- Discuss - Mailman 3

SURBL bomb
by Matthew Wilson 18 Nov '04

18 Nov '04

SURBL list, Has anyone seen any emails with hundreds of URIs - meant to overload filtering servers and the SURBL DNS servers, not poison them...? Matthew Wilson, MCSE (2003), MCSA-Messaging Network Administrator matthew(a)boomer.com Boomer Consulting, Inc. 610 Humboldt Manhattan, KS 66502 http://www.boomer.com 1-888-266-6375 x 17

6 7

Possible warning to users. Santa phish.
by Chris Santerre 16 Nov '04

16 Nov '04

I just got a spam that hit 2 SURBL domains. Advert for "Send your kids an email from santa!" How nice of spammers to not only tkae your $10, but harvest your children's email account and name as well. I'll be drafting up a warning to my users shortly. Others may want to do the same. Spread the love :) Content preview: Commercial Announcement ======================================= Get a Letter From Santa! Go here to get started: http://kelepouri113.com/ssnbpsq.php?oioWAHTwnlp94ooMSG_bcfchahj.3284859ioWAH Twnlp94oo22SJWMerchantsOverseas.comioWAHTwnlp94oo1027163931&f=493&i=1908 [...] Content analysis details: (5.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_HELO_PASS SPF: HELO matches SPF record 0.7 EXCUSE_6 BODY: Claims you can be removed from the list 0.8 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 0.2 HTML_90_100 BODY: Message is 90% to 100% HTML 0.6 MY_ALT RAW: Empty ALT uri 0.5 MY_NO_QU RAW: Q without a U 0.4 MY_OBFU_LONG RAW: One long word! 2.0 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: kelepouri113.com equalispecialvecto.com] --Chris (Santa don't need this crap right now!)

1 0

RE: [SURBL-Discuss] Should we list ratware?
by Chris Santerre 16 Nov '04

16 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, November 15, 2004 10:06 PM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] Should we list ratware? > > >On Monday, November 15, 2004, 8:13:18 AM, Chris Santerre wrote: >> MailinglistMaster.com > >Q: "Should we list ratware?" > >A: Only if the domain appears exclusively in spams. > A2: Or if the domain is responsible for one of the major tools for delivering spams. I sure the heck don't want anyone in my company getting an email with a link to their site. I'm guessing ISPs and colleges would feel the same. --Chris

1 0

RE: [SURBL-Discuss] FW: SURBL+ Checker Submission
by Chris Santerre 16 Nov '04

16 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, November 15, 2004 10:33 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] FW: SURBL+ Checker Submission > > >On Monday, November 15, 2004, 3:54:18 PM, David Funk wrote: >> On Mon, 15 Nov 2004, Chris Santerre wrote: > >>> Both domains in this submission are Whitelisted. Let me guess..... >>> >>> sina.com and 6to23.com appear in ham :/ >>> >>> --Chris > >> Not to dissapoint you Chris but sina.com is the Chinese equivalent >> of yahoo/geocities, big ISP (webmail, hosting, etc). >> Clearly whitelisting material. > >Yes, sina.com one of the globally most visited web sites according >to Alexa: > > http://www.alexa.com/site/ds/top_sites?ts_mode=global&lang=none > >6to23.com is also on the Alexa Global 500. > >Both have legitimate uses, so we don't list them. > LOL....Show offs! ;) I didn't know Dave could read Chinese :-) Well then they better clean up their act now, just like yahoo :/ --Chris

1 0

RE: [SURBL-Discuss] domain check dealsforrecruiters.net
by Chris Santerre 16 Nov '04

16 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, November 15, 2004 11:59 PM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] domain check dealsforrecruiters.net > > >On Monday, November 15, 2004, 12:47:43 PM, Chris Santerre wrote: >> I've got numerous reports on these guys. But I can't make up >my mind. But I >> have at least 6 spammy looking submitted mails. > >> so anyone got an opinion on dealsforrecruiters.net? > >FWIW It shows up on no RBLs. > >The real question is whether it has legitimate uses. Can >we tell from their web site? Their web site seems to offer >"Targeted-mail marketing" and it also seems to have a >subscription form. I did not try the subscription but >if it's open, perhaps vigilantes are signing up anti-spam >addresses to try to get these guys listed? If so that >would be highly annoying and a counterproductive waste of >our time, and I wish they would stop. > Agreed. I'm putting them on my watch closely list. They will go unlisted.....for now. --Chris

1 0

Keep getting this spam, not listed in multi.
by Martin 16 Nov '04

16 Nov '04

Hi, I've keep getting the same spam every now and then. I think i have reported this spam atleast 4 times on the submission form at rulesemporium.com. How come it won't be listed? The domain in the spam is http://www.pinksheetsMUNGED.com and the spam is about stocks. I get this spam reported almost every day from different users in our organization. This is 100% spam! When will this be added to multi? I can send the message in original if you want, just let me know. Thank you / Martin

3 5

RE: [SURBL-Discuss] Re: [SURBL-Announce] SURBL stats: list hit r a tes measured in DNS
by Chris Santerre 16 Nov '04

16 Nov '04

>-----Original Message----- >From: Jose Marcio Martins da Cruz [mailto:Jose-Marcio.Martins@ensmp.fr] >Sent: Monday, November 15, 2004 3:27 PM >To: SM >Cc: Chris Santerre; Jeff Chan >Subject: Re: [SURBL-Discuss] Re: [SURBL-Announce] SURBL stats: list hit >ra tes measured in DNS > > >SM wrote: > >>> > http://j-chkmail.ensmp.fr/urlbl/urlbl.txt >> >Wrong link... > >http://j-chkmail.ensmp.fr/jeff/urlbl/urlbl.txt > >Jose-Marcio Thanks, but..... These stats are pretty useless: STATS BY URL BL ================================================= * ab.surbl 139803 38226 * j-chkmail 207945 54310 * multi.surbl 175657 54486 * ob.surbl 990 260 * sc.surbl 220 180 * ws.surbl 354 246 Because you said it goes by alphabet and stops at first hit. Mutli.surbl contains everything in SC and WS. So everything after mutli is of no use. Your other stats are cool though ;) --Chris

3 3

domain check dealsforrecruiters.net
by Chris Santerre 16 Nov '04

16 Nov '04

I've got numerous reports on these guys. But I can't make up my mind. But I have at least 6 spammy looking submitted mails. so anyone got an opinion on dealsforrecruiters.net? --Chris

3 2

FW: SURBL+ Checker Submission
by Chris Santerre 16 Nov '04

16 Nov '04

Both domains in this submission are Whitelisted. Let me guess..... sina.com and 6to23.com appear in ham :/ --Chris >-----Original Message----- >From: SURBL+ Checker >Sent: Friday, November 12, 2004 3:16 AM >Subject: SURBL+ Checker Submission > > >Date: Fri Nov 12 02:16:03 2004 >Reporter IP: MUNGED > >Applicable List: URIBL:ws.surbl.org >Reported URI/IP: 6to23.com >Rating: Black - 100% spam > >Email Source: >---------------------------------------- > >Received: from hotmail.com (unverified) by mailgate.munged.mungo!! > (Content Technologies SMTPRS 4.3.14) with ESMTP id ><T6d361aa1e8ac1000026e8(a)mailgate.freakingmunge.com> for <info(a)mungymungomunged.com>; > Thu, 11 Nov 2004 22:12:30 +0000 >Message-ID: <T6d361aa1e8ac1000026e8(a)mailgate.isaidmunge.com> >From: "nbbv(a)hotmail.com" <nbbv(a)hotmail.com> >Subject: Promote your business >To: Mungo likes to munge the munging! >Content-Type: text/html;charset="GB2312" >Content-Transfer-Encoding: 8bit >Reply-To: nbbv(a)hotmail.com >Date: Fri, 12 Nov 2004 06:11:33 +0800 >X-Priority: 3 >X-Mailer: Microsoft Outlook Express 6.00.2800.1106 > ><STYLE type="text/css"> > ></STYLE> ></HEAD> ><BODY> >Promote your business ! > >  We offer you e-mail addresses databases >for advertisement mailing; we sell databases >also carry out mailing and hosting for the >advertising projects. > >Products > >World Email Lists .  Their validity >and originality are verified. Black"><A href="http://asp3.6to23.com/oss/index.htm" >target="_blank">Details please go to >our website</A> > >Country or area total emails and price > >America      175 Million Email >Address >Europe       156 Million Email >Address >Asia         168 Million >Email Address >China(PRC)   80 Million Email Address >  >HongKong     3.25 Million Email >Address >TaiWan       2.25 Million >Email Address >Japan        27 Million >Email Address  >Australia    6 Million Email Address > >Canada       10 Million Email >Address   >Russia       38 Million Email >Address >England      22 Million Email >Address >German       40 Million >Email Address   >France       38 Million Email >Address >India        12 Million >Email Address >other Country or Area   > >--------------------------------------------------------------- >------------------------------ >            >            >           >            >  >Category Name total emails > >Apparel, Fashion, Textiles and Leather  4,654,565 > >Automobile & Transportation     >        6,547,845 >Business Services         >            >  6,366,344 >Chemicals           >            >        3,445,565 >Computer & Telecommunications    >       654,655 >Construction & Real Estate     >         3,443,544 > >Consumer Electronics       >            > 1,333,443 >Energy, Minerals & Metals     >          6,765,683 > >Environment           >            >      656,533 >Food & Agriculture       >            >   1,235,354       >            > >Gems & Jewellery       >            >     565,438 >Health & Beauty       >            >      804,654 >Home Supplies         >            >      323,232 >Industrial Supplies        >            > 415,668 >Office Supplies         >            >    1,559,892 >Packaging & Paper      >            >     5,675,648 >Printing & Publishing       >            >6,563,445 >Security & Protection       >            >5,653,494 >Sports & Entertainment     >            > 3,488,455 >Toys, Gifts and Handicrafts    >         2,135,654 > >--------------------------------------------------------------- >------------------------------ > >¡¤All of Country email lists + email sender >express +add url express + etrae express+Ebook >--------------------------------------------------------------- >------------------------------ > > > >Send Your Ad to Millions > >5 million bulk email >50 million bulk email >100 million bulk email >200 million bulk email > >Imagine emailing 500,000 recipients and 1 >out of every 1000 orders your product, that's >500 new orders! >* We go all-out to make sure our customers >are completely satisfied >* If any emails fail to make delivery, we >replace them free of charge >* 100% Spam free, rest assured you will not >be accused of spamming >* Almost all of our emails are sent to valid >email addresses >* No software required, we do all the mailing >from our own server >* Don't be fooled in signing up with similar >sites offering services that cannot compare >to ours >* Get the most bang for your buck with bulk >email advantage! >--------------------------------------------------------------- >------------------------------ > > > ><A href="http://asp3.6to23.com/oss/index.htm" >target="_blank">Details go to >website</A> > > > > >the email company > >copyright¡¤2004-2005 all reserved > > >------------------------------------------------------------ >remove please email: <A >href="mailto:emailad1234@sina.com?Subject=remove">emailad1234@s >ina.com</A> >------------------------------------------------------------ ></BODY> > >---------------------------------------- > >

4 3

Should we list ratware?
by Chris Santerre 16 Nov '04

16 Nov '04

MailinglistMaster.com They produce StealthMail Master 5.0, rateware. "The anonymous bulk email software you need to protect your connection from being shut down when you send out bulk email. With this new technology your ISP will not have a problem with your bulk e-mail operation. It uses special proxies for anonymity. Reliable proxy service comes with the software. Proxies are updated daily. We update our proxies several times a day. The program gets its speed from up to 300 concurrent connections to different proxy servers. We carefully select the proxies we add to our database.Instant and very accurate delivery rate is assessed by the program. This is the most reliable proxy mailer out there. It is sold on a membership basis. You can purchase either a monthly or a lifetime membership." --Chris

2 1

Computer being repaired
by SURBL 16 Nov '04

16 Nov '04

Hi all, Please note that I may not be able to respond as quickly as I'd like for a day or so since I need to repair my main computer. This is only referring to my personal mail. SURBL stuff should run just fine, as usual. (Chris S., my PC locked up in JO. Now the video BIOS won't even come up.... :-( Power supply measures ok with no load, so maybe the motherboard is hosed. Might be the power supply though.) Jeff C.

2 1

RE: [SURBL-Discuss] Re: [SURBL-Announce] SURBL stats: list hit r a tes measured in DNS
by Chris Santerre 15 Nov '04

15 Nov '04

>-----Original Message----- >From: Jose Marcio Martins da Cruz [mailto:Jose-Marcio.Martins@ensmp.fr] >Sent: Monday, November 15, 2004 3:50 PM >To: Chris Santerre >Cc: SM; SURBL Discussion list (E-mail); Jeff Chan >Subject: Re: [SURBL-Discuss] Re: [SURBL-Announce] SURBL stats: list hit >r a tes measured in DNS > > >Chris Santerre wrote: > >>Thanks, but..... >> >>These stats are pretty useless: >> STATS BY URL BL >> >>================================================= >> >> * ab.surbl 139803 38226 >> * j-chkmail 207945 54310 >> * multi.surbl 175657 54486 >> * ob.surbl 990 260 >> * sc.surbl 220 180 >> * ws.surbl 354 246 >> >>Because you said it goes by alphabet and stops at first hit. >Mutli.surbl >>contains everything in SC and WS. So everything after mutli >is of no use. >> > >You're wrong. > >If some entries were found at WS and SC, this means that they >aren't at >MULTI. > >Why ? There may be a race condition : as multi is created from other >bls, it may be possible that when I rsync, SC and WS where already >updated but not MULTI. > >Quite interesting indeed... > >I rsync data every two hours. It could be interesting to change >periodicity and see what happens. > Well yeah, you could look at a rotten apple and see it as a chance to study penicillin as well ;) So yeah, that would be the only explanation as to why there are any hits at all for those servers. But as general hit sites for those servers, those stats aren't going to help. Heck, it's only good for your first one :) --Chris Wait a minute! Whats a guy named Jose doing with a .fr TLD? ;)

1 0

RE: [SURBL-Discuss] safe.surbl.org concerns
by Chris Santerre 15 Nov '04

15 Nov '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, November 12, 2004 9:36 PM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] safe.surbl.org concerns > > >On Friday, November 12, 2004, 6:16:48 PM, Rob McEwen wrote: >> RE: safe.surbl.org concerns > >> While I do see the reasoning behind the need for a "golden" >list that users >> can feel **particularly** secure about using in a MTA-like >"set it and >> forget it" type of blocking... I can help but wonder: > >> (1) Wasn't the original goal of ALL surbl.org to have a low >enough FP rate >> to be able to operate in "set it and forget it" MTA-like >blocking mode? (I >> guess the answer to this question is that Fortune-500 types >want a really, >> really powerful assurance that they can employ SURBL with >virtually zero >> FPs?) > >Yes, but it seems really difficult to achieve perfection in any >given list. > >This is a proposal for some experiments to see if we can derive a >"carrier grade" list, as Carl Friend called it off list, from >some of the existing data. Haven't picked any names yet. > >> (2) Even so, can I (we) be assured that having a "golden" >list like this >> will NOT diminish our standards with the regular list. > >Yes, we will not be dumping a bunch of grey entries into any of >the existing lists. > >> In other words, I >> would like to know that the FP rate of the regular list will >at least stay >> the same (and hopefully continue to improve). > >Yes, that's what should happen. The FPs per existing list should >remain stable or be further improved. That remains a goal. > >> I'd hate to see SURBL >> administrators get "slack" by virtue of thinking "well, if >they wanted >> **that** level of low FPs, they should have used the golden list." > >I agree. We should not let that happen. As far as I'm concerned our >biggest challenge is reducing FPs. We're already doing a good >job of catching spam. I agree with Jeff. The ONLY list that is getting grey domains added is the UC list. Which is NOT an official SURL.org list. And it isn't ready for prime time yet. Lowering the FP rate in WS is the first and foremost goal for many contributors. WS will be as close to zero FP as we can humanly get. --Chris

1 0

RE: [SURBL-Discuss] Re: [SURBL-Announce] SURBL stats: list hit ra tes measured in DNS
by Chris Santerre 15 Nov '04

15 Nov '04

Linky no worky?? --Chris >-----Original Message----- >From: Jose Marcio Martins da Cruz [mailto:martins@ensmp.fr] >Sent: Sunday, November 14, 2004 3:25 PM >To: discuss(a)lists.surbl.org >Cc: martins(a)ensmp.fr >Subject: [SURBL-Discuss] Re: [SURBL-Announce] SURBL stats: list hit >rates measured in DNS > > > >Jeff, > >You'll find some stats from our mail server at : > > http://j-chkmail.ensmp.fr/urlbl/urlbl.txt > >Some words about it : > >- When a list get a hit, it stops searching other lists. >- The first list checked is the our one. surbl lists are checked > just after our one, in alphabetical order. This means : > j-chkmail > ab.surbl.org > ... > >So, our stats doesn't show all lists, but if this interests you, >I can easily adapt our stats scripts to get hits for all lists. > >Either way, this shows that most spam detection using SURBL, at >our domain, comes from ab and multi. This conclusion is mitigated >by : >- many entries from our list (j-chkmail) may exist on ob/sc or ws. >- our list (j-chkmail) isn't being updated too frequently, because > as I said you before, I add entries only when they aren't yet > at surbl lists and surbl lists are being updated very fast... > >Best > >Jose-Marcio > > >> >> In order to explore some conjunctions of existing lists that >> might have fewer false positives, we've created some stats >> measuring the number of DNS hits against all blocklists that the >> individual lists get, along with some permutations of those lists. >> >> >> Jeff C. >> -- >> Jeff Chan >> mailto:jeffc@surbl.org >> http://www.surbl.org/ >> > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] Computer being repaired
by Chris Santerre 15 Nov '04

15 Nov '04

>-----Original Message----- >From: SURBL [mailto:surbl@horse.supranet.net] >Sent: Sunday, November 14, 2004 11:10 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] Computer being repaired > > >Hi all, >Please note that I may not be able to respond as quickly as I'd like >for a day or so since I need to repair my main computer. This >is only referring to my personal mail. SURBL stuff should run >just fine, as usual. > >(Chris S., my PC locked up in JO. Now the video BIOS won't even >come up.... :-( Power supply measures ok with no load, so maybe >the motherboard is hosed. Might be the power supply though.) > Crud! Any overclocking? Did you throw in a older video card to check? This is damn important to fix quickly. No not because of emails.... The JO expansion comes out tomorrow!!! :-) Let me know if I can be any help. Make sure your hard drive is still good. You got lots of good data! --Chris (The Geforce 6800 OC freaking rocks!!!)

1 0

Re: [SURBL-Announce] SURBL stats: list hit rates measured in DNS
by Jose Marcio Martins da Cruz 14 Nov '04

14 Nov '04

Jeff, You'll find some stats from our mail server at : http://j-chkmail.ensmp.fr/urlbl/urlbl.txt Some words about it : - When a list get a hit, it stops searching other lists. - The first list checked is the our one. surbl lists are checked just after our one, in alphabetical order. This means : j-chkmail ab.surbl.org ... So, our stats doesn't show all lists, but if this interests you, I can easily adapt our stats scripts to get hits for all lists. Either way, this shows that most spam detection using SURBL, at our domain, comes from ab and multi. This conclusion is mitigated by : - many entries from our list (j-chkmail) may exist on ob/sc or ws. - our list (j-chkmail) isn't being updated too frequently, because as I said you before, I add entries only when they aren't yet at surbl lists and surbl lists are being updated very fast... Best Jose-Marcio > > In order to explore some conjunctions of existing lists that > might have fewer false positives, we've created some stats > measuring the number of DNS hits against all blocklists that the > individual lists get, along with some permutations of those lists. > > > Jeff C. > -- > Jeff Chan > mailto:jeffc@surbl.org > http://www.surbl.org/ >

1 0

Re: [SURBL-Discuss] RFC: consensus list?
by Frank Ellermann 14 Nov '04

14 Nov '04

Jeff Chan wrote: >> (35 + 35 + 21 + 7 + 1 = 99, is that correct ?) It is, 128 -1 -7 -( 6+5+4+3+2+1 ) = 99. Where -1 is "not no bit", -7 is "not only one bit", and the rest "not two bits". > Actually it may be necessary to create some new lists, > partly depending on whether the application can combine > individual lists by itself. Yes, bit 0 could replace only one "new list", not several. But as long as you can express the condition for the "new list" by a single boolean expression of the 7 multi bits, one bit is good enough. Excl. the special case "no bits", because that would result in 127.0.0.1. > And I just realized a major flaw in my suggestion to try > 127.0.0.84 as a single list 84 = 64+16+4 (you said JP+OB+WS, I don't check it). Let's say that you want any combo where these 3 bits are set. Then you have 3 fixed bits, and 4 free bits (at the moment only 3 free bits, but you may want to add the 7th bit later). 2 ** 4 = 16, you need 16 result codes to identify all combos with JP+OB+WS: 84,86, 92,94, 116,118, 124,126, (= 8 without the 7th bit, for the remaining 8 combos just add 128, from 212 to 254) > it will NOT have any JP + OB + WS + SC That's 86 = 84 + 2. > That kind of combination needs to be done by creating a > new list on the data side, or special processing in the > application. Or by adding bit 0 on your side for THE one "optimal rule": 85,87, 93,95, 117,119, 125,127 (= same 8, now bit 0 is set) > I will create some temporary test lists in the second or > third octet of multi to test on corpora instead. Yes, post a real complex boolean expression, it's fun stuff, SURBL would set a new standard (impressing ISIPP and OPM ;-) But don't touch the zeros in 127.0.0.? without warning, it would break my poor <http://purl.net/xyzzy/src/rxwhois.cmd> : | if SockGetHostByName( arg(1) || arg(2), 'P.' ) then do | if abbrev( P.ADDR, '127.0.0.' ) | abbrev( P.ADDR, '127.1.0.' ) | then say arg(3) '(' || substr( P.ADDR, 9 ) || '):' arg(2) | else say 'erroneous result' P.ADDR 'for' arg(1) || arg(2) | return 1 | end /* 127.1.0.1 .. 127.1.0.7 for .opm.blitzed.org(1+2+4) */ | return 0 Bye, Frank

2 5

RFC: consensus list?
by Jeff Chan 14 Nov '04

14 Nov '04

Pondering the question of how to make a "telco grade" SURBL that had as close to zero false positives as possible, but would still catche many spams, I remembered that many of the biggest spam domains seem to appear in several different SURBL lists. What does anyone think about creating a "consensus" list that a telco or ISP might use to block at the MTA level? For example a domain that appears on: ((SC or AB) and (JP or OB)) or PH might be a candidate for such a list. The main reason I don't include WS is that it's a hand built list and I don't have a feeling for the latencies from it. SC and AB are both mostly based on SpamCop user reports. JP and OB are both mostly based on spamtrap data. PH represents really destructive fraud and phishing and probably should be included unless the FP rates from it are significantly above zero. I realize this is a simplistic scheme and other ways of combining the list are possible, but what does anyone think those idea? Conceivably we could have other combinations. Another possibility might be records that appear in SC and AB and WS and JP and OB I think we can nearly guarantee that those are 100% spam. :-) (Would want to check those that are in WS separately from JP, which is currently included in WS.) What other ways to combine lists might produce near zero FPs yet still hit most spam? Shall we just try some of them and see how well they work? Comments? Jeff C. -- "If it appears in hams, then don't list it."

6 13

Re: [SURBL-Discuss] RFC: consensus list?
by Frank Ellermann 13 Nov '04

13 Nov '04

Jeff Chan wrote: > LOL! I didn't think of that! Just an idea how to use bit 0 of multi in a way indicating "interesting" combinations. Ryan identified "any 3 out of 6 multi bits" as relevant. That's probably too KISS for you, and if you'd add the not yet used 7th multi bit it would result in 7 over 3 (any 3 out of 7) combinations, 99 result codes if I got it right. (35 + 35 + 21 + 7 + 1 = 99, is that correct ?) Apparently SA already supports Ryan's idea, and then you don't need it. But if you have more complex rules to get an "optimal" proper subset of all multi result codes, then you could (ab)use bit 0 to mark it. Or in other words, any odd N in 127.0.0.N would be optimal. And 127.0.0.1 would be still protected (= never returned). > without explicitly creating new, combined lists. Yes, that's unnecessary. Unless you have more than one definition of "optimal". Bit 0 can only handle one "rule", i.e. any combination of AND / OR / NOT multi bits you like. Bye, Frank

2 1

Re: [SURBL-Discuss] RFC: consensus list?
by Frank Ellermann 13 Nov '04

13 Nov '04

Jeff Chan wrote: > Comments? See Ryan's answer, it's easy to do interesting stuff with the multi bits, multi was a good idea. If you want to simplify it set bit 1 if 3 or more other bits are set, examples: 127.0.0.6 => 127.0.0.6 (2 or less bits unchanged) 127.0.0.100 => 127.0.0.101 (64+32+4 => 64+32+4+1) 127.0.0.14 => 127.0.0.15 (8+4+2 => 8+4+2+1) Bye, Frank

2 1

Re: [SURBL-Discuss] RFC: consensus list?
by Rich Graves 13 Nov '04

13 Nov '04

Jeff Chan wrote: > The idea is to have a "golden" list that is so accurate > (for spams it does identify) and has so few FPs that > it would be safe to block outright at the MTA level, > for example. > > An MTA milter or plugin probably can't determine that > from multi alone (i.e. looking at all the lists), so I'm > wondering if we can create a list for that purpose out > of the existing lists. SpamAssassin does have "meta" rules. Look at NIGERIAN_BODY4 or UPPERCASE_75_100 in 20_meta_tests.cf. meta SURBL_3 (URIBL_JP_SURBL + URIBL_AB_SURBL + URIBL_PH_SURBL + URIBL_SC_SURBL + URIBL_WS_SURBL + URIBL_OB_SURBL) > 2 describe SURBL_3 Contains URIs in at least 3 blacklists score SURBL_3 3 True, that would also catch messages with one URI in JP, a different URI in AB, a third URI in OB, and no actual overlap, but that's not very likely... -- Rich Graves <rcgraves(a)brandeis.edu> UNet Systems Administrator

3 2

Re: [SURBL-Announce] fraud.rhs.mailpolice.com phishing data added to ph SURBL
by Jeff Chan 13 Nov '04

13 Nov '04

On Thursday, November 11, 2004, 10:35:02 PM, Jeff Chan wrote: > As of 12 November 2004, we have added data from > fraud.rhs.mailpolice.com into ph, joining our exiting phishing > data from mailsecurity.net.au. I should add, this means if you were testing fraud.rhs.mailpolice.com as a separate list, as in SA 2.63 or 2.64 with SpamCopURI: uri MP_URI_RBL eval:check_spamcop_uri_rbl('fraud.rhs.mailpolice.com','127.0.0.2') describe MP_URI_RBL URI's domain appears in MailPolice fraud list tflags MP_URI_RBL net score MP_URI_RBL 2.0 or SpamAssassin 3.0.0: urirhsbl URIBL_MP fraud.rhs.mailpolice.com. A header URIBL_MP eval:check_uridnsbl('URIBL_MP') describe URIBL_MP URI's domain appears in MailPolice fraud list tflags URIBL_MP net score URIBL_MP 2.0 or SpamAssassin 3.0.1: urirhsbl URIBL_MP fraud.rhs.mailpolice.com. A body URIBL_MP eval:check_uridnsbl('URIBL_MP') describe URIBL_MP URI's domain appears in MailPolice fraud list tflags URIBL_MP net score URIBL_MP 2.0 Then you should remove or disable the above rule as redundant if you are also using ph in multi.surbl.org, which SpamAssassin 3.0.0 and 3.0.1 do *by default*: http://spamassassin.apache.org/full/3.0.x/dist/rules/25_uribl.cf urirhssub URIBL_PH_SURBL multi.surbl.org. A 8 body URIBL_PH_SURBL eval:check_uridnsbl('URIBL_PH_SURBL') describe URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist tflags URIBL_PH_SURBL net score URIBL_PH_SURBL 3.0 (IIRC you can disable rules simply by setting them to zero, but in this case I'd probably recommend commenting them out or deleting them.) So keep the PH rule and delete any test rule using fraud.rhs.mailpolice.com separately. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Please test MailPolice Fraud list
by Jeff Chan 12 Nov '04

12 Nov '04

Please test the MailPolice Fraud list as Bill described earlier (copied below). We would like to include this data in our PH anti-phishing list, but request your help in testing it first. We're particularly interested in any false positives. Jeff C. __ This is a list that MailPolice hosts and I have been running it for a few hours and it has already flagged some phish and fraud e-mails. Here is some info about the list: http://rhs.mailpolice.com/#rhsfraud This is my configuration for SA 2.64 with the SpamCopURI plug-in: uri MP_URI_RBL eval:check_spamcop_uri_rbl('fraud.rhs.mailpolice.com','127.0.0.2') describe MP_URI_RBL URI's domain appears in MailPolice fraud list tflags MP_URI_RBL net score MP_URI_RBL 2.0 And for SA 3.0 with the URIDNSBL plug-in: urirhsbl URIBL_MP fraud.rhs.mailpolice.com. A header URIBL_MP eval:check_uridnsbl('URIBL_MP') describe URIBL_MP URI's domain appears in MailPolice fraud list tflags URIBL_MP net score URIBL_MP 2.0 Bill

5 16

Re: [SURBL-Discuss] Please test MailPolice Fraud list
by Jeff Chan 12 Nov '04

12 Nov '04

On Thursday, November 11, 2004, 7:03:44 PM, Chris wrote: > On Thursday 11 November 2004 07:41 pm, Jeff Chan wrote: >> urirhsbl URIBL_MP fraud.rhs.mailpolice.com. A >> body URIBL_MP eval:check_uridnsbl('URIBL_MP') >> describe URIBL_MP URI's domain appears in MailPolice fraud list >> tflags URIBL_MP net >> score URIBL_MP 2.0 >> >> Jeff C. > Uh, maybe I should have clarified also :( do I just paste the above into my > local.cf? Yes, but be sure to put your local.cf in /etc/mail/spamassassin and not /usr/share/spamassassin. The former directory is for custom rules. The latter directory is for default rules that come with SA and can get overwritten when versions are updated. Jeff C. -- "If it appears in hams, then don't list it."

1 0

Probable new data source: DNS queries hitting spamhaus lists
by Jeff Chan 10 Nov '04

10 Nov '04

At Daniel Quinlan's suggestion, we've started to check a sampling of SURBL name server queries against sbl and xbl.spamhaus.org. His interest is as a potential replacement for the very time consuming NS record lookups done with uridnsbl. We haven't turned these into a SURBL yet, but probably will eventually. So far this has resulted in about 11k SBL domains with about 60% overlap with existing SURBLs. The fun thing is that this catches at a very early stage spams from scumbags like "Media Dreamland" that has been spamming free computer monitors, etc. lately. Some of these type of operations that reuse the same name server IPs, but register and change domains frequently are caught this way, just like uridnsbl does, but with perhaps a few missed due to sampling effects on the DNS queries. This method also features a much lower global DNS overhead since the lookups are done once in a centralized way, and not repeatedly in a gazillion SpamAssassin installations on the same domains in a very distributed and redundant way. The way this works is that we sample DNS queries from SURBL lookups and compare new wild domains (i.e. domains found in general email URIs), against xbl and sbl and build up lists of the matches. (To be more correct, it's the wild domain name server "NS" record resolved ip addresses which are checked against sbl and xbl.) Along with this will need to be expiration runs, which I haven't built yet. (In other words, domains should come off the lists when they no longer resolve or no longer resolve to name servers in sbl or xbl.) The main downside is that domains matching name servers listed in sbl or xbl definitely has more false positives than our other SURBL lists. We'll want to do some testing, but it may be as high as 1%, so they'd need to be used carefully. Some perhaps other interesting stats after about two weeks: unique queries logged so far about 250k (These are reduced to base domains where easy) SBL matches so far about 11k XBL matches so far about 400 SBL are checked for NS records only XBL are checked for NS, www, base domain against XBL (but not MX) Questions? Comments? Suggestions? Jeff C. -- "If it appears in hams, then don't list it."

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss