cumsuckingbabe.com * 152: cyber411.com * 153: cybervoyeurcam.com * 154: dailyleads.info * 155: dailyleads.net * 156: dalkey.net * 157: dalmiamail.com * 158: dashboardcofessional.com * 159: dcsone.com * 160: dcwebpages.com * 161: debtreliefnow.org * 162: decorativeflags.net * 163: delcid.com * 164: dens.org * 165: desktopdeals.com * 166: dickmysuck.com * 167: dimondrio.com * 168: dircetv.com * 169: directbyemail.com * 170: dirtymaturewoman.com * 171: discountednames.com * 172: divepro.net * 173: dixney.com * 174: domainmania.org * 175: domainnameoffer.com * 176: domainsrealm.co.uk * 177: dominio.com * 178: dotcomproducts.net * 179: doubletwist.com * 180: downblose.com * 181: downbluse.com * 182: drippingfacials.com * 183: droa.com * 184: droamerica.com * 185: droc.ca * 186: droe.com * 187: dromoland.com * 188: drugsmakemecool.com * 189: durasex.com * 190: dvdmoviebiz.net * 191: dzennet.com * 192: e-cology.net * 193: e0451.com * 194: electricpenis.com * 195: elektrictechnologies.com * 196: emailaccont.com * 197: emailoffersdirect.com * 198: finalfantisy8.com * 199: financialfreedom4life.com * 200: free-help.com * 201: freeepussy.com * 202: ftspower.com * 203: gamespotmail.com * 204: gotonude.com * 205: grandevictorian.com * 206: hostcom.com * 207: hostcompany.net * 208: hostconsultants.com * 209: hottent.com * 210: ihorizon.net * 211: indyrr.com * 212: inetbooks.net * 213: jaihindmail.com * 214: johnmelloncamp.com * 215: justdoit4u.com * 216: kandela.ws * 217: latetiacasta.com * 218: listcontrol.com * 219: littlebohemia.org * 220: lochranza.net * 221: lovedabutt.com * 222: lovego.com.tw * 223: mecanik.com * 224: meronina.info * 225: mhnllc.com * 226: mikemcconnaughey.com * 227: modonnamusic.com * 228: money-21.com * 229: mortgage-and-loan.com * 230: mybritehouse.net * 231: naughtywomen.com * 232: netbillions.com * 233: netforum.com * 234: neverever91.biz * 235: nochargehosting.com * 236: nocostslendersolution.com * 237: ntfaf.org * 238: nude.com * 239: oblivion-zine.com * 240: ohh-my-rx.us * 241: ohiooffice.com * 242: oilskinhats.com * 243: omei-cn.com * 244: on-us4u.info * 245: one-sixseven-a-day.com * 246: oneworldmail.com * 247: onlinesingles.net * 248: ooar.net * 249: oopt.com * 250: opet-onener.us * 251: orderpills.org * 252: orgia.com * 253: osot-hect.info * 254: pacbelle.net * 255: pahcetes.com * 256: partionmagic.com * 257: pcdataonline.com * 258: pcexplorer.com * 259: pearson-music.com * 260: penetrationmarketing.com * 261: phidelio.biz * 262: philshopping.com * 263: phoneahottie.com * 264: phoneme2.net * 265: photoworks.biz * 266: phpad.com * 267: pianoplayerplus.com * 268: poker-runs.com * 269: pollinate.net * 270: polllstar.com * 271: pornogirls.com * 272: pornsitepreview.com * 273: potash.org * 274: powerfan.com * 275: powerfulporn.com * 276: powerpromo.com * 277: powerupnetwork.com * 278: premiumdeal.com * 279: prescriptiondoc.com * 280: priceqoutes.com * 281: probedbyaliens.com * 282: proname.com * 283: puntocom.com * 284: pwcglobel.com * 285: registrationgroup.com * 286: respond1.biz * 287: rx4you.biz * 288: sagadreamcast.com * 289: sgg.com * 290: soft777.com * 291: sourcesbest.net * 292: sprint-canda.com * 293: starsearh.com * 294: sunnytown.org * 295: tamapbayrr.com * 296: theperfectsafelist.com * 297: timemagazin.com * 298: travelprofits.net * 299: trecomnet.com * 300: villigevoice.com * 301: votewithamerica.com * 302: webcamchicks.com * 303: wehostforyou.com * 304: worldxn.com * 305: wowzers.net * 306: www.actnownames.com * 307: www.dsouzamail.com * 308: www.hostm.net Should be blocked at firewall so nothing ever comes from these POS, IMHO. --Chris

3 2

SC manual blacklist pruned
by Jeff Chan 19 Nov '04

19 Nov '04

We have a manual blacklist for the SC list that I use to nudge records without enough hits onto SC (sooner than they otherwise would): http://spamcheck.freeapp.net/blacklist-domains I've pruned that list, removing domain names that have had no NS records for three successive checks over about five weeks. That has reduced the manual blacklist list by about 270 records. Before removing those I checked to see how many DNS hits they were getting and only notinuse.biz had any of significance, so we kept that one on the manual blacklist. SC will probably be manually pruned again some time in future, but the list (both automatic and manual) is so small and effective to begin with that it tends not to need to much manual maintenance. Note that cleaning up the manual blacklist is not the same as whitelisting. Any record that comes off the manual blacklist can be manually or automatically blacklisted again in future at any time if it appears in spams again. So it's not at all a "free pass" to spammers or anything like that. It just means some domains that are unusable and don't appear in any recent spams are no longer included on SC for now. If they get used again, they'll get listed again. I still plan to re-write the SC-specific engine and the general data engine used for processing the SURBL data. The main features will be more uniform processing of the data, including public logs of additions, deletions, whitelists, etc. Aside from SC, the results should be identical, and I will run them in parallel for a while to make sure that's the case. The SC data will be handle more efficiently and probably have an resolved-IP-based biasing system to get the domains of persistent spammers onto SC sooner, automatically. Cheers, Jeff C. -- "If it appears in hams, then don't list it."

2 2

RE: [SURBL-Discuss] general questions.....
by Chris Santerre 19 Nov '04

19 Nov '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Thursday, November 18, 2004 4:23 PM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] general questions..... > > >on Thu, Nov 18, 2004 at 03:29:14PM -0500, Chris Santerre wrote: >> >> > >> >SHould we post the top 25 lookups to SURBL? This way people >can look at >> >maybe denying these by IP at firewall? >> > >> >--Chris >> >(I am an anal-retentive and highly-clueful well-motivated >maniac.) ;) >> >> AN example to my own question: >> 63.251.163.112 > >Erm, that's in eNom space. FYI. It's a default "hosted by eNom" IP. > and? :) -Chris

2 1

Re: [SURBL-Discuss] general questions.....
by Joe Zitnik 18 Nov '04

18 Nov '04

Not us. THings are holding pretty steady. Two days 43,000 e-mails, 32,000 spam (Each rounded up about a hundred). That's about par for the course for us. >>> Lindsay Snider <lindsay(a)pa.net> 11/18/2004 5:08:55 PM >>> On Thursday 18 November 2004 03:13 pm, Chris Santerre wrote: > Have any of you seen fewer spams? I don't see many these days. Our graphs show the rates decreasing. http://user.pa.net/~lindsay/year_block.png I'm not sure what other factors could be causing the graphs to tend downward but I do know the mail volume has increased and the code rbl/block code has not changed. > > About 15% of the spams I get are not in SURBL, but are by the time I try to > add :) > > I have not done any study of domains that continue to try to spam despite > being in SURBL. Any numbers on these? Possibly the most/longest hit domain > in SURBL lookups?? I also haven't done a study recently but I could contribute data for analysis if we wanted to study any of it. -Lindsay _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

Re: [SURBL-Discuss] need help on this one
by Patrik Nilsson 18 Nov '04

18 Nov '04

At 15:45 2004-11-18 -0500, Chris Santerre wrote: >Looks like an obvious spam reported. Yet NO NANAS reports and domain from >Dec 2001. Linkagents.com is connected to same domain, so no zombie there. > >agentleads.com > >I'm leaning towards adding. I'm thinking someone purchased the old domain. Both linkagents.com and agentleads.com are registered to Whitehouse.com Inc. Dan "whitehouse.com" Parasi announced he was changed his focus from adult porn to real-estate earlier this year, and that he was selling Whitehouse.com Inc and the 100s of domains in it's possession. So... either he found a buyer, or this is Dan himself, promoting his real-estated business. Either way, I'd say 100% spam. Patrik

1 0

need help on this one
by Chris Santerre 18 Nov '04

18 Nov '04

Looks like an obvious spam reported. Yet NO NANAS reports and domain from Dec 2001. Linkagents.com is connected to same domain, so no zombie there. agentleads.com I'm leaning towards adding. I'm thinking someone purchased the old domain. Return-Path: <bounce-21069-1965066(a)news.linkagents.com> Received: from news.linkagents.com (news.linkagents.com [209.67.37.178]) by realtyroad.com (8.11.6/8.11.6) with SMTP id iAIAklS11000 for <gene(a)MUNGED.com>; Thu, 18 Nov 2004 02:46:47 -0800 From: "Agentleads.com" <news(a)linkagents.com> To: gene(a)MUNGED.com Subject: AgentLeads.com-Get your territory today. Date: Thu, 18 Nov 2004 04:59:00 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="MIMEBoundaryddd2bf1db18a281dfbd9e80b4d160393" List-Unsubscribe: <mailto:leave-glagentsnoname-1965066E@news.linkagents.com> Message-Id: <LYRIS-1965066-21069-2004.11.18-05.00.01--gene#MUNGED.com(a)news.linkagents.co m> X-MailScanner-Information: Please contact the ISP for more information X-MailScanner: Found to be clean X-MailScanner-SpamCheck: not spam, SpamAssassin (score=4.869, required 6.5, AWL -0.51, BAYES_99 3.51, HTML_50_60 0.09, HTML_MESSAGE 0.00, HTML_NONELEMENT_00_10 0.00, HTML_TAG_EXIST_TBODY 0.11, SARE_HTML_HTML_TBL 1.67) X-MailScanner-SpamScore: 4 X-MailScanner-From: bounce-21069-1965066(a)news.linkagents.com This is a multi-part message in MIME format. --MIMEBoundaryddd2bf1db18a281dfbd9e80b4d160393 Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: 8bit Dear Agent: Agentleads.com buys advertising from Yahoo, MSN, Google and over 100 other high traffic sites on the Internet. Find more buyers. It's easy with Agentleads.com. Agentleads.com offers the following advantages Total Cost Efficiency: Pay ONLY for your leads. There are no other costs. Unlike other types of direct advertising, there are no unknowns. Your cost per lead is always consistent. Qualified Leads: Agentleads.com leads come directly from individuals who indicate a near-term desire to find an agent for their transaction. Unsurpassed Control: You control the number of leads they receive and the areas where the leads originate. You can increase or decrease the size of your territory and pause, activate or cancel your account immediately, at any time. Simple To Join: Just sign up and you will start receiving leads. Join our network before all territories are gone. We hope to increase your business soon! For more information visit Agentleads.com or gene(a)erachampion.com Go to Agentleads.com to Join with no signup cost below at http://secure.agentleads.com/agent/agent_signup/ To unsubscribe from future emails from Agentleads.com, click below. http://news.linkagents.com/u?id=1965066E&n=T&l=glagentsnoname Agentleads.com 295 Greenwich Street Suite 184, New York, New York 10007 Agentleads.com, Inc. is a division of House.com Inc. a Licensed Real Estate Broker --MIMEBoundaryddd2bf1db18a281dfbd9e80b4d160393 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 8bit <html> <TABLE cellSpacing=5 cellPadding=0 width=500 border=0> <TBODY> <TR> <TD><SPAN class=copy>Dear Agent: </FONT></SPAN> <P class=copy><a href="http://secure.agentleads.com/agent/agent_signup/" target="new">Agentleads.com</a> is proud to introduce its new service to agents. Agentleads.com offers the following advantages:</FONT></P> <UL> <LI class=copy><SPAN class=copybold>Total Cost Efficiency:</SPAN><BR>Pay ONLY for your leads. There are no other costs. Unlike other types of direct advertising, there are no unknowns. Your cost per lead is always consistent. <LI class=copy><SPAN class=copybold>Qualified Leads:</SPAN><BR><a href="http://secure.agentleads.com/agent/agent_signup/" target="new">Agentleads.com</a> leads come directly from individuals who indicate a near-term desire to find an agent for their transaction. </FONT></FONT> <LI class=copy><SPAN class=copybold>Unsurpassed Control:</SPAN><BR>You control the number of leads they receive and the areas where the leads originate. You can increase or decrease the size of your territory and pause, activate or cancel your account immediately, at any time. <LI class=copy><SPAN class=copybold>Simple To Join:</SPAN><BR>Just sign up and you will start receiving leads.</FONT></FONT> </LI></UL> <P class=copy><a href="http://secure.house.com/agent/agent_signup/" target="new">Click Here</a> to learn more about <A target="_blank" to learn more about <a href="http://secure.agentleads.com/agent/agent_signup/" target="new">Agentleads.com</a> and join our network before all territories are gone. We hope to increase your business soon!</P> <P class=copy>Sincerely,</FONT></P>Agentleads.com Inc.<br> <a href="http://secure.house.com/agent/agent_signup/" target="new"></FONT></P></P></TD></TR></TBODY></TABLE></FONT></td></tr><a href="http://news.linkagents.com/u?id=1965066E&n=T&l=glagentsnoname">unsubsc ribe</a> Agentleads.com, Inc. 295 Greenwich Street Suite 184, New York, New York 10007 Agentleads.com, Inc. is a division of House.com Inc. Licensed Real Estate Broker.</span></div></tr></table> </table><img src="MailScannerWebBug" width="1" height="1" alt="Web Bug from http://news.linkagents.com/db/21069/1965066/1.gif" /></HTML> </td></tr> </table> --MIMEBoundaryddd2bf1db18a281dfbd9e80b4d160393-- ---------------------------------------- Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

RE: [SURBL-Discuss] general questions.....
by Rob McEwen (PowerView Systems) 18 Nov '04

18 Nov '04

>maybe denying these by IP at firewall? Also, the IP address of the sending server is NOT necessarily the IP address of the NameServer the domain is assigned to. (Or maybe I'm misunderstanding you altogether) Also... I don't mean to be so negative... certainly, this is the kind of brainstorming that leads to great ideas. I'm just double-checking your ideas :) Rob McEwen

1 0

RE: [SURBL-Discuss] general questions.....
by Rob McEwen (PowerView Systems) 18 Nov '04

18 Nov '04

> AN example to my own question: > 63.251.163.112 Chris: (1) Why then is this IP address NOT listed in either SpamHaus (all lists) and NOT listed in dsbl.org? Is there **ANOTHER** RBL list which WOULD include this IP, but WITHOUT the kind of FPs that you get with many RBLs. (2) Could **other** legitimate mail be coming from that IP address. Certainly, such mail **deserves** to get blocked because of the "company it keeps"... but try explaining that to a client. Basically IP blocking is very drastic. Going from SURBL blocking to IP blocking is like using a sledgehammer rather than a surgeon's scalpel. I'm not against this approach. But consider that not everyone used SpamAssassin. Some programs can't automatically check the nameserver's IP against RBLs, etc. Also, I strongly recommend not taking these out of SURBL. Certainly, it would be good to encourage people to block in ways that save processing time and lookups where needed. But don't use that as an excuse to remove these because not everyone will be know to do this type of blocking and removing these from SURBL will give them a pass. (not to mention, what happens if the domain name stays the same, but switches hosting providers?) Rob McEwen

1 0

Astaro will release new version with builtin SA 3.01 and SURBL-support!
by Martin 18 Nov '04

18 Nov '04

Read the announcement here: http://www.astaro.org/showflat.php?Cat=&Number=52033&page=0&view=collapsed&… This is way cool! / Martin

1 0

Possible SURBL DNS poisoning attempt
by Doc Schneider 18 Nov '04

18 Nov '04

Nov 18 03:01:13 dns named[22511]: denied recursion for query from [24.14.194.168].137 for TRESPASSERS IN Nov 18 03:01:15 dns named[22511]: denied recursion for query from [24.14.194.168].137 for TRESPASSERS IN Just a headsup. I'm seeing these in my name server logs... obviously it isn't working on my server. Meaning this (comcast) virused machine is trying to (appears to be) injecting some type of data into my named (bind) server. Also am still getting a whole whale of surbl queries to the wrong IP/DNS server here. In other words servers are trying to get surbl returns from my bind server and not my rbldnsd server. -Doc

1 0

SURBL bomb
by Matthew Wilson 18 Nov '04

18 Nov '04

SURBL list, Has anyone seen any emails with hundreds of URIs - meant to overload filtering servers and the SURBL DNS servers, not poison them...? Matthew Wilson, MCSE (2003), MCSA-Messaging Network Administrator matthew(a)boomer.com Boomer Consulting, Inc. 610 Humboldt Manhattan, KS 66502 http://www.boomer.com 1-888-266-6375 x 17

6 7

Possible warning to users. Santa phish.
by Chris Santerre 16 Nov '04

16 Nov '04

I just got a spam that hit 2 SURBL domains. Advert for "Send your kids an email from santa!" How nice of spammers to not only tkae your $10, but harvest your children's email account and name as well. I'll be drafting up a warning to my users shortly. Others may want to do the same. Spread the love :) Content preview: Commercial Announcement ======================================= Get a Letter From Santa! Go here to get started: http://kelepouri113.com/ssnbpsq.php?oioWAHTwnlp94ooMSG_bcfchahj.3284859ioWAH Twnlp94oo22SJWMerchantsOverseas.comioWAHTwnlp94oo1027163931&f=493&i=1908 [...] Content analysis details: (5.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_HELO_PASS SPF: HELO matches SPF record 0.7 EXCUSE_6 BODY: Claims you can be removed from the list 0.8 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 0.2 HTML_90_100 BODY: Message is 90% to 100% HTML 0.6 MY_ALT RAW: Empty ALT uri 0.5 MY_NO_QU RAW: Q without a U 0.4 MY_OBFU_LONG RAW: One long word! 2.0 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: kelepouri113.com equalispecialvecto.com] --Chris (Santa don't need this crap right now!)

1 0

RE: [SURBL-Discuss] Should we list ratware?
by Chris Santerre 16 Nov '04

16 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, November 15, 2004 10:06 PM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] Should we list ratware? > > >On Monday, November 15, 2004, 8:13:18 AM, Chris Santerre wrote: >> MailinglistMaster.com > >Q: "Should we list ratware?" > >A: Only if the domain appears exclusively in spams. > A2: Or if the domain is responsible for one of the major tools for delivering spams. I sure the heck don't want anyone in my company getting an email with a link to their site. I'm guessing ISPs and colleges would feel the same. --Chris

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss