- Discuss - Mailman 3

Re: [SURBL-Discuss] Possible fps
by Jeff Chan 08 Nov '04

08 Nov '04

On Sunday, November 7, 2004, 8:54:28 AM, Tastings Journal wrote: > I run www.TastingsJournal.com and saw your letter on the internet. Our > messages do go out to a large base of people that have been members @ > PartySlave.com or PartyPolice.com > I send out just HTML text only messages and then direct people to the site. > Even though they have subscribed I still put an unsubscribe link in each > mail. I am not sure if this message means since I am not that familiar > with FP's or SURBL (black lists?) > Etc etc. If I am listed, I would like to know what measures I can take with > you to have the stigma taken off the Domain. > Thanks > James James, Please add confirmations to your subscriptions. Otherwise anyone can subscribe john(a)johnkerry.com, for example. Looks like this domain is on the Outblaze list. Outblaze, Please consider removing this domain. It has no NANAS, is not on RBLs, appears to have legitimate uses. Jeff C. -- "If it appears in hams, then don't list it."

1 0

C version of SURBL client?
by Andrew 07 Nov '04

07 Nov '04

Hi All, Does anyone know if there is an open-source client written in c to perform URL searches in message bodies, and then lookups against a SURBL ? (This is not for use with SA) Cheers, Andrew

4 7

Another program that uses SURBL
by Bret Miller 06 Nov '04

06 Nov '04

Just ran across this today. Doug's content filter for Merak, Exchange and Communigate Pro now supports SURBL too. http://www.2150.com/regexfilter/ Bret ---------- Send your spam to: bretmiller(a)wcg.org <mailto:bretmiller@wcg.org> Thanks for keeping the internet spam-free!

2 1

Virginia Law is used for first time for felony SPAM convictions
by Kevin A. McGrail 05 Nov '04

05 Nov '04

Pre-Face: We run the public nameserver d3.surbl.org and it is located in Virginia as is our company. I wonder whether things like surbl (I can definitely see Razor) could be extrapolated to increase the venue of this type of law? At the very worst, I think this is a definite "spammer beware". Anyway, after staying up till the wee hours after the election, I missed this news article about 2 spammers being convicted of 3 felony's each in Virginia this week. One sentenced to 9 years in jail, one got $7500 fine. However, one particularly interesting note. This case only accounted for SPAM sent for less than a month and 3 days of email over 10K each day were the reason for the 3 felony convictions. Important to note, these were extraditions from North Carolina where they SPAMmed users at AOL. It looks like using or sending to Virginia-based servers will be enough for felony convictions. Regards, KAM Some sparse info here: http://www.washingtonpost.com/wp-dyn/articles/A23622-2004Nov3.html More sentencing info here: http://www.computerweekly.com/articles/article.asp?liArticleID=134815&liArt…

1 0

Syntax issues
by Joe Zitnik 04 Nov '04

04 Nov '04

I am having problems getting all of my SURBL rules to work. My rules are below. All my rules work except two of them (I think): URIBL_PH_SURBL and URIBL_AH_DNSBL I have check through my archived spam, and can find no hits on those rules. If I run spamassassin --lint, I get no syntax errors. Are my rules not working, or do those rules almost never hit? urirhsbl URIBL_SC_SURBL sc.surbl.org. A header URIBL_SC_SURBL eval:check_uridnsbl('URIBL_SC_SURBL') describe URIBL_SC_SURBL Contains a URL tflags URIBL_SC_SURBL net score URIBL_SC_SURBL 4.0 urirhsbl URIBL_WS_SURBL ws.surbl.org. A header URIBL_WS_SURBL eval:check_uridnsbl('URIBL_WS_SURBL') describe URIBL_WS_SURBL Contains a URL tflags URIBL_WS_SURBL net score URIBL_WS_SURBL 2.0 urirhsbl URIBL_OB_SURBL ob.surbl.org. A header URIBL_OB_SURBL eval:check_uridnsbl('URIBL_OB_SURBL') describe URIBL_OB_SURBL Contains a URL tflags URIBL_OB_SURBL net score URIBL_OB_SURBL 4.0 urirhsbl URIBL_AB_SURBL ab.surbl.org. A header URIBL_AB_SURBL eval:check_uridnsbl('URIBL_AB_SURBL') describe URIBL_AB_SURBL Contains a URL tflags URIBL_AB_SURBL net score URIBL_AB_SURBL 5.0 urirhssub URIBL_PH_SURBL multi.surbl.org. A 8 header URIBL_PH_SURBL eval:check_uridnsbl('URIBL_PH_SURBL') describe URIBL_PH_SURBL Contains a URL tflags URIBL_PH_SURBL net score URIBL_PH_SURBL 5.0 urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 header URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') describe URIBL_JP_SURBL Contains a URL score URIBL_JP_SURBL 4.0 uridnsbl URIBL_AH_DNSBL dnsbl.ahbl.org. TXT body URIBL_AH_DNSBL eval:check_uridnsbl('URIBL_AH_DNSBL') describe URIBL_AH_DNSBL Contains a URL listed in the AH DNSBL tflags URIBL_AH_DNSBL net score URIBL_AH_DNSBL 0.5

2 2

Nice URIDNSBL functionality
by Bill Landry 04 Nov '04

04 Nov '04

Folks, with some of the nice functionality that the SA devs built into the URIDNSBL plug-in (see http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Plugin…), you can do cool things like: ===== # URIDNSBL (queries URIs against standard DNSBLs) uridnsbl URIBL_AH_DNSBL dnsbl.ahbl.org. TXT body URIBL_AH_DNSBL eval:check_uridnsbl('URIBL_AH_DNSBL') describe URIBL_AH_DNSBL Contains a URL listed in the AH DNSBL blocklist tflags URIBL_AH_DNSBL net score URIBL_AH_DNSBL 0.5 uridnsbl URIBL_NJA_DNSBL combined.njabl.org. TXT body URIBL_NJA_DNSBL eval:check_uridnsbl('URIBL_NJA_DNSBL') describe URIBL_NJA_DNSBL Contains a URL listed in the NJA DNSBL blocklist tflags URIBL_NJA_DNSBL net score URIBL_NJA_DNSBL 0.5 uridnsbl URIBL_SBL_XBL sbl-xbl.spamhaus.org. TXT body URIBL_SBL_XBL eval:check_uridnsbl('URIBL_SBL_XBL') describe URIBL_SBL_XBL Contains a URL listed in the SBL-XBL DNSBL blocklist tflags URIBL_SBL_XBL net score URIBL_SBL_XBL 0.5 uridnsbl URIBL_SORBS_DNSBL dnsbl.sorbs.net. TXT body URIBL_SORBS_DNSBL eval:check_uridnsbl('URIBL_SORBS_DNSBL') describe URIBL_SORBS_DNSBL Contains a URL listed in the SORBS DNSBL blocklist tflags URIBL_SORBS_DNSBL net score URIBL_SORBS_DNSBL 0.5 # URIRHSBL (queries URIs against standard RHSBLs) urirhsbl URIBL_AH_RHSBL rhsbl.ahbl.org. A body URIBL_AH_RHSBL eval:check_uridnsbl('URIBL_AH_RHSBL') describe URIBL_AH_RHSBL Contains a URL listed in the AH RHSBL blocklist tflags URIBL_AH_RHSBL net score URIBL_AH_RHSBL 0.5 urirhsbl URIBL_MP_RHSBL block.rhs.mailpolice.com. A body URIBL_MP_RHSBL eval:check_uridnsbl('URIBL_MP_RHSBL') describe URIBL_MP_RHSBL Contains a URL listed in the MP RHSBL blocklist tflags URIBL_MP_RHSBL net score URIBL_MP_RHSBL 0.5 urirhsbl URIBL_SS_RHSBL blackhole.securitysage.com. A body URIBL_SS_RHSBL eval:check_uridnsbl('URIBL_SS_RHSBL') describe URIBL_SS_RHSBL Contains a URL listed in the SS RHSBL blocklist tflags URIBL_SS_RHSBL net score URIBL_SS_RHSBL 0.5 ===== I have been running these additional URI tests for about two weeks and have gotten very good results. If you decide to try out these tests, you may want to run them with minimal scores until you see how they are going to perform for you in your particular environment. Bill

6 12

Re: SURBL not working properly in SA 3.0.x (and MailScanner)
by alden＠engineno9inc.com 03 Nov '04

03 Nov '04

On Tuesday, November 2, 2004, 1:10:15 PM, Alden Levy wrote: >> Last week, I upgraded my server to FC1 (from RH 7.3). Sendmail, Ensim, and >> perl also got upgraded (to 8.12.x, 4.02, 5.8.1, respectively. >> Before the upgrade, everything worked well with SA 3.0.0 and MaliScanner >> 4.34. Now, SURBL doesn't work unless I do some really strange things. I've >> reinstalled SA, MS, and ClamAV, but no joy. I've since upgraded to SA 3.0.1, >> MS 4.35.9 and Mail::ClamAV 0.13. I already had ClamAV 0.80 installed. >> spamassassin -D --lint works fine, and when I test spamassassin with a SURBL >> URL, it gives the expected output. I don't get hits with MailScanner running >> unless I put the contents of 25_uribl.cf into my spam.assassin.prefs.conf >> (which has a link from local.cf). >> And my mail logs look fine, i.e., no errors, no MS restarts, etc. >Did you remember to change your URIBL rules from header to body? Yep. I did this (I, too, had hoped that this would fix my problem). Any other thoughts? Thanks. > http://www.surbl.org/ > Important Note Regarding SpamAssassin 3.0.1 and later: When > adding URIDNSBL rules, including SURBL or SBL ones using > urirhsbl, urirhssub or uridnsbl, be sure to set the rule type > to body. For example: > > urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 > body URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') > describe URIBL_JP_SURBL Has URI in JP at http://www.surbl.org/lists.html > tflags URIBL_JP_SURBL net > > score URIBL_JP_SURBL 4.0 > > This is a change from SpamAssassin 3.0.0, where body above was > previously header. Here is the changelog reference: > > r54022 | felicity | 2004-10-07 22:21:30 +0000 (Thu, 07 Oct 2004) | 1 line > > bug 3734: uridnsbl rules work on body data, not header data, so change > the rule type from header to body >Jeff C.

3 2

SURBL not working properly in SA 3.0.x (and MailScanner)
by Alden Levy 03 Nov '04

03 Nov '04

Last week, I upgraded my server to FC1 (from RH 7.3). Sendmail, Ensim, and perl also got upgraded (to 8.12.x, 4.02, 5.8.1, respectively. Before the upgrade, everything worked well with SA 3.0.0 and MaliScanner 4.34. Now, SURBL doesn't work unless I do some really strange things. I've reinstalled SA, MS, and ClamAV, but no joy. I've since upgraded to SA 3.0.1, MS 4.35.9 and Mail::ClamAV 0.13. I already had ClamAV 0.80 installed. spamassassin -D --lint works fine, and when I test spamassassin with a SURBL URL, it gives the expected output. I don't get hits with MailScanner running unless I put the contents of 25_uribl.cf into my spam.assassin.prefs.conf (which has a link from local.cf). And my mail logs look fine, i.e., no errors, no MS restarts, etc. Any help would be appreciated. Thanks, Alden Alden Levy Engine No. 9, Inc. 130 W. 57th Street, Suite 12E New York, NY 10019 (212) 981-1122 (212) 725-7202 fax

2 1

applying surbl
by George Georgalis 01 Nov '04

01 Nov '04

Q Q Q H A P P Y Q H A L L O W E E N Q Q Q ! I'm having trouble getting surbl to work... SpamAssassin Server version 3.0.0 running on Perl 5.6.1 I have /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm and I can see from the spamd startup logs I'm loding it twice in cf files: loadplugin Mail::SpamAssassin::Plugin::URIDNSBL and I have score URIBL_AB_SURBL 2.007 score URIBL_OB_SURBL 1.996 score URIBL_PH_SURBL 0.839 score URIBL_SBL 0.629 score URIBL_SC_SURBL 3.897 score URIBL_WS_SURBL 0.539 and I bumped up uridnsbl_timeout 8 but "it's not working" even when I cat spam with http://test.surbl.org/ to spamc -R, none of the surbl tests work. I was suprised to discover it doesn't check the body for foe, only the header, eg urirhssub URIBL_SC_SURBL multi.surbl.org. A 2 header URIBL_SC_SURBL eval:check_uridnsbl('URIBL_SC_SURBL') describe URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist tflags URIBL_SC_SURBL net but, it's not matching anything. What am I doing wrong? // George -- George Georgalis, systems architect, administrator Linux BSD IXOYE http://galis.org/george/ cell:646-331-2027 mailto:george@galis.org

3 4

Lists anounced on SA-dev and users
by Jeff Chan 31 Oct '04

31 Oct '04

FWIW I've announced these lists on spamassassin-dev and spamassassin-users. Hopefully we will get some additional interested folks to join in. Jeff C. __ Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 1

Pardon the old messages
by Jeff Chan 31 Oct '04

31 Oct '04

I fscked up and resent some old messages from April. Please discard those. Embarrassed, Jeff C.

1 0

LT02.NET
by Fred 29 Oct '04

29 Oct '04

Can someone tell me why LT02.NET is whitelisted? (don't tell me cause it's in ham) I would like an example if possible. They use open relays to send their spam, the have 8 nanas hits, the domain is fairly new like 2004-08-06 Hand checked, it does not look like a legit site. (main page is just a remove form.) I played around and found that if you visit: http://t.lt02.net/c.asp? it will redirect you to www.listrak.com which is also whitelisted (listrak has 31 nanas hits). Their mx record is an open relay, I think this is a very questionable domain to whitelist. http://ordb.org/lookup/?host=66.109.239.150 CALLING CHRIS, WE NEED THIS ADDED TO OUR GREYLISTING! Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400 mailto:info@i-is.com

4 5

RE: Re: [SURBL-Discuss] In support of Project Honeypot
by Chris Santerre 28 Oct '04

28 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, October 28, 2004 12:01 AM >To: SURBL Discuss; phpot-surbl(a)matthew.unspam.com >Subject: Fwd: Re: [SURBL-Discuss] In support of Project Honeypot > > >Here's a response to Chris Albert's concerns about Project >Honeypot from Matthew Prince, the head of Project Honeypot and >unspam.com. He also gives his direct phone number as: 312.543.3046. >Matthew's reply address is: phpot-surbl(a)matthew.unspam.com or >you may be able to reply all since I included this on the To: >list. > >I invited him to join our lists, but expect he may already get >plenty of mail. > >Jeff C. >__ > >It's a strange thing to have to prove that you're one of the >good guys. *snip* Oh no! It's worse then we thought! They aren't spammers, or spam helpers. They are lawyers! ;) J/K. I remember seeing the video on the MIT site from the conference. Its a very good idea. Which is why I'm one of the 50. But I don't get much traffic. I need to get a few more sites setup. --Chris (The curse has been reversed!)

3 2

Fwd: Re: [SURBL-Discuss] In support of Project Honeypot
by Jeff Chan 28 Oct '04

28 Oct '04

Here's a response to Chris Albert's concerns about Project Honeypot from Matthew Prince, the head of Project Honeypot and unspam.com. He also gives his direct phone number as: 312.543.3046. Matthew's reply address is: phpot-surbl(a)matthew.unspam.com or you may be able to reply all since I included this on the To: list. I invited him to join our lists, but expect he may already get plenty of mail. Jeff C. __ It's a strange thing to have to prove that you're one of the good guys. I've certainly been skeptical of a lot of supposed anti-spam websites that turned out to be nothing more than advertising schemes (for example, I was in part responsible for the FTC's investigation a few months ago of the subsequently shut down EthicalEmail.com site -- you may have heard the ads they were running on the radio about a "private national do not email registry"). It's good to ask questions, and I understand how things could look skeptical.... especially those Google ads. We've had a running debate all day ourselves about whether we should pull down the Google ads. As you know, we have no control over what ads appear on that site. I have no idea why Google has decided to put up ads for mailers on some of our pages. When we've used Google to serve ads to the News Ticker on our Unspam site they've typically been spam filter companies. Our goal, since our means are modest, has been to simply cover the costs of our bandwidth and servers. I was really, really surprised myself when the ads that appeared were for marketers. I tried initially to use the AdSense interface in order to block them. If you haven't used it, the way AdSense works is you have to list advertisers one at a time by their URL. There is no way to block an entire category. Unfortunately, enough bulk mailers are using Google's ads that they just kept appearing. I was about to pull the ads from the pages entirely when one of our developers -- who's a lot smarter than I am -- sent me an email saying: "You know, this is sort of a sweet justice. The bulk mailers are paying to have their ads listed on our site. It's certainly an efficient way to transfer the wealth from the spam community to the anti-spam community. Talk about hitting spammers in their pockets!" That's clever, I thought. While I'm not ready to say that everyone advertising there is a "spammer" (I don't want to get sued, or get the Google lawyers coming after me for violating the terms of service somehow) the reasoning above resonated and I (so far) decided to leave the ads up. To that end any page where an ad appears we've now added a disclaimer to the bottom. And there's a paragraph in the FAQ about the ads that appear. You can check it out here: http://www.projecthoneypot.org/faq.php#e I'm having second thoughts seeing that there's skepticism in the anti-spam community. I'd love your feedback. If people are adamant we should pull down the ads then I definitely will. Otherwise, again, seems like sweet justice. As far as our "consulting," the people who started Unspam, myself included, are attorneys by trade. We are occasionally -- although rarely -- asked to speak at conferences to talk about the legal risk to companies and individuals that send unsolicited commercial email. That is the extent of our "consulting" practice. I, for example, spoke at Anne Mitchell's ISIPP conference in July and the majority of audience members were bulk mailers. I believe you can actually listen to a copy of my speech from the ISIPP website (http://www.isipp.org/). I was invited by the ITU, a branch of the UN, to speak about why anti-spam laws have failed in Geneva, Switzerland a few months ago. There are several other similar speeches online. For example, you can see a whole video at: http://otel3.uis.edu/impatica/kmill2/Summit.htm Click Lunch Speaker. Or, maybe most appropriately, I think there's video floating around from last year's MIT SpamConference where I was a speaker again and talked about the initial ideas that formed the basis for Project Honey Pot.... how, currently, spammers were most vulnerable at the beginning of the "spam cycle," the point at which they are gathering email addresses, but no one was focusing on that. I'm also told that the video from CEAS where I spoke about what we're trying to do with the Project will be available soon through the CEAS website (http://www.ceas.cc/). Watching my talks, you may or may not agree with everything I had to say, but I think it's pretty clear we're not spammers or in any way in support of spammers (or bulk mailers, or list brokers). A couple of things I think you already know, but maybe it'd be good for the SURBL list to hear. First, we have never taken money from or been hired to consult with any spammer, harvester, bulk mailer, list broker, or ISP. (If our business were primarily consulting, we'd be fairly pathetic failures.) We started Project Honey Pot in order to help governments and individuals investigate, understand, and prosecute the spammers. We saw a problem -- that no one was tracking the entire spam cycle -- and are in the process of trying to solve it. One of the things we realized we could do once we had that infrastructure in place was assist other people in the anti-spam fight. We've already pledged to make the corpus of spam we receive available to anti-spam authors. And, as I've told you, we will turn over the complete list of URLs from the messages that we receive to the SURBL and potentially other open source RBLs. The point that has been made on the list that spammers will adjust and I'm sure that is true. While today I think the number of IP addresses used for spamming is small, over time more harvesters will use proxies and other tools to obscure their identities. In our initial tests we observed at least a few that appeared to already be doing that. That's not a reason to not do this now, at worst it's just an indictment that we're wasting our time. I don't agree with that and think the Project will prove useful even as spammers adjust to it. But it should be said that I have never believed that we would make much, if any, dent in the overall volume of spam. All I think is that we have a chance to gather a lot more data on the behavior of spammers, to answer some key questions, and hopefully set the stage for someone a lot more clever than me to come up with the idea that will be the final nail in spam's coffin. I just got a call from Eric Langheinrich, one of the people developers behind the software that makes Project Honey Pot possible, about a bug we're trying to track down and fix in the registration process. I told him people were saying we looked "too corporate." He started laughing and didn't stop until he finally said, "Wow, if they only knew! That's what you get for making a pretty website and including all that legal mumbo jumbo." Maybe that's our sin, but does seem like strange reasoning to say that we must be on the side of the spammers because our site is pretty.... So, with all that, I encourage anyone who wants to sign up to do so; we'd love to have as many website participating as possible. You can do so at: http://www.projecthoneypot.org/ It's hard for us to prove that we're going to do what we promise because we've only been open for 3 days and, to be honest, have only received one spam message so far. (They're start flooding in soon. Our initial tests show that on average there's about 1 week between harvesting and the first messages to arrive.) If you're skeptical of our intent then I just ask that you give us a chance and wait and see how we behave. Thanks to everyone who's donated MX entries and installed honey pots. In three days with no publicity other than than emails sent out to friends of ours about the launch we're up to about 50 installed honey pots and over 100 donated MXs. That's more successful than we could have ever hoped. If anyone has a question, you're welcome to email or call me directly and I'd be happy to do what I can to answer it. Keep fighting the good fight! Matthew Prince CEO, Unspam, LLC Adjunct Professor of Law John Marshall Law School 312.543.3046 (direct) phpot-surbl(a)matthew.unspam.com

2 1

ccTLD med.br
by Yves Junqueira 28 Oct '04

28 Oct '04

Hi. med.br is in WS while it shouldn't. It's a TLD reserved for medical professionals (doctors). See http://registro.br/info/dpn.html registro.br is the main (only?) brazilian registrar. -- Yves Junqueira http://www.lynx.com.br

2 1

RE: [SURBL-Discuss] In support of Project Honeypot
by Chris Santerre 27 Oct '04

27 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, October 27, 2004 11:01 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] In support of Project Honeypot > > >On Wednesday, October 27, 2004, 7:48:08 AM, Chris Santerre wrote: >> I guess I'll have to get up out of my >> chair and move my lazy butt to inplement this today :) > >Or put a chair by your computer? ;-) ;-) > Even for a hockey player, its too darn cold in that room! And my boss's office is right next to it ;) I've just implemented my projecthoneypot account! Weeeeeee!! Now to add some links. --Chris

1 0

Project Honeypot is open source
by Jeff Chan 27 Oct '04

27 Oct '04

FWIW Project Honeypot is open source: http://www.projecthoneypot.org/faq.php#e "Does Project Honey Pot support Open Source development? Yes! We want as many developers as possible to help with this project. We use Open Source software and, where possible, have licensed the software that we've developed under the GPL. If you want to contribute to Project Honey Pot, drop us a line and we'll get you involved." Jeff C. -- "If it appears in hams, then don't list it."

1 0

RE: [SURBL-Discuss] In support of Project Honeypot
by Chris Santerre 27 Oct '04

27 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, October 27, 2004 9:18 AM >To: Christopher Albert >Cc: Matthew Prince; SURBL Discussion list >Subject: Re: [SURBL-Discuss] In support of Project Honeypot > > >On Wednesday, October 27, 2004, 5:01:13 AM, Christopher Albert wrote: >> Are you guys serious!? >> Did you look at this page: >> http://www.projecthoneypot.org/bots_and_servers.php >> The ads placed there do not look all that encouraging: > >Those ads come from google. I hardly think google are >spammers. Lots of non-spammer pages have google ads. > >> http://www.expedite-email-marketing.com/index.htm >> http://www.l-i-s-t.com/main_site/opt_in_email_lists.asp >> http://www.classmates.com/cmo/reg/school/index.jsp >> http://www.definitivedatabase.com/ > >Eric Kolve, author of SpamCopURI, works for classmates.com. >Does that mean SpamCopURI is made for spammers? Is there an antispam hall of fame? Eric should be in it ;) (Along with SA devs of course!) *snip* > >I think you misunderstand Project Honeypot. It is as open and >noncommercial as SpamCop. I fully believe that the people doing >it are trying to go after spammers in a potentially very effective >and relatively open way. And they're making a definite effort to >share their data. > >I know some of the people working on this project and I >can tell you they're whitehats. Thanks for clearing this up Jeff. I guess I'll have to get up out of my chair and move my lazy butt to inplement this today :) --Chris (?)

2 1

RE: [SURBL-Discuss] In support of Project Honeypot [Scanned]
by Chris Santerre 27 Oct '04

27 Oct '04

>-----Original Message----- >From: David Thurman [mailto:listonly@webpresencegroup.net] >Sent: Wednesday, October 27, 2004 8:58 AM >To: SURLB Discussions >Subject: Re: [SURBL-Discuss] In support of Project Honeypot [Scanned] > > >On 10/27/04 7:01 AM, "Christopher Albert" wrote: > >> Are you guys serious!? >> Did you look at this page: >> http://www.projecthoneypot.org/bots_and_servers.php >> The ads placed there do not look all that encouraging: >> >> http://www.expedite-email-marketing.com/index.htm >> http://www.l-i-s-t.com/main_site/opt_in_email_lists.asp >> http://www.classmates.com/cmo/reg/school/index.jsp >> http://www.definitivedatabase.com/ >> >> You almost feel that this must be a joke. >> >I saw that also, and wondered a bit about it. Good concerns. >> >> I think you guys are making a mistake by participating. We could do >> this ourselves in a completely open and noncommercial way where the >> information is available in near real time. > >I would be one of the first to join, though we did sign up at >the honeypot >site but now that you bring up your concerns I think I will >hold off for a >bit and see what it really is all about. >-- I also signed up but haven't implemented the code yet. I have to open up a small hole in my security to do it. I haven't decided if I want to do that yet. Mainly because I'm lazy and rather not walk over to the firewall ;) --Chris (My power to misspell is only overshadowed by my lack of stick handling ability)

2 1

In support of Project Honeypot
by Jeff Chan 27 Oct '04

27 Oct '04

Justin Mason mentioned Project Honeypot on the SpamAssassin Users list shortly after they opened things up for public use: On Monday, October 25, 2004, 1:26:55 PM, Justin Mason wrote: > http://www.projecthoneypot.org/ > seems interesting, they plan to share their resulting corpora, and they > seem like nice guys too [...] > --j. I've donated 25 MX records to Project Honeypot so far. It looks like a good project mainly to provide solid data for legal action against spammers, harvesters, zombie deployers, etc. I'd encourage others to do likewise. Project Honeypot will also share their data with us so eventually we may have another good source of spam URI domains for SURBLs. What they need now are more people to donate DNS MX records and put up honeypots on their own sites. (The two aspects are separate; you can do either or both if you like.) Their site offers plenty of good explanations about legal, technical, etc. areas of the project: http://www.projecthoneypot.org So I'd like to encourage more folks to participate. Cheers, Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

5 6

possible blacklist source
by Daniel Quinlan 27 Oct '04

27 Oct '04

Catherine Hampton's SpamBouncer has a zillion blacklisted domains: http://www.spambouncer.org/webdev/downloads/beta.shtml 1. download sb-new.tar.gz 2. mkdir sb; cd sb; tar xfz ../sb-new.tar.gz 3. perl -lne 'print "$1.$2" if /\)([\w-]+?)$.*?$([a-z]{2,4}?)\(/' *.rc \ | sort | uniq -c | sort -nr I suspect Catherine has a list in raw format (for all I know, there are some whitelisted domains somewhere in there). Merging it with WS might make sense. Catherine is probably a bit (*cough*) more aggressive than you. Also, many domains are listed more than once. I'm guessing that they're worse in some way. Or something. ;-) Daniel -- Daniel Quinlan ApacheCon! 13-17 November (3 SpamAssassin http://www.pathname.com/~quinlan/ http://www.apachecon.com/ sessions & more)

4 3

Spamassassin and SpamCopURI
by Frank Tore Johansen 27 Oct '04

27 Oct '04

Hi, I'm in the progress of upgrading SA from 2.63 to 2.64 and SpamCopURI from 0.19 to 0.22. During make test of SA I get these during each t/rule_tests: t/rule_tests................ok 61/62Failed to compile URI SpamAssassin tests, skipping: (syntax error at /etc/mail/spamassassin/local.cf, rule WS_URI_RBL, line 1, near "eval:" syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 1, near "eval:" syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 6, near "} }" I am aware that there was a discussion on the surbl list about this a few months ago, where someone said it could be caused by two Conf.pm's. However, I only have the one in /local/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Conf.pm and the two in the 2.64 distribution: the original ./lib/Mail/SpamAssassin/Conf.pm and the make-generated ./blib/lib/Mail/SpamAssassin/Conf.pm The errors didn't go away after installing SpamCopURI 0.22. I still haven't dared install SA. This is the relevant entry in local.cf: # Domain blacklists uri WS_URI_RBL eval:check_spamcop_uri_rbl('ws.surbl.org','127.0.0.2') describe WS_URI_RBL URI's domain appears in sa-blacklist tflags WS_URI_RBL net score WS_URI_RBL 3.0 And this is from spamcop_uri.cf: uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2') describe SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org tflags SPAMCOP_URI_RBL net score SPAMCOP_URI_RBL 3.0 So, what is causing the test errors? Can I safely ignore them, or will my RBL's stop working if I upgrade? I had hoped for a quick upgrade from 2.63 to 2.64 due to warnings about DOS (and the last few days our mailserver actually went out of memory twice, so it could be that spammers have started actually using this DOS)... -Frank.

3 5

RE: [SURBL-Discuss] Possible False Positive
by Chris Santerre 26 Oct '04

26 Oct '04

Agreed. And Whitelisted. :P >-----Original Message----- >From: Fred [mailto:tech2@i-is.com] >Sent: Tuesday, October 26, 2004 1:10 PM >To: SURBL Discussion list >Subject: [SURBL-Discuss] Possible False Positive > > >cokesbury.com >0 Nanas >Domain registered since 1998 (6 yrs). > >Whois Results for cokesbury.com >Registrant: >United Methodist Publishing House (COKESBURY3-DOM) > 201 8th Ave S > Nashville, TN 37202 > US > Domain Name: COKESBURY.COM > Administrative Contact, Technical Contact: > umph, domains (38034410P) domains(a)umpublishing.org > 201 8th ave. south > Nashville, TN 37202 > US > 615-749-6106 > Record expires on 27-Aug-2006. > Record created on 28-Aug-1998. > Database last updated on 26-Oct-2004 13:00:52 EDT. > Domain servers in listed order: > NS.UMPUBLISHING.ORG 67.106.203.110 > NS1.UMPUBLISHING.ORG 67.106.203.98 > > >Frederic Tarasevicius >Internet Information Services, Inc. >http://www.i-is.com/ >810-794-4400 >mailto:info@i-is.com > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Possible False Positive
by Fred 26 Oct '04

26 Oct '04

cokesbury.com 0 Nanas Domain registered since 1998 (6 yrs). Whois Results for cokesbury.com Registrant: United Methodist Publishing House (COKESBURY3-DOM) 201 8th Ave S Nashville, TN 37202 US Domain Name: COKESBURY.COM Administrative Contact, Technical Contact: umph, domains (38034410P) domains(a)umpublishing.org 201 8th ave. south Nashville, TN 37202 US 615-749-6106 Record expires on 27-Aug-2006. Record created on 28-Aug-1998. Database last updated on 26-Oct-2004 13:00:52 EDT. Domain servers in listed order: NS.UMPUBLISHING.ORG 67.106.203.110 NS1.UMPUBLISHING.ORG 67.106.203.98 Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400 mailto:info@i-is.com

1 0

RE: [SURBL-Discuss] free host: greatnow.com
by Chris Santerre 26 Oct '04

26 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, October 25, 2004 5:01 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] free host: greatnow.com > > >On Monday, October 25, 2004, 1:23:32 PM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>If we're thinking about setting up a blog list (as we were >>>earlier), then it might be useful to test the data before using >>>it, don't you agree? >>> >>>I don't see how dumping lists with arbitrary FPs onto UC helps >>>either UC or SURBLs. In fact it's one of the bad things we >>>predicted: that a grey list would become a dumping ground with >>>some FPs and some domains that belong on a blocklist, all sitting >>>there underclassified, unchecked or ignored. > >> They are NOT going unchecked. UC is still in beta form right >now. So we are >> testing. Most people have no clue where the server is as it >is NOT part of >> SURBL, so UC.SURBL.ORG doesn't work. Not a dumping ground at >all. It will be >> as active as WS. > >> I fully intend to mirror most of what goes into WS into UC. >UC will simply >> have a different policy. Grey domains need to be considered. >UC will do >> that. You said yourself earlier you didn't want to be any >part of a list >> that handled grey domains. That it would waste time. So you >don't have to >> worry about UC. > >> UC will get as much attention to detail as I put into WS. I >just won't >> delete grey domains, like I do now. I will instead list then in UC. > >How about a blog spam SURBL? Or is all blog spam grey? You want a seperate list for blog spammers? Have at it. I'll add what I can to it. --Chris

3 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss