- Discuss - Mailman 3

URL shortener abuse data
by Ron Guerin 21 Dec '09

21 Dec '09

As I've mentioned here before, I write an open source URL shortening service. I also operate one publicly since that was the only way I was ever going to get useful real world data to work with. To look at the code though, you'd think I run an anti-abuse system that also shortens URLs. So goes the Internet I guess. While I have a tiny number of users relative to any URL shortening service you've ever heard of, a couple of thousand people have downloaded the software, and I'm aware of a couple of dozen public installations. Between all the ones that may be out there, we might just produce enough abuse data to make it worth someone's while to use it. As I'm about to do a lot of work on the software in preparation for a new release, I'd like to get anyone's thoughts about the following: 1. Interest: Is anyone interested in using URI abuse data produced by URL shorteners? 2. Ideal way to supply the data: I'd rather supply it to SURBL or some other well-run URI BL for inclusion in an existing URI BL service than operate one for this purpose. I'm looking to use anything that remotely resembles standards for everyone's sake, rather than re-invent the wheel. 3. Trust/Reputation: I've discovered on a couple of occasions that I'd been using on my mail server abuse data from shoddily run operations, and frankly this is much much worse than getting some spam. I don't intend to be Yet Another Irresponsible BL Operator running an absentee automated blocklist data source. Yet, in order to have enough data to be worth sending somewhere, I'm going to need to accept input from my users, both of the service, and of the source code. I plan on doing something similar to Craigslist whereby people can report abuse from the web site and a certain number of complaints will disable the redirection. As for my source code users, I think I need some kind of reputation system. Any thoughts about this would be appreciated. - Ron

2 1

Re: [SURBL-Discuss] [SURBL-Announce] Most Abused TLDs report added
by Kris Deugau 03 Nov '09

03 Nov '09

SURBL Announcement list [READONLY] wrote: > SURBL has added a report of Most Abused TLDs. This is a daily count of > the TLDs most commonly appearing in SURBL data and is an indication of > relative abuse levels. > > http://www.surbl.org/tld-subtotals.head Some interesting numbers, but what might be more interesting is to see the *percentage* of domains in each TLD - .com domains may be highest on the list, but I suspect there are far more .com domains overall as well, and the percentage of abused .net and .info domains is much closer to the .com (possibly higher). -kgd

2 1

I seem to have been blacklisted for a few hours
by Steven W. Orr 15 Oct '09

15 Oct '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Now it seems to be fixed before I could even finish writing the request to be removed from the blacklist. I was in [[SURBL Lookup Result: syslang.net is on SURBL lists: WS Back to SURBL Lookup Page ]] Do I get to find out why I was blacklisted? I'm one of the good guys, but I suppose all the badguys say that too. Seriously, am I entitled to an answer? This is the first time it has happened and I've been running for over 10 years. It's a non-commercial community opt-in mailinglist. There's a wiki with recommendations for local services by the registered members of the list. And I do apologise if this is a frequent question, but I saw no way to get this answer myself. TIA - -- Time flies like the wind. Fruit flies like a banana. Stranger things have .0. happened but none stranger than this. Does your driver's license say Organ ..0 Donor?Black holes are where God divided by zero. Listen to me! We are all- 000 individuals! What if this weren't a hypothetical question? steveo at syslang.net steven orr -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkrXXQ4ACgkQRIVy4fC+NySZmgCfWVLkMCcmcThVE45mpmT742/E uuAAnAp7J7nz4Ze3ZWTDMA8A4ORTvAJH =kBNZ -----END PGP SIGNATURE-----

1 0

What is "1.name" ?
by GRIFFIN Paul 17 Sep '09

17 Sep '09

Hi As you'll probably gather quite quickly, I'm new to this mailing list so please forgive any faux pas's on my part. The company I work for are getting e-mails blocked because they contain a url listed on surbl. Which is fine, except the url it is referencing is "1.name"...?? I thought this was initially some refenence in our software but it appears the name "1.name" is actually blacklisted on surbl (if you type it in Lookup it gives a positive response). There is no DNS reference for this as far as I can see. I am quite likely being stupid here but, can anyone please enlighten me as to how or why this is on the surlbl list...? Thanks Paul **************************************************************** The operating companies affiliated with Atradius N.V. (Atradius Group) conduct insurance, debt collection and information services business through their registered (branch) offices in many countries. For information about the main registration details of Atradius Group offices in your country please visit http://global.atradius.com/general-content/legal/legallist.html IMPORTANT NOTICE. This e-mail, including any and all attachments, is intended for the addressee or its representative only. It is confidential and may be under legal privilege. Any form of unauthorised use, publication, reproduction, copying or disclosure of the content of this e-mail is not permitted. If you are not the intended recipient of this e-mail and its contents, please notify the sender immediately by reply e-mail and delete this e-mail and all its attachments subsequently. Although this e-mail and any attachments are believed to be free of any virus or other defect that might affect any computer system into which it is received and/or opened, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by Atradius Group companies, either jointly or severally, for any loss or damage arising in any way from its use. E-mail received by Atradius Group can be stored for business purposes. ****************************************

2 2

False blacklist for my domain
by Alan Greene 03 Sep '09

03 Sep '09

I just created a new domain, hosted on arvixe, and have never even set up mail on the site. Now, I created a website on the domain and when I tried to send the link to my testers, my email was returned, saying my domain was blacklisted. This is ridiculous. It's a brand new site WITHOUT mail. Now, surbl wants me submit a request to remove it, using an email with my domain, but I DON"T EVEN HAVE AN EMAIL ADDRESS at that domain. Great, thanks for messing with my life, SURBL. Who are you and what gives you the right to do this?

2 1

bit.ly url
by Steven Wetzel 23 Aug '09

23 Aug '09

my bit.ly url on my tweets at Twitter is being flagged as possible spam. How do I correct this? I "looked up" my link http://twitteronlinesystem.com/go.php?offer=dreamcat1&pid=1 on SURBL and it said "Not Blacklisted" OK so what's up?

2 1

Re: [SURBL-Discuss] Other SURBL lists then from surbl.org?
by Eric McClatchie 20 Aug '09

20 Aug '09

I am having emails ending up not delivered whenever a certain domain URL is in the email. When I check surbl.org lists, the domain is NOT blacklisted. What other lists should I be looking at? I also notice when subscribing to this list, the approval email went to spam on gmail! Mac

4 4

Re: [SURBL-Discuss] Notification of Blacklist Status
by Steve Sobol 04 Jul '09

04 Jul '09

Maybe instead of having an attitude, you should understand that you're exposing your organization to a lot of liability by not fixing your problem, if in fact you haven't fixed it yet. If you haven't fixed it yet, you need to stop whining on this mailing list, and go fix it ASAP. If you're avoiding the questions posed to you earlier in this thread, I imagine that you *haven't* fixed anything yet. Break-ins happen. But if you don't fix the damage, you could be opening yourself up for civil damages or criminal charges (I'm not a lawyer, and I am not familiar with Canadian law; I'm assuming things up there work in a similar manner to the way they work in the US). This is *not* a threat. I have no intention of pursuing legal action against you. I'm just stating the cold, hard facts. -- Steve Sobol, Victorville, CA sjsobol(a)JustThe.net

2 3

Notification of Blacklist Status
by Petros Kolyvas 04 Jul '09

04 Jul '09

Dear All, I was notified today via an error message from a mail server that a domain/URL in the e-mail was on a blacklist somewhere. I took the time to check and sure enough our own domain is on that list with the note PH. The problem is that our domain is hosted on a shared web host from what I believe to be a fairly reputable web host here in Montreal (iWeb.com.) We have no ability to control or monitor the servers at a level that would allow us to work on, modify, patch, or make any low- level changes that requested in the "Removal Request." More importantly is why a domain isn't notified upon being blacklisted? (Via the info@... or abuse@.... mailboxes) I can understand the need for immediately blacklisting troublesome domains; with that I have no qualms. However it seems that, in the hope of weeding out false positives like our own, at least a note that the domain is being added to the blacklist would help in some kind of active response - instead of the reactive one where we start receiving cryptic messages from clients' servers indicating something is amiss. That being said, thanks for all your hard work to keep this giant and messy infrastructure as clean as humanly possible. Be well, Petros Kolyvas -- ShiftFocus Media for Arts and Education Phone: 514.667-9778 ext. 231 Fax: 866.850.5451 42 Milner Street Montreal, QC, H4X 2H5

3 14

Re: [SURBL-Discuss] How long does your removal process take?
by Heather Nagey 15 Jun '09

15 Jun '09

Thank you very much for your intervention. I was beginning to despair... Our customers will appreciate being able to get their mail! Regards, Heather On 13 Jun 2009, at 11:00, discuss-request(a)lists.surbl.org wrote: > Your domains are no longer blacklisted. Heather Nagey Customer Services Manager Runtime Revolution Ltd http://www.runrev.com

2 1

Need some help finding the cause of WS listing (solution-devis.com, tranquillitesante.fr)
by Stéphane BERTHELOT 13 Jun '09

13 Jun '09

Hello everyone, Both domains in subject line are managed by one of my customers. They carefully pay attention to send only to optin emails by themselves but they often rent email sending platform services and ask them specifically to only use optin email databases. I'm quite sure one of those platforms didn't respect the rules and both domains are on WS list. I would like if possible to know as much details as possible from the original email triggering the blacklist. They usually use many ESP at the same time for different services that direct to those domains. Those ESP are almost all the time professionnal and do a careful job but it seems this time one didn't. Having many emailings at the same period, getting some details would allow me to make them file a claim (or at least cancel their contracts) with the one that sent UCE with their domains listed and ask delisting with much more knowledge of what happened exactly, making sure it doesn't anymore. Thanks in advance a lot for any help, Regards, Stephane. -- (Logo EmisFr) *Stéphane BERTHELOT* EmisFR /Infogérance, Sécurité et Serveurs, Développements métier et spécifiques/ 10 rue Mazagran, 54000 NANCY, France http://www.emisfr.com Tel/Fax.: +33.3 83 32 25 75

4 7

How long does your removal process take?
by Heather Nagey 13 Jun '09

13 Jun '09

Dear list members, I have completed your removal form, twice, at an interval of several weeks. After waiting some time to see if this would have any effect, I emailed your whitelist address on 9th June. So far, nothing has resulted. I am attempting to get on-rev.com removed from your blacklist since we are a legitimate business, with opt in mail lists, and your listing is preventing our paid up customers receiving mail from us regarding the product they have purchased. I'd appreciate some guidance on the next step, since my actions so far have not produced any results. At a very minimum, I'd like to know why we are on this list, since I cannot see a reason for it, and this domain was only registered by us a few month back. It seemed that the minute we started using it, we encountered this problem. Perhaps someone previous to us was using it for something? Regards, Heather Nagey Customer Services Manager Runtime Revolution Ltd http://www.runrev.com and http://www.on-rev.com

3 2

Re: [SURBL-Discuss] Lookup web page not showing blacklisted urls?
by SM 03 Jun '09

03 Jun '09

At 22:43 02-06-2009, Jeff Chan wrote: >This December 2007 paper "The Great DNS Wall of China" suggests that >Chinese ISPs are (being forced to) distort DNS results for domains >that contain certain strings: David Funk posted a message about a stale configuration causing bogus responses. On the surface, that may explain the behavior. However, it does not explain the malformed packets. We could theorize that the incorrect results are due to some corruption (broken nameserver, etc.). Based on other rough tests I conducted, I don't think so. Regards, -sm

5 10

Re: [SURBL-Discuss] Lookup web page not showing blacklisted urls?
by SM 03 Jun '09

03 Jun '09

At 18:04 02-06-2009, SURBL Role wrote: >The 202.106 servers seem to be giving the right results now: These servers are still giving the wrong results. You may wish to test for flickr.com.multi.surbl.org too. Regards, -sm

2 2

Re: [SURBL-Discuss] Lookup web page not showing blacklisted urls?
by SM 03 Jun '09

03 Jun '09

Hi Raymond, At 14:43 02-06-2009, Raymond Dijkxhoorn wrote: >So able to reproduce this. But its depending what machine you are using, >what reply you get. On some if get random results, on others i get >nxdomain, on this exact same server. I can reproduce the above. I suggest dropping 202.106.182.243 too. Regards, -sm

3 2

Re: [SURBL-Discuss] Lookup web page not showing blacklisted urls?
by SM 03 Jun '09

03 Jun '09

Hi Raymond, At 14:22 02-06-2009, Raymond Dijkxhoorn wrote: >surbl.org nameservers, or multi.surbl.org nameservers? >Two different things. It's one of the multi.surbl.org nameservers. >For the first i dont see issues, for the second, its only rbldnsd servers >so wonder how this could be.... I sent Jeff an email. The behavior looks more like policy enforcement instead of a rbldnsd server issue. Regards, -sm

3 2

Lookup web page not showing blacklisted urls?
by Chip Campbell 02 Jun '09

02 Jun '09

There are sites which return with IP addresses to dns lookups, but which report as "not blacklisted" when I submit them to the lookup web page. For example, % dig +short twitter.com.multi.surbl.org 4.36.66.178 % dig +short test.surbl.org.multi.surbl.org 127.0.0.126 But when I enter twitter.com into http://george.surbl.org/lookup.html, it says "twitter.com is not blacklisted" in a green box. Same for test.surbl.org. What am I missing? Chip C Toronto

5 8

Re: [SURBL-Discuss] Blacklisted for no good reason
by Chris Santerre 18 May '09

18 May '09

> The emails were sent from the band's domain, > mollysrevenge.com, using the commercial newsletter service, FanBridge. > I do not speak for SURBL. FanBridge was listed, not your band domain. You are prbly clean as a whistle. You just chose the wrong partner. > So how am I supposed to deal with this? You complain to Fanbridge, or to the people that blocked you. As said before, SURBL does not block spam anymore then the Better Business Bureau stops you from walking into a Jiffy Lube to get your oil changed. > Fanbridge is a legitimate > business That is not capable of using clean email lists. Proven time and time again. >with thousands of customers. The number of customers has no bearing on this. > I have no idea why you > chose to > blacklist them and I don;t really care, That's a great way to get the antispam community on your side. Tell us you don't care. > all I know is that > legitimate > emails are being intercepted as a result and that's an unacceptable > situation. Yes it is. Its very unacceptable. We don't like spam, and people made a list of people who send spam. Some of us use it. Its not mandatory. > If this happened with USPS mail, you'd be guilty of a > felony. The internet is not ruled by US law. > Catchall solutions to internet spam that result in legitimate emails > being blocked are unacceptable. You got that right! We all understand that. But SURBL is not a catchall. No one is made to use the list. And everyone is clearly told that blocking emails based on the list is prbly not a good idea! But those of us with clean inboxes do, and it works, and we thank SURBL. Good Luck, Chris Santerre

1 0

In response to May 8th "Help!!!' posting
by Peter Haworth 18 May '09

18 May '09

Hear, hear to this post! Emails to my band's legitimate, opted-in mailing list were recently blocked because the newsletter service we use is blacklisted on this site. I can't even mention the name of the service in this email because it then gets rejected by my ISP when I try to send it! This is a ridiculous situation and saying that you are not blocking anything is an unacceptable denial of responsibility. You are providing the means for email to be blocked and recommending ISPs use it so accept your responsibility. What I and anyone else sending out legitimate emails must have is a way for our emails to be delivered and NOT classified as spam. Cavalier approaches to blocking spam which cause havoc to legitimate emails are just not acceptable. > You missed my point. When I tried to send email to the whitelist > address given, it > was rejected. > > All I'm saying is that people should be given an opportunity to > clear their name. > Your system assumes that the blacklisted domain has been sending > advertising and > you want to judge whether it's spam or not. If we don't use the > domain for > advertising, we have no way of complying with your form > requirements. When we > tried to contact you using the alternate method, our email was > rejected by your > servers, because it is on your blacklist. > > I understand that you are not blocking anything, but recommending it > to people who > trust your list results in the same thing. We have to go to each > recipient and ask > that they stop using your list in order to get our mail through. It > would be > better for all concerned, to make it easier to correct the problem > at it's source. > > The present system clogs up the list with things that should be > handled in > private, and results in people having to drop your service in order > to receive > legitimate email. That means the spammers win. > > BTW, How would blacklisting a domain NOT hurt legitimate email from > that domain? > > > > Raymond Dijkxhoorn wrote: > > Hi! > > > >> "We just do not handle delisting requests on the mailinglist. > Thats not > >> what is is here for." > >> > >> That is understood. What is not understood is why it is so hard > to get a delisting > >> request through proper channels, that many have to resort to this > list out of > >> desperation. If we don't have the magic formula to get the site > to accept our > >> request, and our mail is rejected, what are we supposed to do? > >> > >> You call us spammers and slam the door in our face. As bad as > spam is, I think it > >> is worse to interfere with legitimate email and provide no way to > report mistakes. > > > > With every list there will be people saying it will hurt their > legitimate > > mailflow. We do not block anything hoewever. Its every > mailproviders free > > choise to pick a list for filtering mail. > > > > If your delisting request wasnt handled like you expected drop a > not on > > whitelist at surbl.org and we will follow up with you there. > > > > Thanks, > > Raymond. > > _______________________________________________ > > Discuss mailing list > > Discuss at lists.surbl.org > > http://lists.surbl.org/mailman/listinfo/discuss > Pete Haworth http://www.mollysrevenge.com http://www.sonicbids.com/MollysRevenge http://www.myspace.com/mollysrevengeband

8 13

Re: [SURBL-Discuss] Blacklisted for no good reason
by Steve Sobol 17 May '09

17 May '09

Fanbridge doesn't send me anything but spam, and you can google and find their CEO saying "well, just email me and I'll add you to our global suppression list." Well, if they managed their lists better... actually, if they forced their bands to manage the lists better... they wouldn't need to do damage control like that. Your list? I am not questioning that it's clean. If you say it's clean, I'll trust you. Fanbridge, however, was an unfortunate choice... I've tried unsubscribing from a band's email list, just to find that I'm on two others besides the one I just got off of. This has happened more than once. I've NEVER subscribed to ANY email list hosted at Fanbridge. Seriously - go find another ESP. And stop posturing, it only makes you look like a jerk. No one is required to accept mail from Fanbridge, whether you like it or not. Best, Steve - NOT SPEAKING FOR THE SURBL MAINTAINERS. Just speaking on my own behalf. ----- Original Message ----- From: "Peter Haworth" <pete(a)mollysrevenge.com> To: discuss(a)lists.surbl.org Sent: Sunday, May 17, 2009 9:15:05 AM GMT -08:00 US/Canada Pacific Subject: [SURBL-Discuss] Blacklisted for no good reason On Saturday May 16th, we sent out a legitimate newsletter email to our mailing list consisting of people who opted -in and specifically requested to receive newsletters. Some of these emails were classified as spam because of references to either Fanbridge.com or fburls.com. The emails were sent from the band's domain, mollysrevenge.com, using the commercial newsletter service, FanBridge. So how am I supposed to deal with this? Fanbridge is a legitimate business with thousands of customers. I have no idea why you chose to blacklist them and I don;t really care, all I know is that legitimate emails are being intercepted as a result and that's an unacceptable situation. If this happened with USPS mail, you'd be guilty of a felony. Catchall solutions to internet spam that result in legitimate emails being blocked are unacceptable. Pete Haworth http://www.mollysrevenge.com http://www.sonicbids.com/MollysRevenge http://www.myspace.com/mollysrevengeband _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss -- Steve Sobol, Victorville, CA, USA sjsobol(a)justthe.net

1 0

Blacklisted for no good reason
by Peter Haworth 17 May '09

17 May '09

On Saturday May 16th, we sent out a legitimate newsletter email to our mailing list consisting of people who opted -in and specifically requested to receive newsletters. Some of these emails were classified as spam because of references to either Fanbridge.com or fburls.com. The emails were sent from the band's domain, mollysrevenge.com, using the commercial newsletter service, FanBridge. So how am I supposed to deal with this? Fanbridge is a legitimate business with thousands of customers. I have no idea why you chose to blacklist them and I don;t really care, all I know is that legitimate emails are being intercepted as a result and that's an unacceptable situation. If this happened with USPS mail, you'd be guilty of a felony. Catchall solutions to internet spam that result in legitimate emails being blocked are unacceptable. Pete Haworth http://www.mollysrevenge.com http://www.sonicbids.com/MollysRevenge http://www.myspace.com/mollysrevengeband

2 1

Requesting Removal from List
by Steve Carrea 15 May '09

15 May '09

Good Evening, I am writing in hopes that someone can help me resolve this urgent issue. I am writing on behalf of NYC area rock band Almost One, whos URL is blocked by your website and I need it removed from the list immediately. There's no reason why it should be on it since the band only sends out solicited messages. I hope to hear from someone soon. I did try entering the URL in the lookup field and it returns a message that it is not blacklisted, yet this is the error we get when sending out emails: ---- Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 552 552 5.2.0 Remote MTA 209.85.222.115: An URL contained in this message is blacklisted by SURBL. See http://www.surbl.org (state 18). ---- Thanks in advance for your help. _________________________ A NYC Indie Rock & Roll Band http://www.almostone.com

5 4

Help!!!!!!!!!!!
by James 08 May '09

08 May '09

keepitoffforlife.com is black listed. We have never sent an email from this site. The site just came live only about six weeks ago. To remove ourselves from the blacklist we must show our typical message headers REQUIRED. We have no advertising for this site yet, so I have no headers. So, am I being asked to lie and make something up? This feels like catch 22. Any assistance would be greatly appreciated. Very frustrating, my software engineer who is building the site cannot even reference the site in his emails to me without getting them bounced. Best Regards, James Schmidt james.schmidt(a)netzero.net

9 21

Mailing list gets bounces from my mail provider because of surbl
by Daniel Dickinson 17 Apr '09

17 Apr '09

Hi, My ISP (www.bmts.com - Bruce Telecom, reachable at tech(a)brucetelecom.com) uses surbl to detect and block SPAM, however the debian mailing lists do not and this results in bounces of mail sent to the debian mailing lists and through it to me through my provider. This is bad because the debian mailing lists unsubscribe users who have too many bounces. My ISP tells me to contact you to get the offending site removed, however I don't object to the site blacklisted, but to the listz.debian.org mail bouncing. I asked them to whitelist it but they just reiterated that I had to contact you. I think they are wrong and not understand. Could someone kindly beat the over the head with instruction on how to whitelist listz.debian.org so that it is not blocked even if a surbl blacklisted URL is in the mail? The address of their tech support is tech(a)brucetelecom.com Please CC me if this is a busy list as I may then not see the message. Regards, Daniel -- And that's my crabbing done for the day. Got it out of the way early, now I have the rest of the afternoon to sniff fragrant tea-roses or strangle cute bunnies or something. -- Michael Devore GnuPG Key Fingerprint 86 F5 81 A5 D4 2E 1F 1C http://gnupg.org The C Shore (Daniel Dickinson's Website) http://cshore.is-a-geek.com

6 9

Integrating twi.bz URL shortener and SURBL
by John Graham-Cumming 15 Apr '09

15 Apr '09

Folks, You've probably not heard of my URL shortener service http://twi.bz/ because it is very new, but I wanted to appeal to the SURBL folks to accept twi.bzdomain names within the SURBL lists. twi.bz is differently from the standard URL shorteners in that it includes the domain name of the destination site in the twi.bz domain name. For example, a twi.bz link to amazon.com would be in the form: amazon.twi.bz/XYZ. A twi.bz link to amazon.ca would be in the form amazon.ca.twi.bz/XYZ and a twi.bz link to amazon.co.uk would be in the form amazon.co.uk.twi.bz/XYZ. For .com domains I strip the .com for all the rest I leave the TLD in place. Since this is in the domain name it should be easy for them to appear in the SURBL list. On my side I'll be using SURBL multi on domains submitted to the service to check for spam. I'm hoping that the visibility in twi.bz domains, they're ability to appear in SURBL and my checking of SURBL links will make twi.bzunattractive for spammers. John.

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss