- Discuss - Mailman 3

Request for Whitelist
by Bitz 23 Sep '04

23 Sep '04

epromos . com listed at ws.surbl.org We have customers who conduct business with these folks, I googled and didn't find any spam related proof against them. Thanks, -b

2 2

JPEG flaw in Windows - URLs in emails
by Matthew Wilson 23 Sep '04

23 Sep '04

Since proof-of-concept code for the JPEG flaw in Windows has been posted online, we can surely expect at least one mass mailing exploit soon. The form will likely take the form of either: 1) A JPEG file embedded in an email message with the exploit code embedded in the embedded image. Theoretically, the exploit pattern should already be known, no matter what the encoding is, so anti-virus companies should theoretically be able to detect this already, if this method is used. 2) Because of the above, the more likely method seems to be the embedding of a URL in the message that either refers to the actual JPEG itself or refers to a webpage that loads the infected JPEG. It seems then that the only tool that could detect worms of this sort would be SURBL. And so on to my question: if I (or anyone else for that matter) submit a domain name that hosts an infected JPEG file, how quickly will the SURBL databases be updated to reflect this infection? Also, what if the exploit is multi-stage, and tries to infect actual http servers with infected JPEGs, and thousands of websites become infected...? Would it then be necessary to create a separate SURBL list for these infected domains, or could they be listed in, say, the phishing list? Thanks, Matthew Wilson

5 4

RE: [SURBL-Discuss] JPEG flaw in Windows - URLs in emails
by Chris Santerre 22 Sep '04

22 Sep '04

>-----Original Message----- >From: Matthew Wilson [mailto:matthew@boomer.com] >Sent: Wednesday, September 22, 2004 11:33 AM >To: SURBL Discussion list >Subject: [SURBL-Discuss] JPEG flaw in Windows - URLs in emails > > >Since proof-of-concept code for the JPEG flaw in Windows has >been posted >online, we can surely expect at least one mass mailing exploit soon. >The form will likely take the form of either: > >1) A JPEG file embedded in an email message with the exploit code >embedded in the embedded image. Theoretically, the exploit pattern >should already be known, no matter what the encoding is, so anti-virus >companies should theoretically be able to detect this already, if this >method is used. > >2) Because of the above, the more likely method seems to be the >embedding of a URL in the message that either refers to the actual JPEG >itself or refers to a webpage that loads the infected JPEG. It seems >then that the only tool that could detect worms of this sort would be >SURBL. > >And so on to my question: if I (or anyone else for that >matter) submit a >domain name that hosts an infected JPEG file, how quickly will >the SURBL >databases be updated to reflect this infection? > >Also, what if the exploit is multi-stage, and tries to infect actual >http servers with infected JPEGs, and thousands of websites become >infected...? Would it then be necessary to create a separate >SURBL list >for these infected domains, or could they be listed in, say, the >phishing list? > >Thanks, >Matthew Wilson > Well here are some random thoughts in no order: 1) I'm not getting web submissions right now. Something is FUBAR there. 2) Perhaps we can work something out with a third party to maintain virus type links like this? I'll email Jeff Off List as I have some other questions there. 3) Ehhh....I think Jeff is going to say something along the lines of "SURBL wasn't intended to be used like that." To which I agree, yet sadly SURBL is the tool to catch these. --Chris

2 1

RE: [SURBL-Discuss] RFC: pj.surbl.org - list from Joe Wein and Pr olocation data
by Chris Santerre 21 Sep '04

21 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, September 16, 2004 7:01 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] RFC: pj.surbl.org - list from Joe Wein and >Prolocation data > > >On Wednesday, September 15, 2004, 7:06:34 PM, David Hooton wrote: >> On Wed, 15 Sep 2004 16:43:32 -0700, Jeff Chan ><jeffc(a)surbl.org> wrote: >>> we thought it might be useful to make the PJ data available as >>> a separate list, at least within multi.surbl.org, the combined >>> SURBL. We'd like to get your comments on this. > >> I think having a separate list makes sense if the data quality is >> different to that of the pooled data it was previously connected to. > >>> We're also wondering whether the PJ data should be taken out of >>> WS, or left in, if we do make PJ a distinct list. > >> No point in lowering the hitrate of the superset, any >additional score >> added to a spam is better than none at all. > >>> Please comment, > >> The greater choice and control we provide SURBL users the better. If >> we have the ability to sustainably break data out like this and >> provide ongoing data quality ratings to aid score adjustments I think >> we should do it. > >Thanks for your feedback David. Does anyone else have comments >about the possibility of PJ? Making separate lists from the WS >data is a little different from the direction we've been going >lately, so it would be nice to get comments on it. We're still >somewhat undecided about whether to do it or not.... > >As you can see from the first message about this, the FP rates >of PJ look significantly lower than WS as a whole. AS usual, I'm thinking different from everyone else :) I do NOT like the idea of more lists. 1) The lists are dynamic, so FP rates will change. 2) Too many lists make it more difficult for the devs to GA and perceptron run all of them. Causing a slow down in scoring for SA and others. 3) Run a diff and find out where we have our FPs. 4) More lookups for mutli 5) Too many list options will drive some potential users away. 6) K.I.S.S. The only reason I see having more lists is if the data is specifically different throughout the whole list. ie: phishing, UC, regular spam, blog, ect.... His list data is the same kind as WS. So really....why seperate? We just keep getting our FP rate lower and it will all be good. --Chris (The devils advocate.)

6 19

Problems installing SpamCopURI-0.22
by Overdijk, Harrie 20 Sep '04

20 Sep '04

Dear SURBL Guru's, I'm still using the latest small-version of the BigEvil.cf custom rule for SpamAssassin. Because I would like to use the several SURBL 'lists' I would like to install Mail-SpamAssassin-SpamCopURI-0.22 on a - RedHat 7.3 system with - perl 5.6.1, - amavisd-new-20030616.p10 and - SpamAssassin 2.64 I already upgraded the system with perl-URI-1.32 because the previous version was way too low. However Make test fails with: # make test PERL_DL_NONLAZY=1 /usr/bin/perl -Iblib/arch -Iblib/lib -I/usr/lib/perl5/5.6.1/i386-linux -I/usr/lib/perl5/5.6.1 -e 'use Test::Harness qw(&runtests $verbose); $verbose=0; runtests @ARGV;' t/*.t t/blacklist.........Can't locate Test/More.pm in @INC ... BEGIN failed--compilation aborted at t/blacklist.t line 3. t/blacklist.........dubious Test returned status 2 (wstat 512, 0x200) t/dnsrbl............Can't locate Test/More.pm ... etc ending in: BEGIN failed--compilation aborted at t/whitelist.t line 3. t/whitelist.........dubious Test returned status 2 (wstat 512, 0x200) FAILED--7 test scripts could be run, alas--no output ever seen make: *** [test_dynamic] Error 2 If I use a 'binary' ;-) RPM package I get the error: # rpm -ivh perl-Mail-SpamAssassin-SpamCopURI-0.22-1.noarch.rpm Preparing... ########################################### [100%] file /usr/share/man/man3/Mail::SpamAssassin::Conf.3pm.gz from install of perl-Mail-SpamAssassin-SpamCopURI-0.22-1 conflicts with file from package perl-Mail-SpamAssassin-2.64-1 file /usr/share/man/man3/Mail::SpamAssassin::PerMsgStatus.3pm.gz from install of perl-Mail-SpamAssassin-SpamCopURI-0.22-1 conflicts with file from package perl-Mail-SpamAssassin-2.64-1 Boy, duplicate manpages... What am I doing wrong? Do I need extra perl-modules or better version to get it to install? How can I get it to run? Thanks for your help. Cheers, Harrie Harrie Overdijk, ECN, Postbox 1, 1755 ZG Petten (NH), The Netherlands. Internet: overdijk(a)ecn.nl Noisenet: +31 224 56 4597 Homenet : h.overdijk(a)hccnet.nl FAXnet : +31 224 56 8864 ICP/Postmaster/UseNet-News-manager/WWW-manager/Security-manager of ECN.

2 1

RE: [SURBL-Discuss] Funniest domain so far?
by Chris Santerre 20 Sep '04

20 Sep '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Friday, September 17, 2004 3:03 PM >To: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] Funniest domain so far? > > >on Fri, Sep 17, 2004 at 11:42:29AM -0400, Chris Santerre wrote: >> scabpickingisfun.com >> >> Can you top that? > >I love a challenge. :) > *snip* OMG! I bow down to that list! LOL. sharkswithfrickinlaserbeams.net That is priceless!!! :-) --Chris

1 0

Chinese translation help for anti-spam effort
by Jeff Chan 20 Sep '04

20 Sep '04

We've gotten a couple documents form the Internet Society of China www.isc.org.cn relating to email delivery and I'd like to request some help in translating them: http://www.surbl.org/isc1.doc http://www.surbl.org/isc1.doc The documents are some proposed email delivery standards called "Public Email Service Critereon" and a list of participating Chinese ISPs. (I changed the file names from the original non-English characters.) This contact came about as a result of my meeting the Secretariat of the ISC, Liu Liang, at the CEAS conference. We're also trying to get a copy of a Memorandum of Understanding between some Chinese ISPs and Internet companies like AOL Time Warner, Microsoft, eBay, Yahoo, dealing with the handling of spam and abuse. http://yahoo.businessweek.com/bwdaily/dnflash/sep2004/nf20040914_6178_db065… That MoU was a result of a September ISC meeting 2004 China Internet Conference which included a 2004 International Anti-Spam Summit. While spam obviously remains a problem worldwide, I'm hopeful that some improved cooperation and communication with China to deal with spam and abuse may happen, as facilitated by ISC. In particular, we hope that any precedents created for cooperation between the MoU parties can be expanded to other anti-abuse organizations such as Spamhaus and SpamCop. Spamhaus already has some contacts with ISC, but missed this recent conference. If you can help translate these Chinese documents or know anyone who may be able to, please let me know. Thanks, Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Additional PJ info
by Jeff Chan 19 Sep '04

19 Sep '04

Here's some additional info about the PJ data. Raymond is now processing about 300k spams per day and feeding them to Joe Wein for processing. This has increased the spam detection for PJ: SpamAssassin tag hits: (top 100) #1 103430 URIBL_WS_SURBL #2 101346 URIBL_PJ_SURBL #3 91324 BAYES_99 #4 90939 URIBL_SBL #5 85476 RCVD_IN_BL_SPAMCOP_NET #6 85092 URIBL_OB_SURBL #7 81798 HTML_MESSAGE #8 67027 URIBL_SC_SURBL #9 56416 URIBL_AB_SURBL #10 48047 MIME_HTML_ONLY Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

5 7

Additional phish/fraud list
by Bill Landry 19 Sep '04

19 Sep '04

This is a list that MailPolice hosts and I have been running it for a few hours and it has already flagged some phish and fraud e-mails. Here is some info about the list: http://rhs.mailpolice.com/#rhsfraud This is my configuration for SA 2.64 with the SpamCopURI plug-in: uri MP_URI_RBL eval:check_spamcop_uri_rbl('fraud.rhs.mailpolice.com','127.0.0.2') describe MP_URI_RBL URI's domain appears in MailPolice fraud list tflags MP_URI_RBL net score MP_URI_RBL 2.0 And for SA 3.0 with the URIDNSBL plug-in: urirhsbl URIBL_MP fraud.rhs.mailpolice.com. A header URIBL_MP eval:check_uridnsbl('URIBL_MP') describe URIBL_MP URI's domain appears in MailPolice fraud list tflags URIBL_MP net score URIBL_MP 2.0 Bill

5 28

WS FPs: e-gold.com, home.ro
by Jeff Chan 19 Sep '04

19 Sep '04

Speaking of which, why are e-gold.com and home.ro on WS? These look like obvious FPs to me. How did they get on? Jeff C.

2 4

RFC: pj.surbl.org - list from Joe Wein and Prolocation data
by Jeff Chan 19 Sep '04

19 Sep '04

As you know WS has data from several different sources: 1. Bill Stearns' sa-blacklist 2. Chris Santerre and the SARE Ninja's former BigEvil, MidEvil and other new ones. 3. Joe Wein's jwSpamSpy traps 4. Raymond's Prolocation traps and manual list. 5. MailSecurity lists and probably many others I'm not even aware of. So WS has become a collection of many different data sources. In some cases, such as for the jw data, my initial thought was to set it up as a separate list, but it was somewhat easier to let them all be added together. Raymond is currently feeding spamtrap data into Joe's system also. Raymond and I were looking at some of the data sources in WS and their spam detection and false positive rates, and we tried an experiment of checking his Prolocation spam data with Joe Wein's to see what the results would be like. We called that list "PJ" for "Prolocation and Joe" and found that the FP rate on one large corpus was significantly lower than WS, while the spam detection rate was approximately the same: OVERALL% SPAM% HAM% S/O RANK SCORE NAME 2424443 2357143 67300 0.972 0.00 0.00 (all messages) 100.000 97.2241 2.7759 0.972 0.00 0.00 (all messages as %) 7.595 7.8122 0.0045 0.999 1.00 0.00 URIBL_SC_SURBL 76.754 78.9448 0.0178 1.000 0.80 0.00 URIBL_OB_SURBL 77.230 79.4340 0.0208 1.000 0.60 1.00 URIBL_PJ_SURBL 0.985 1.0126 0.0045 0.996 0.50 0.00 URIBL_AB_SURBL 82.119 84.4600 0.1367 0.998 0.40 0.00 URIBL_WS_SURBL 0.021 0.0216 0.0045 0.829 0.00 0.00 URIBL_PH_SURBL (We removed FPs from both PJ and WS as a result of some of this testing, so both should score relatively better now in terms of FPs. The spam hit rates on SC and AB are low because this spam corpus includes many old spams with URIs which would have rolled off these lists. A test only on more recent days would show much higher spam hit rates for SC and AB.) In Raymond's own test of only spam hits, a later version of PJ got higher detection rates than WS: SpamAssassin tag hits: (edited to top 10) #1 108958 BAYES_99 #2 87001 URIBL_SBL #3 84709 URIBL_PJ_SURBL #4 81455 HTML_MESSAGE #5 78177 RCVD_IN_BL_SPAMCOP_NET #6 75546 URIBL_OB_SURBL #7 74892 URIBL_WS_SURBL #8 64610 URIBL_SC_SURBL #9 58190 URIBL_AB_SURBL #10 54230 MIME_HTML_ONLY Since WS has relatively low scores in SA 3, presumably due to the relatively high FP rate: > On Thu, Sep 02, 2004 at 08:09:17PM -0700, Jeff Chan wrote: >> score URIBL_AB_SURBL 0 2.007 0 0.417 >> score URIBL_OB_SURBL 0 1.996 0 3.213 >> score URIBL_PH_SURBL 0 0.839 0 2.000 >> score URIBL_SC_SURBL 0 3.897 0 4.263 >> score URIBL_WS_SURBL 0 0.539 0 1.462 >> >> So what do the columns above mean? (Theo replied:) > $ perldoc Mail::SpamAssassin::Conf > [...] > If four valid scores are listed, then the score that is used > depends on how SpamAssassin is being used. The first score is used > when both Bayes and network tests are disabled (score set 0). The > second score is used when Bayes is disabled, but network tests are > enabled (score set 1). The third score is used when Bayes is > enabled and network tests are disabled (score set 2). The fourth > score is used when Bayes is enabled and network tests are enabled > (score set 3). we thought it might be useful to make the PJ data available as a separate list, at least within multi.surbl.org, the combined SURBL. We'd like to get your comments on this. We're also wondering whether the PJ data should be taken out of WS, or left in, if we do make PJ a distinct list. There's not much downside in leaving PJ in WS, aside from a somewhat larger standalone WS list. On the other hand all of our lists are currently standalone and not deliberate subsets in terms of data sources. But I assume most people will use multi, for which the difference is small either way. By the way, please don't use PJ for production data yet, unless you are rsyncing the zone files, in which case you can mirror PJ locally now from the rsync servers for testing purposes if you like. PJ's only being served up on a couple public servers for our testing; we don't want to overload those servers. PJ is not in multi currently. Note that PJ is only a test list now. It may go away. Please comment, Jeff C.

3 4

OT: For Dallas...
by Alex Broens 18 Sep '04

18 Sep '04

Would appreciate if Dallas would allow me to mail him directly... Apologize for the noise. No other way to contact Dallas. Thanks Alex ----------------- Sat 2004-09-18 21:30:38: From: alexb(a)MUNGED.CH Sat 2004-09-18 21:30:38: To: dallase(a)nmgiMUNGED.com Sat 2004-09-18 21:30:38: Subject: DoubleCheck Sat 2004-09-18 21:30:38: Message-ID: <6.1.0.6.2.20040918212951.0268d918(a)inet.alexb.ch> Sat 2004-09-18 21:30:38: MX-record resolution of [nmgi.com] in progress (DNS Server: 192.168.192.6)... Sat 2004-09-18 21:30:39: P=010 D=nmgi.com TTL=(60) MX=[mail2.nmgi.com] {209.218.125.110} Sat 2004-09-18 21:30:39: P=005 D=nmgi.com TTL=(60) MX=[mail1.nmgi.com] {67.67.32.200} Sat 2004-09-18 21:30:39: Attempting MX: P=005 D=nmgi.com TTL=(60) MX=[mail1.nmgi.com] {67.67.32.200} Sat 2004-09-18 21:30:39: Attempting SMTP connection to [67.67.32.200 : 25] Sat 2004-09-18 21:30:39: Waiting for socket connection... Sat 2004-09-18 21:30:39: Socket connection established (192.168.192.6 : 3407 -> 67.67.32.200 : 25) Sat 2004-09-18 21:30:39: Waiting for protocol initiation... Sat 2004-09-18 21:30:40: <-- 220 mailgw.nmgi.com ESMTP Sat 2004-09-18 21:30:40: --> EHLO alexb.ch Sat 2004-09-18 21:30:40: <-- 250-DoubleCheck Supports Sat 2004-09-18 21:30:40: <-- 250-PIPELINING Sat 2004-09-18 21:30:40: <-- 250-8BITMIME Sat 2004-09-18 21:30:40: <-- 250 AUTH LOGIN PLAIN Sat 2004-09-18 21:30:40: --> MAIL From:<alexb(a)MUNGED.CH> Sat 2004-09-18 21:30:40: <-- 250 ok Sat 2004-09-18 21:30:40: --> RCPT To:<dallase(a)nmgi.MUNGEDcom> Sat 2004-09-18 21:30:40: <-- 554 sorry, your envelope sender is in my badmailfrom list (#5.7.1) Sat 2004-09-18 21:30:40: SMTP session terminated (Bytes in/out: 181/72) Sat 2004-09-18 21:30:40: ----------

1 0

Re: Additional URIBL phish/fraud list
by Jeff Chan 18 Sep '04

18 Sep '04

On Friday, September 17, 2004, 4:24:37 PM, Bill Landry wrote: > This is a list that MailPolice hosts and I have been running it for a few > hours and it has already flagged some phish and fraud e-mails. Here is some > info about the list: http://rhs.mailpolice.com/#rhsfraud > This is my configuration for SA 2.64 with the SpamCopURI plug-in: > uri MP_URI_RBL > eval:check_spamcop_uri_rbl('fraud.rhs.mailpolice.com','127.0.0.2') > describe MP_URI_RBL URI's domain appears in MailPolice fraud list > tflags MP_URI_RBL net > score MP_URI_RBL 2.0 > And for SA 3.0 with the URIDNSBL plug-in: > urirhsbl URIBL_MP fraud.rhs.mailpolice.com. A > header URIBL_MP eval:check_uridnsbl('URIBL_MP') > describe URIBL_MP URI's domain appears in MailPolice fraud list > tflags URIBL_MP net > score URIBL_MP 2.0 > Bill Thanks for finding that additional phishing data Bill! It may be worth noting that we're working on including these into PH inside multi.surbl.org, and that we have 15 times more name servers than mailpolice.com does. ;-) Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Whitelist catholicexchangeMUNGED.com
by Fred 18 Sep '04

18 Sep '04

I have a customer who keeps tripping catholicexchangeMUNGED.com Can we get this removed from WS SURBL? Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400 mailto:info@i-is.com

4 5

Funniest domain so far?
by Chris Santerre 17 Sep '04

17 Sep '04

scabpickingisfun.com Can you top that? --Chris

2 1

Pls check: paypal
by Alex Broens 17 Sep '04

17 Sep '04

Jeff & Co. Just scored this a while ago. * 3.0 WS_URI_RBL URI's domain appears in ws database at ws.surbl.org * [www.paypal.com [in URI RBL at multi.surbl.org] In the original msg there's a a weird charachter after the .com which I cannot explain. maybe a space? could you pls check where this may be showing up (no in my local zone :) thanks Alex

2 1

RE: [SURBL-Discuss] Pls check: paypal
by Chris Santerre 17 Sep '04

17 Sep '04

Only one I have is this: www1-paypalSUPERMUNGEDFORYOURPROTECTION.com Sorry :) www1-paypal.com >-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Friday, September 17, 2004 10:22 AM >To: SURBL Discussion list >Subject: [SURBL-Discuss] Pls check: paypal > > >Jeff & Co. > >Just scored this a while ago. > > * 3.0 WS_URI_RBL URI's domain appears in ws database >at ws.surbl.org > * [www.paypal.com [in URI RBL at multi.surbl.org] > >In the original msg there's a a weird charachter after the >.com which I >cannot explain. > >maybe a space? > >could you pls check where this may be showing up (no in my >local zone :) > >thanks > >Alex > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Watchit :)
by Alex Broens 17 Sep '04

17 Sep '04

Jeff, FYI: a spam with a link to http://www.cabdriver.kjcjvjv.com.com/ just showed up. Obviously dumbo spammy goofed up... as we obviosuly won't want to SURBLize com.com (cnet) and this may be reported by some spamtrapping system it may be a good idea to check if com.com is whitelisted. thanks Alex

2 1

intercompras.com.gt
by Jeff Chan 17 Sep '04

17 Sep '04

Is anyone familiar with intercompras.com.gt? It's in Guatemala, and appeared recently in the SC data. Can't tell if it's an ISP or something like that. Jeff C.

3 4

RE: [SURBL-Discuss] [OT] FUN: Something to send your family membe rs!
by Chris Santerre 16 Sep '04

16 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, September 15, 2004 5:12 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] [OT] FUN: Something to send your family >members! > > >On Wednesday, September 15, 2004, 11:51:55 AM, Raymond >Dijkxhoorn wrote: >>>> So for anyone who knows what I'm talking about on this >page, feel free to >>>> spam it to all your friends and family! ;) > >>> Wouldn't it be added to SURBL then? :) > >> Some sites have the luck to be whitelisted, this is one of them ;) > >It's all random, you know. ;-) We use a the Monte Carlo method >with an old dartboard full of domain names to decide what to >whitelist. ;-) Crap!! We really need to standardize. I've been throwing chicken bones and reading tea to whitelist! --Chris

1 0

Re: [SURBL-Discuss] [OT] FUN: Something to send your family members!
by SM 16 Sep '04

16 Sep '04

Hi Chris, At 09:14 15-09-2004, Chris Santerre wrote: >So for anyone who knows what I'm talking about on this page, feel free to >spam it to all your friends and family! ;) Wouldn't it be added to SURBL then? :) Regards, -sm

4 4

RE: [SURBL-Discuss] important reduce wrise renkles & skin spots ( fwd)
by Chris Santerre 15 Sep '04

15 Sep '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Friday, September 10, 2004 8:48 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] important reduce wrise renkles & skin spots >(fwd) > > >Hi! > >Our favorite pill spammers also try to get around SURBL now. > >I dont want to end up making SA rulesets for this, any suggestions ? > >ns3.airmaramba.biz >ns3.avk29.biz > >The same crap... But, with less SA hits now, since its not touched by >SURBL. Bah. > >---------- Forwarded message ---------- >Date: Sat, 11 Sep 2004 01:50:29 +0100 >From: kenneth clakley <auroraschorn(a)rfc.every1.net> >To: wilfredo moote <reyes(a)prolocation.net> >Subject: important reduce wrise renkles & skin spots > >suc-oneonta sony-steo lettery > > >>From inside to outside, from w^eig_ht l`o^ss to skin care. From mental >relief to physical relief, from antidepressant to muscle >relaxant. The care >inside out. > >you can copy > >wjq.s.adjuster6370pinn.com/56/ > >to your browser > Not all of these are listed in SURBL: (Yes one day I hope to make this info availible to you.) * 1: abrasions6681tabs.biz * 2: absentia4304drug.biz * 3: abstention2386tads.us * 4: accordance3414drugs.biz * 5: addable8060biz.com * 6: adorer457dryg.com * 7: agronomy9603dryg.com * 8: aground8965drugs.biz * 9: agues346rneds.us * 10: aider8333tads.com * 11: alighted2110tads.us * 12: alitalia9689pi11.us * 13: amateurish8859rx.us * 14: anaerobe9918tabs.us * 15: annularity789drugs.biz * 16: antioch8386drygs.us * 17: apercus9591dryg.us * 18: aperiodic1001pill.biz * 19: appetite352tads.us * 20: arc4679biz.biz * 21: armenian5748drug.biz * 22: armenian8291drygs.com * 23: arteriole1448drygs.us * 24: articular9420tabs.biz * 25: aspirated8343pi11.us * 26: assemblies7268biz.us * 27: assumpsit9521drygs.us * 28: astf2571pills.us * 29: attendee9327tads.us * 30: authorise5969rneds.us * 31: avk29.biz * 32: axing5875pi11s.us * 33: aye3054biz.us * 34: bedtime7591rx.us * 35: benzene4347drug.us * 36: benzine6086dryg.com * 37: bier3709pi11.biz * 38: bleach2839drugs.us * 39: breakup9732pi11.us * 40: bream1462rneds.us * 41: bridegroom6963rx.us * 42: brimming6028pill.biz * 43: bumble2318pills.biz * 44: burnie5422pinn.com * 45: caraway307biz.us * 46: carp6499pi11s.us * 47: caw5709biz.us * 48: cctv6483tabs.biz * 49: centralism3766rx.us * 50: charlatan9181rneds.us * 51: chopsticks4847tabs.biz * 52: cleat7228pirrs.com * 53: closed6129tads.us * 54: cobra133pirrs.com * 55: cog5687tads.us * 56: collocutor9120dryg.com * 57: comparable6635tads.com * 58: concinnity6196pi11s.us * 59: congener1455rneds.com * 60: copenhagen1026tabs.us * 61: crane7149biz.biz * 62: crucify8156pi11.us * 63: cyrconium8981biz.us * 64: dale1949pi11.us * 65: dayak3409tabs.biz * 66: decatur9854rx.us * 67: dehydrated8623meds.us * 68: destitute6182drygs.com * 69: dewlap752drygs.com * 70: dhl7809tads.com * 71: digestion5594rneds.us * 72: digital9420rx.biz * 73: directory1403rx.biz * 74: disjoint5156drygs.com * 75: docket9430pi11.us * 76: duodenum1797nx.com * 77: duodenum6414biz.us * 78: earwax8995rneds.com * 79: embody6740tabs.biz * 80: emerge2198dryg.com * 81: enactment859drygs.us * 82: enriched3735pi11.us * 83: entail2096drygs.us * 84: epitheory4065dryg.com * 85: ergo2905drygs.us * 86: fabricate2671rneds.us * 87: faire4813rneds.com * 88: farcical3545rneds.us * 89: fatality5443drugs.com * 90: fateful3948pill.us * 91: feminine2966biz.us * 92: ferryboat4957meds.biz * 93: fie9819meds.biz * 94: fitful1499tads.us * 95: flank4240biz.us * 96: flatfoot8255tabs.us * 97: flew7838tads.com * 98: flimsiness4164dryg.us * 99: fortress221drug.biz * 100: fox621dryg.us * 101: frankly8033pi11s.us * 102: fraudulent4567pill.us * 103: glassy5030nx.com * 104: gratuitous4973meds.us * 105: griffith4438biz.us * 106: grin7749pi11.us * 107: guano7904pills.us * 108: gui7176biz.com * 109: haphazard8933tads.us * 110: hard8589meds.us * 111: harmonious682pi11s.us * 112: healing7489biz.com * 113: heartbreak7918rneds.biz * 114: hits359pills.biz * 115: hopefully3701rneds.us * 116: humpback726pirrs.com * 117: hyaena988drygs.us * 118: identifier618pi11.us * 119: imbed3506pinn.com * 120: impede276tads.us * 121: indenting1562pill.com * 122: indoor954pill.biz * 123: inequality2661pi11s.us * 124: infinitive6385biz.us * 125: inflect5194drygs.us * 126: insure3484biz.us * 127: integrated7310tads.us * 128: involute6538drygs.us * 129: issued5633drug.biz * 130: jell8297drugs.us * 131: joliet5195biz.com * 132: kathy8786pi11.us * 133: katzner3273biz.us * 134: kick6502pi11.us * 135: killing8335biz.us * 136: knowingly606meds.us * 137: lawful7322dryg.us * 138: laxative5682dryg.us * 139: laziness6976dryg.com * 140: leaden9828biz.us * 141: lessee7050tabs.biz * 142: lettish3429pill.us * 143: liaison6083tabs.biz * 144: limped6950pill.us * 145: lotus9106rneds.com * 146: luxuriate7999tads.us * 147: madder8828biz.us * 148: magenta4358rx.us * 149: med12now.com * 150: mediate3804rx.us * 151: medic7.com * 152: medspro7.com * 153: microcode3252meds.biz * 154: milan1517biz.com * 155: mirroring5831dryg.us * 156: mis6163pi11s.us * 157: misogynist2527dryg.biz * 158: moisten982rx.us * 159: monitor8072pill.biz * 160: narrowly1946biz.us * 161: narrowly9558pi11.us * 162: negater6398tads.com * 163: nevermore8513pi11.us * 164: newmedsgo.com * 165: nude7755pi11s.us * 166: obscuring7328drygs.biz * 167: odometer3845meds.us * 168: oleaginous9337meds.us * 169: onyx810dryg.us * 170: optimize5129drug.com * 171: oscillator9247biz.com * 172: osprey9824drug.us * 173: outgoing9256pi11s.us * 174: outweigh9214pills.us * 175: overhand1383biz.us * 176: packaged2320rneds.biz * 177: paperwork970tads.com * 178: paramour5839biz.biz * 179: parfaits6405drygs.us * 180: passivism3981tads.com * 181: payout4174pills.us * 182: pelves963tads.com * 183: penney5099rx.us * 184: phantasia6277biz.us * 185: phoneme6858biz.com * 186: phosphite1908tads.com * 187: plasticize6988drygs.com * 188: pleader7286pi11.us * 189: plus2766rx.biz * 190: pollacks6901biz.us * 191: pompadour8149meds.us * 192: poncho4491dryg.us * 193: pottage6834pirrs.us * 194: prairie4725biz.com * 195: pressman1177nx.com * 196: pretzel3736pills.com * 197: primness6560nx.us * 198: probity7464tads.com * 199: procuress4029pinn.com * 200: project2089biz.com * 201: propylene3479pi11s.us * 202: qts7851drygs.us * 203: quits8304drygs.com * 204: quoter7237tabs.biz * 205: race874pi11s.us * 206: racetrack2853pirrs.com * 207: radial1212rx.biz * 208: rainproof4172tads.com * 209: ram7888dryg.com * 210: randomness3999pi11.us * 211: rata2536tads.com * 212: rating1857rneds.us * 213: rationale9722dryg.us * 214: receive5709tads.us * 215: recruited2055rneds.com * 216: replenish4787nx.com * 217: reproduced2714tads.us * 218: resist9528rneds.com * 219: rework5964drugs.us * 220: rhubarb454rneds.us * 221: richmond8106dryg.com * 222: ringlet6664biz.us * 223: rustic9925rneds.com * 224: safflower170dryg.com * 225: sahib5037biz.com * 226: salesman8694tabs.biz * 227: sanguine882rneds.com * 228: sanita77.biz * 229: satrapy8385tads.com * 230: sauntering5306biz.biz * 231: scarfs7993pi11s.us * 232: scatters8393rneds.com * 233: sceptical5237tabs.us * 234: schlepp5206biz.com * 235: science6119dryg.us * 236: scratchpad4718tads.us * 237: scuttle5567pills.us * 238: searim7571tads.us * 239: seascape9247dryg.us * 240: seconds9619pills.biz * 241: seduction6895drygs.us * 242: sergeancy8489pinn.com * 243: servile9023tads.us * 244: sewerage5665pills.us * 245: sextette9640drug.us * 246: shadowy9804pinn.com * 247: shaves4465drugs.biz * 248: shied5615rneds.us * 249: shingle6722dryg.us * 250: shipshape6075pi11.us * 251: shirts7008drygs.us * 252: showplace1294pirrs.com * 253: showroom3161drygs.us * 254: shrieking3773pi11s.us * 255: shrinks489pinn.com * 256: shudder4751dryg.us * 257: shudder6654meds.biz * 258: sideband9064dryg.us * 259: silenced221pills.us * 260: silvers2867biz.us * 261: simpleness128pill.us * 262: siphonage8358pi11.us * 263: skills4744rneds.us * 264: skunk2642drugs.us * 265: sky5490pirrs.com * 266: skydives9635pi11s.us * 267: slates8323rx.biz * 268: slays1093drugs.biz * 269: sleety6351pills.biz * 270: slide6037drygs.us * 271: smeltery7284pills.us * 272: smithies7780biz.us * 273: smock928pill.us * 274: smoldering3120drugs.biz * 275: snivels460biz.biz * 276: snoozed2548rneds.com * 277: soaker1916tads.com * 278: societies7375tads.us * 279: sociologic3084biz.us * 280: sods4562rx.us * 281: soluble7830pinn.com * 282: souped9129pill.biz * 283: sparring2432pi11s.us * 284: spidery4421biz.com * 285: spiritous5262dryg.us * 286: spoilt7777rneds.com * 287: squelched807rx.us * 288: stack7167biz.us * 289: statutory1625pi11s.us * 290: stein3843dryg.us * 291: stereo661drugs.us * 292: stiffed5912tads.com * 293: stillness4372pills.us * 294: stillwater7481drug.us * 295: stockinet9618nx.com * 296: stolidly8964biz.us * 297: stony4921rneds.com * 298: stoppage9046drugs.us * 299: subcell5587drugs.us * 300: summit4716drygs.com * 301: sundae8155pi11.us * 302: sundance4111pills.biz * 303: swaged5905biz.com * 304: tachometer4191rx.us * 305: tangential3858pill.us * 306: tentative8691pinn.com * 307: terminable3646drygs.com * 308: textiles528tads.us * 309: them1275pinn.com * 310: thickly6764drugs.us * 311: threadbare2938rneds.us * 312: throughput9067pi11.us * 313: thumbscan6966tads.us * 314: thumper4635pi11s.us * 315: tidings7196rx.biz * 316: tiled2118rneds.com * 317: timeworn642tads.us * 318: tingle3751drygs.com * 319: tipped2161pills.us * 320: tiptoe1538rx.us * 321: toaster7461drygs.com * 322: towing613pill.biz * 323: transient3126drygs.com * 324: transitive7329pi11.us * 325: treatable4145pill.biz * 326: trinity7698pi11s.us * 327: tunny1567rx.us * 328: ugh5315biz.biz * 329: unawares6248pinn.com * 330: unburdened2613pills.us * 331: uncocked5801tabs.biz * 332: undefended7133pinn.com * 333: underload9603pirrs.com * 334: unhewn2916drug.us * 335: unordered6621rx.us * 336: unpainted4643pills.us * 337: valencia9167pill.biz * 338: vcr1047pinn.com * 339: vermouth9192drugs.biz * 340: very9221rx.us * 341: voodoo5623rx.biz * 342: wanton5925pill.biz * 343: waterside9155dryg.us * 344: weak2133drug.us * 345: weaponless8185biz.com * 346: weeper9194nx.com * 347: wimbledon743pill.us * 348: winney6568drugs.biz * 349: winning7272tads.com * 350: wolfhound8782biz.us * 351: workman3166tabs.us * 352: worrisome5163pill.us * 353: wrasse8984pi11.us * 354: yachtsmen1959pi11s.us * 355: yip3909tads.com --Chris

6 17

whitelist senderbase top domains?
by Jeff Chan 15 Sep '04

15 Sep '04

Looks like senderbase.org has a database of the domains and IPs used to send the most mail. Normally that would not be too interesting to us since we care about message body URIs, i.e. content, and not senders or their ISP addresses, but I'm thinking about whitelisting all the legitimate NSPs, ISPs and telcos in their top domains list: http://www.senderbase.org/search?page=domains we would exclude the few that appear to be spammers according to spamhaus: imgmailer.com TAM Network stocksntalk.com iMedia Networks Inc. havagreatday.com But I'd like to whitelist all the rest which are obviously large ISPs, etc. In essence we're just using it as a list of some of the top ISPs in the world. Does anyone have any comments on this? Note that this won't have a major effect on bad guys since spammers would not have much incentive to advertise their ISPs, and we don't "whiten" spams for mentioning non-spam domains anyway. It also does not mean that we're whitelisting the ISP address space, senders, or anything like that, just mail that mentions these large ISP URIs. Jeff C.

6 24

Re: [SURBL-Discuss] important reduce wrise renkles & skin spots ( fwd)
by Jeff Chan 15 Sep '04

15 Sep '04

On Wednesday, September 15, 2004, 5:36:51 AM, Anti-Spam Anti-Spam wrote: > From: "Jeff Chan" <jeffc(a)surbl.org> >> On Wednesday, September 15, 2004, 12:46:00 AM, Alex Broens wrote: >> > Jeff Chan wrote: >> >> What is your expiration algorithm? >> >> > None so far. As its all very new, I'm still "collecting". >> > On my local IP RBL I have 30 days, dunno yet what to use on URIs, I >> > assume that using 6 months at least would be safe. >> >> 6 months sounds reasonable to me. 3 months could work also. >> >> The way the sc data works is that it's refreshed by new reports >> or the records fall off the list after some number of days. In >> other words it's report-driven. > which makes sense when autromatically listing IPs as a zombie may be fixed > real fast. Not sure how that's relevant since we're doing URI domains, not zombie IPs. IOW we're doing destination URIs, not source IPs. To me they're not too connected. The hosting of the URI and the sending of spam are relatively de-coupled (not connected). > my thought is that as domains are usually paid for a year or more, their > owners have to get their ROI together, so keep them in there for at least as > long as the dom is paid for...:) Most hard core spammers use a domain for a couple days then abandon it. These spammers don't use their domains a year; they treat them as disposable. Jeff C.

1 0

RE: Start an IP list to block?
by Chris Santerre 15 Sep '04

15 Sep '04

>-----Original Message----- >From: jm(a)jmason.org [mailto:jm@jmason.org] >Sent: Friday, September 10, 2004 1:05 PM >To: Jeff Chan >Cc: SURBL Discussion list (E-mail); Spamassassin-Talk (E-mail) >Subject: Re: Start an IP list to block? > > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >Jeff Chan writes: >> On Friday, September 10, 2004, 7:27:06 AM, Chris Santerre wrote: >> > WOW! I think this would hit more FPs then listing the IP! >Am I wrong there! >> > I would never list the name server, as they may be hosting >for much more >> > then just a spammer. That number is sure to be greater >then a virtual hosts >> > number for an IP. Maybe I'm missing something key? >> >> SBL lists some spammer name server (and web server) IPs. >> Hopefully they're careful about it, since you're right listing >> name servers could affect a lot more than just the virtual hosts >> on a web server IP. > >SBL is also *very* manually-driven, and has a high level of certainty >required before anything is listed. There's some serious human vetting >going on for every IP that gets added, and they (generally) >spot the cases >where ns1.bigisp.com would be listed, and don't list them ;) > >- --j. 1) Sounds familiar...the vetting that is ;) 2) HOw the hell do you keep up on your email? I'm convinced JM is actually a machine of some sort. Possibly an old PDP11 in a university basement someone left on and forgot. It somehow became self aware. --Chris

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss