- Discuss - Mailman 3

surbl.org website down?
by Martin 17 Aug '04

17 Aug '04

Is it jst me or is the surbl.org website down? / Martin

3 11

Re: [SURBL-Discuss] surbl.org website down?
by daveb＠esat.net 17 Aug '04

17 Aug '04

Martin wrote: > >Jeff Chan wrote: > >> Comes up fine for me, but it could be intermittent DNS timeouts >> due to BIND being slow reloading. I'm changing my server over >> to rbldnsd and encouraging other of the public SURBL name >> servers to do likewise, but some are not converted over yet. >> I believe running rbldnsd will help a lot. > >Jeff, > >Alright, but it seems like i can't find the host at all: > >traceroute www.surbl.org >traceroute: unknown host www.surbl.org > >Anyone else from sweden experiencing the same problem? I think it's to do with which nameserver you get back. I noticed when I switched mine to rbldnsd that other day that I was unable to resolve www.surbl.org from it anymore... dave@pagh:~$ dig version.bind chaos txt @ns16.surbl.org +short "rbldnsd" dave@pagh:~$ dig a www.surbl.org @ns16.surbl.org +short dave@pagh:~$ dig version.bind chaos txt @ns14.surbl.org +short "rbldnsd 0.992 (7 Mar 2004)" dave@pagh:~$ dig a www.surbl.org @ns14.surbl.org +short dave@pagh:~$ dig version.bind chaos txt @ns13.surbl.org +short "8.3.7-REL" dave@pagh:~$ dig a www.surbl.org @ns13.surbl.org +short 66.170.2.60 As you can see, ns16 & ns14 won't give you an A record back, but ns13 will. This also affects what my nameservers will cache .... daveb@bilbo:~$ dig a www.surbl.org @ns4.ns.esat.net +short daveb@bilbo:~$ dig a www.surbl.org @ns5.ns.esat.net +short 66.170.2.60 daveb@bilbo:~$ traceroute www.surbl.org traceroute: unknown host www.surbl.org Both servers are identical, yet one can resolve it, and one can't. I'm not sure what the solution should be, but it will only get worse as more clients migrate rbldnsd IMHO. Dave

3 14

RE: [SURBL-Discuss] Need help with setup...
by Kristian Davies 17 Aug '04

17 Aug '04

>>I also re-installed. >>but it seems that spam is still not getting tagged with URI.... :-( >Does it catch a test message containing: > http://surbl-org-permanent-test-point-MUNGED.com/ >or: > http://127.0.0.2-MUNGED/ >without the "-MUNGED"s. So if you send yourself a message with >any of those unmunged testpoints as URIs, the messages should >match any SURBLs you have installed. > http://www.surbl.org/faq.html#test-uris >Jeff C. Cheer for your pointers Jeff, Alas it didnt work :-(( -Kristian --------------------------------------------------------------------------- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. ---------------------------------------------------------------------------

1 0

webpronews.com fp in ws
by Jeff Chan 17 Aug '04

17 Aug '04

webpronews.com is an fp in ws. I've whitelisted it in SURBLs but please remove it from ws, and trace back the source. webpronews.com is in the bonded sender program and another domain belonging to ientry.com. I've separately asked ientry.com for a list of their domains to whitelist beyond: ientry.com ientry.net ientrymail.com webpronews.com Jeff C.

1 0

RE: [SURBL-Discuss] RE: (1) Another Possible FP, and (2) header p arsing issues
by Chris Santerre 17 Aug '04

17 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Saturday, August 14, 2004 2:24 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] RE: (1) Another Possible FP, and >(2) header >p arsing issues > > >On Friday, August 13, 2004, 10:33:22 PM, Bill Landry wrote: >> From: Rik van Riel > >>> Once I have a working script to extract URLs from a spamtrap >>> feed, I'll make it available as free software. Possibly even >>> bundled with Spamikaze ;) > >> Here is a script I run against my spamtrap mailboxes to >output a list of >> domain names: > >> egrep -i "http|www" main.mbx | cut -d ":" -f2 | cut -b 3- | >cut -d "/" -f1 | >> sed "s/=2E/\./g" | grep "\..*\." | egrep -v " >|>|=|@|\..*\..*\." | cut -d >> "." -f2-3 | tr -d "<" | usort | uniq > >> Depending on your mailbox format, it may work for you as well. > >Which will work on some plaintext URIs, but SpamAssassin and >others have code to "render" messages from MIME, multipart >messages, etc. that are not plaintext, in addition to a bunch of >other deobfuscation code. Since spammers sometimes try to make >their messages harder for programs to read, the programs tend to >become more complex and capable. > >Jeff C. While I'm all for automation, but please be extremely careful. Take it from someone who knows, harvesting domains from scripts will lead to headaches. Like Jeff said, there is other encoding to deal with. URL poison. links that don't have http or www in them. ("Paste this into your browser......", btw SARE is working on that now.) I'm thinking the best way would be to take the actual SURBL code, and use it to rip out domains. But the SA code to unencode the email would be needed as well. Putting this in the email pipe would be best. If spam if not found in SURBL run SURBL extract + append to file :) --Chris

3 3

RE: [SURBL-Discuss] Need help with setup...
by Kristian Davies 16 Aug '04

16 Aug '04

Just wondering, i put amavisd in debug mode and it listed this... debug: running uri tests; score so far=0.16 debug: uri tests: Done uriRE Is this SpamURI ?? Cheers, Kristian >Yeah cheers, i'd actually read that already... >Anyway.. i just did a find on Conf.pm which came up with 3 diretories under >/usr/lib/perl5 and i made sure that the 3 .pm files that come with SpamURI >were the same and the ones in the perl directories, now --lint works fine. >However the 3 directories it found all have lots of pm's in them not just >these 3 that come with spamURI. >I also re-installed. >but it seems that spam is still not getting tagged with URI.... :-( >>Here is what Eric Kolve wrote recently about a similar >>error: > It looks like you have two Conf.pm files floating around. > > Do a locate for 'Conf.pm', you probably have one from a previous > perl install or SpamCopURI is going into the wrong place. > > You are looking for a directory that only has Conf.pm, PerMsgStatus.pm > and SpamCopURI.pm. Remove all those files and try re-installing. > > --eric >>Hope this helps, >>Jeff C. --------------------------------------------------------------------------- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. ---------------------------------------------------------------------------

2 1

RE: [SURBL-Discuss] fp: straight dope dot com
by Chris Santerre 16 Aug '04

16 Aug '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Friday, August 13, 2004 4:53 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] fp: straight dope dot com > > >on Fri, Aug 13, 2004 at 04:03:08PM -0400, William Stearns wrote: >> I added this one after a) they "subscribed" another >mailing list >> to which I was a member and b) were not able to tell me how >this happened. >> I have no problem with whitelisting them if they have >legitimate >> subscribers, of course. > >Yep. One of the class of irresponsible list managers, but not SURBL >fodder. > >> My apologies to Steve and all the other straightdope users. > >Eh, no worries. > slightly OT: I've had a lot of submissions from people saying "They won't unsubscribe me!" I don't list based soely on that. However it is an issue. Almost the same as being subscribed without knowledge of it. --Chris

2 1

RE: [SURBL-Discuss] sounddogs.com FP on WS.
by Chris Santerre 16 Aug '04

16 Aug '04

We've all improved our methods. We kick Butt! :) I will try to get to this tomorrow. I'm swamped with all sorts of things coming out of the woodwork! Look there's another problem! Problems everywhere! AAAhhhhahahahahahahahahaha!!!!! --Chris (Hiding under his desk, sucking his thumb, and holding his blankie!) >-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Monday, August 16, 2004 1:24 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] sounddogs.com FP on WS. > > >on Mon, Aug 16, 2004 at 07:15:53PM +0200, Raymond Dijkxhoorn wrote: >> Hi! >> >> > > I've changed the review process of Steve's domains since >then. So far all >> > > have been from back in June. If I get a second I'll go >thru them again, but >> > > there was a TON! Steve's a busy little bug ;) >> >> > Chris, as I mentioned offlist, the list I sent you back in >June was all >> > of my historical blocks, including HELO arguments from possible joe >> > jobs, etc. I'll send you my 'badhelos' file offlist, and you can go >> > through and see how many of those were >> > >> > 1) in my list sent in June >> > 2) also listed in some other domain bl >> > 3) probable FPs >> >> If would be nice to diff those out... will cut down FP rate >a lot i think >> if that list is somehow large :) > >Yes, Raymond, that's why I sent the complete list to Chris, so >he can do >just that. And as he said, out of ~7300 domains, we've had 4 FPs in >three months. So, "a lot" is a matter of some debate. Most of the FPs I >see are unrelated to the badhelos. > >-- >hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/ _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: {Spam?} Re: [SURBL-Discuss] freehosting.net FP on WS
by Chris Santerre 16 Aug '04

16 Aug '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Monday, August 16, 2004 1:29 PM >To: SURBL Discussion list >Subject: {Spam?} Re: [SURBL-Discuss] freehosting.net FP on WS > > >on Mon, Aug 16, 2004 at 12:57:05PM -0400, Chris Santerre wrote: >> Can you guess where this was? :) > >Yeah, in spam. Sent to a spamtrap. > >Return-Path: <m311002(a)hotmail.com> >Received: from larcs (c67164.upc-c.chello.nl [212.187.67.164]) > by serrano.hesketh.net (8.11.6/8.11.3) with SMTP id >g9VC3fr07663 > for <spamtrap>; Thu, 31 Oct 2002 05:52:09 -0500 >Message-Id: <200210311052.g9VC3fr07663(a)serrano.hesketh.net> >X-Originating-IP: [212.187.67.164] >X-Spam-Filter: check_local(a)serrano.hesketh.net by digitalanswers.org >X-Probably-Spam: "message sent from known spam source (caught >by FIVETEN)" >From: <m311002(a)hotmail.com> >To: <spamtrap> >Subject: As Seen and PROVEN on US TV >Mime-Version: 1.0 >Content-Type: text/plain; charset="iso-8859-1" >Date: Thu, 31 Oct 2002 11:58:39Status: RO >Content-Length: 878 >Lines: 28 > >ONE TIME MAILING, NO NEED TO REMOVE OR REPLY BY E-MAIL *snip* LOL, you always find one Steve :) You're like a pitbull....only easier to cuddle with. That one is from 2002! --Chris (Hold me!)

2 1

RE: [SURBL-Discuss] freehosting.net FP on WS
by Chris Santerre 16 Aug '04

16 Aug '04

Can you guess where this was? :) Removed! --Chris >-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Wednesday, August 11, 2004 5:13 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] freehosting.net FP on WS > > >Hi! > >> freehosting.net is listed in WS. >> freehosting.net has been around since 1998. >> Subdomains are available to customers. Most of these customers and >> subdomains are not spammers. >> >> Checking NANAS reports vs. other postings on Google Groups >indicate that >> having freehosting.net listed will generate a lot of false >positives and >> catch almost no spam. > >Whitelisted on WS now. > >Thanks, >Raymond. >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

RE: [SURBL-Discuss] sounddogs.com FP on WS.
by Chris Santerre 16 Aug '04

16 Aug '04

This was back in June. Came from Steve. Removed. I've changed the review process of Steve's domains since then. So far all have been from back in June. If I get a second I'll go thru them again, but there was a TON! Steve's a busy little bug ;) --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Sunday, August 15, 2004 7:52 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] sounddogs.com FP on WS. > > >On Sunday, August 15, 2004, 4:34:18 AM, Patrik Nilsson wrote: >> sounddogs.com is listed on WS. > >> It's an online sound effects library that's been around since 1998. > >> 1100 posts mentioning sounddogs.com found in Google News. >> None of them a NANAS report related to abuse from sounddogs.com. > >Thanks, I've whitelisted it in SURBLs. We should ask >the WS contributors to check how it got in. > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

3 3

RE: [SURBL-Discuss] fp whitelisted: callatg.com, others
by Chris Santerre 16 Aug '04

16 Aug '04

Callatg.com was in Steve's June submissions. Removed. There is something like 7289 domains in that file from June :) So far about 4 FPs. Not that bad. Again, new submissions go thru more scrutiny then before. So no worries on recent ones. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, August 12, 2004 11:16 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] fp whitelisted: callatg.com, others > > >I've whitelisted: > >atgi.net >callatg.com >advancedtelcom.com > >All of which belong to the same legitimate company. >They make telephone switch hardware, etc. and I knew >someone who worked there. > >callatg.com was on ws. Bill can you see how it got on? > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

RE: [SURBL-Discuss] cross-pollination with MT-Blacklist?
by Chris Santerre 16 Aug '04

16 Aug '04

>-----Original Message----- >From: jm(a)jmason.org [mailto:jm@jmason.org] >Sent: Sunday, August 15, 2004 12:15 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] cross-pollination with MT-Blacklist? > > >Hi SURBLers -- > >has anyone talked to Jay Allen and the MT-Blacklist people? > >MT-Blacklist -- http://www.jayallen.org/comment_spam/ -- is a >blacklist of >"bad" URLs (sound familiar? ;). They have quite a small list from the >looks of things, but cross-pollination could work both ways; if *they* >looked up SURBL, or even just looked up a "blog-spam" SURBL sublist, >that'd be a lot more sensible. > >BTW I bet the blog spammers and email spammers are the same >people. (If >blog spammers are the people who *used* to do referrer >spamming, then I'm >*sure* of it -- see http://taint.org/2003/08/14/040652a.html ). > >Also -- some info on that google technique posted here and in >SpamAssassin-users recently -- read this: >http://kalsey.com/2004/07/new_comment_spam_technique/ > > "It appears the spammers have a new tactic in increasing their > PageRank. They find a site that doesn't delete comment >spam and fill > it with links. Then they boost the PR of that site by >spamming it in > blog comments. Once the spam-friendly's site has in >increased Google > ranking, all those spammed links in their comments will >get a boost in > rank as well." > >I'll bet that's it -- working like so: > > 1. spammer S sets up payload site > 2. S spams comment spam everywhere to up its PageRank > 3. S email-spams with the google search URL > 4. top hit for that phrase is the payload site. SARE is currently discussing an eval to catch number 3. Basically a file containing spam phrases. Eval looks for matches in any given google search link to those spam terms. All theory right now. But should stop this junk. --Chris

1 0

RE: [SURBL-Discuss] FP Pattern for sbl-xbl.spamhaus.org
by Chris Santerre 16 Aug '04

16 Aug '04

For what it is worth, if I turned off blocking at MTA level I would see a 33-40% increase in traffic. I don't want that. Every reject has a nice response saying where to email if you get blocked. I've got Delay_checks enabled. So I can override a listing. I've had to do it 3 times I think. All 3 times the customer was grateful I had informed then they were on a black list. And I helped them to get off of it. So it was not a negative for our company, bit a positive. Just the rants of a crazy man, --Chris >-----Original Message----- >From: Rob McEwen [mailto:rob@pvsys.com] >Sent: Saturday, August 14, 2004 4:52 PM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] FP Pattern for sbl-xbl.spamhaus.org >Importance: High > > >RE: FP Pattern for sbl-xbl.spamhaus.org > >For a while now, my philosophy has been to use >sbl-xbl.spamhaus.org to block >at the connection level and not even allow these messages onto >my server. >Much of the remaining spam filtering is then done by SURBL-checking. >However, more recently, I been testing samples of sbl-xbl.spamhaus.org >blocked messages and I've noticed two things. > >(1) more false positives than I would want to see (though >still a very tiny, >tiny percentage overall) get blocked by sbl-xbl.spamhaus.org > >...and... > >(2) those that ARE legitimate tend to be cases where a mistake >was made and, >by the next day (or later that same day), the offending IP is >removed from >sbl-xbl.spamhaus.org > >However, I must admit, I'm drawing sweeping conclusions from >very little >sampling of data. Therefore, don't take my word for it... >Rather, is this >consistent with anyone else's experience with sbl-xbl.spamhaus.org? The >reason I mention this is that, if my initial conclusions are >true, there >would then be a strong argument for "holding" >sbl-xbl.spamhaus.org blocked >mail and giving it a "second try" some hours later. Also, if >this is true, >does anyone have a "feel" for exactly how long "bad" data stays on >sbl-xbl.spamhaus.org before it gets removed? (Recognizing, of >course, that >SpamHaus is probably the most reliable and respected free RBL >in existence >and they rarely make mistakes in the first place). > >Any thoughts or suggestions? Has anyone examined their >sbl-xbl.spamhaus.org >blocked messages lately? > >Rob McEwen > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] Need help with setup...
by Kristian Davies 16 Aug '04

16 Aug '04

Yeah cheers, i'd actually read that already... Anyway.. i just did a find on Conf.pm which came up with 3 diretories under /usr/lib/perl5 and i made sure that the 3 .pm files that come with SpamURI were the same and the ones in the perl directories, now --lint works fine. However the 3 directories it found all have lots of pm's in them not just these 3 that come with spamURI. I also re-installed. but it seems that spam is still not getting tagged with URI.... :-( >>Here is what Eric Kolve wrote recently about a similar >>error: > It looks like you have two Conf.pm files floating around. > > Do a locate for 'Conf.pm', you probably have one from a previous > perl install or SpamCopURI is going into the wrong place. > > You are looking for a directory that only has Conf.pm, PerMsgStatus.pm > and SpamCopURI.pm. Remove all those files and try re-installing. > > --eric >>Hope this helps, >>Jeff C. --------------------------------------------------------------------------- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. ---------------------------------------------------------------------------

1 0

RE: [SURBL-Discuss] Need help with setup...
by Kristian Davies 16 Aug '04

16 Aug '04

I use amavisd, and yes i have network test enabled. Basically i've been using current setup with amavis/sa/clamav, sorbs/spamhaus/spamcop etc without a hitch for a year or so. The only thing that doesnt work is spamuri which i added a couple of days ago. If i do spamassassin --lint, i get: Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list _spamcop_uri snurl.com *.snurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list _spamcop_uri snipurl.com *.snipurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list _spamcop_uri tinyclick.com *.tinyclick.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list _spamcop_uri babyurl.com *.babyurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list _spamcop_uri lin.kz *.lin.kz Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list _spamcop_uri *.v3.net Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list _spamcop_uri shorl.com *.shorl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list _spamcop_uri tinyurl.com *.tinyurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list _spamcop_uri xurl.us Failed to compile URI SpamAssassin tests, skipping: (syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule WS_URI_RBL, line 1, near "eval:" syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, lin e 1, near "eval:" syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, lin e 6, near "} }" ) Any ideas...? Cheers -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: 16 August 2004 13:01 To: Kristian Davies Cc: 'discuss(a)lists.surbl.org' Subject: Re: [SURBL-Discuss] Need help with setup... On Monday, August 16, 2004, 3:52:37 AM, Kristian Davies wrote: > I have everything setup/installed, copied the pm into the relevant places > along with .cf, but still i'm not getting any hits. Do you have network tests enabled? http://www.surbl.org/faq.html#nettest > My SpamAssassin now has SURBL support but I'm not seeing hits. > If you recently added SURBL support to SpamAssassin but are not > seeing any SURBL (or other RBL hits), check that you have > enabled network tests. For example, if you're using spamd, make > sure it's started without the -L or --local flags, which force > local tests only. If you are running Amavis, make sure > amavisd.conf has $sa_local_tests_only = 0. (Uncomment this line > if it was commented out before, then set the value to zero to > enable network tests.) Jeff C. --------------------------------------------------------------------------- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. ---------------------------------------------------------------------------

2 1

RE: [SURBL-Discuss] FP Pattern for sbl-xbl.spamhaus.org
by Rich Graves 16 Aug '04

16 Aug '04

On Sun, 15 Aug 2004, Rob McEwen <rob(a)pvsys.com> wrote: > Sorry, I didn't mean to start such a ruckus. I have a proposal. I'll > re-configure my filter so that it only blocks those IPs at the MTA level > which are listed on both (1) DSBL (...AND...) (2) listed on at least one of > the two SpamHaus lists. This thread is increasingly off-topic, but I am interested in the outcome of your analysis. On my end, it's worth noting that SpamAssassin with SURBLs rejects 8.6% of messages that passed through all of our blacklist and antivirus checks. I've been doing multi-blacklisting for a couple years. Currently mail must be on at least two of three of bl.spamcop.net, sbl-xbl.spamhaus.org, and list.dsbl.org to be rejected. I have seen false positives on Chinese universities, but not much else. Our 55x rejects always give specific reasons and an invitation to contact postmaster@brandeis. Here's my numbers from our primary MX over the last 10 days. These rules are applied in the order below, i.e., if you're on both spamcop and spamhaus we don't check any other rules, and we don't even bother scanning .pif files with ClamAV anymore. 25,117 /etc/mail/access 42,407 bl.spamcop.net and sbl-xbl.spamhaus.org 3,366 sbl-xbl.spamhaus.org and list.dsbl.org 1,778 bl.spamcop.net and list.dsbl.org 16,067 messages with .pif, .cmd, .vbs, .cpl, or .scr attachments rejected 7,750 viruses detected by ClamAV 24,422 refused because SpamAssassin scored > 14.0 (to score so high, they usually need to be on more than one SURBL) 258,129 messages accepted for delivery Of the 258K messages delivered, 25,448 were tagged suspect with SpamAssassin score > 5.0 and 30,401 were on exactly one blacklist. -- Rich Graves <rcgraves(a)brandeis.edu> UNet Systems Administrator

1 0

Need help with setup...
by Kristian Davies 16 Aug '04

16 Aug '04

Hi All, I have everything setup/installed, copied the pm into the relevant places along with .cf, but still i'm not getting any hits. What are the debug steps... i cant think why its not working. SA 2.64 URI latest Tia, Kristian --------------------------------------------------------------------------- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. ---------------------------------------------------------------------------

2 1

RE: [SURBL-Discuss] RE: (1) Another Possible FP, and (2) header p arsing issues
by Chris Santerre 16 Aug '04

16 Aug '04

>-----Original Message----- >From: Rob McEwen [mailto:webmail@powerviewsystems.com] >Sent: Thursday, August 12, 2004 11:18 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] RE: (1) Another Possible FP, and (2) header >parsing issues >Importance: High > > >I have a two-part question: > >(1) header parsing issues... > >I was reading a web site discussing an implementation of SURBL on the >IceWarp web server (using a third party add-on). One person >complained that >there are too many false positives when submitting IPs and >domains found in >the header of the e-mail. They felt like ONLY the body of the >message should >be examined. I see good arguments both ways. For example, >parsing the header >can catch spam which was originally sent to one place, but >then forwarded to >another. On the other hand, actual affiliate URLs would only >normally occur >in the body of the message. Any thoughts or suggestions? > >(2) Another Possible FP... > >This person was asked to give an example of a message which >shouldn't have >been blocked and which would have gone through if the header >wasn't parsed. >They provided an example which had the following line in the header: > >Message-ID: <000b01c47f1a$e02f73e0$0200a8c0(a)MUNGED-callatg.com> > >The offending domain was MUNGED-callatg.com > >Therefore, I must ask, could MUNGED-callatg.com be a FP? The reason I >suspect so is because they mentioned that this company is a >division of GE. >Please check on this. > I'm confused. (Theres a first!) SURBL only check the body for URLs. How did the message-ID get hit? --Chris

9 25

Fwd: [SURBL-Discuss] FP Pattern for sbl-xbl.spamhaus.org
by Jeff Chan 16 Aug '04

16 Aug '04

Spamhaus says: >From: Rob McEwen <rob(a)pvsys.com> >To: "'SURBL Discussion list'" <discuss(a)lists.surbl.org> >Date: Saturday, August 14, 2004, 1:52:26 PM >Subject: [SURBL-Discuss] FP Pattern for sbl-xbl.spamhaus.org >RE: FP Pattern for sbl-xbl.spamhaus.org > >For a while now, my philosophy has been to use sbl-xbl.spamhaus.org to block >at the connection level and not even allow these messages onto my server. >Much of the remaining spam filtering is then done by SURBL-checking. >However, more recently, I been testing samples of sbl-xbl.spamhaus.org >blocked messages and I've noticed two things. > >(1) more false positives than I would want to see (though still a very tiny, >tiny percentage overall) get blocked by sbl-xbl.spamhaus.org > >...and... > >(2) those that ARE legitimate tend to be cases where a mistake was made and, >by the next day (or later that same day), the offending IP is removed from >sbl-xbl.spamhaus.org Hmmm, this can happen. Also depends on the volume of mail he processes. I'd be interested in if this is due to SBL or XBL hits. Both can produce FP's, but it brings up a debate as to what's an FP. If an IP has been found sending viruses or spam and is auto-listed by the XBL system (normally due to a compromised box), but that IP also sends non-bad email, it's not a false listing. We error on the side of stopping the 100,000 viruses being sent to users worldwide than to let the fewer legit emails pass. >However, I must admit, I'm drawing sweeping conclusions from very little >sampling of data. Therefore, don't take my word for it... If it's SBL, if he has a cousin in the Chinanet-CQ IP space, or in parts of Brazil Telecom's space, he'll probably see many more FPs as we do have large SBL listings. Also, if he gets email from people hosting on the cheap-spam-friendly networks like New Horizon, CET Networks or OC3, they get all IP space listed. >Rather, is this consistent with anyone else's experience with >sbl-xbl.spamhaus.org? The >reason I mention this is that, if my initial conclusions are true, there >would then be a strong argument for "holding" sbl-xbl.spamhaus.org blocked >mail and giving it a "second try" some hours later. He sure could, many people do greylist with DNSBLs. >Also, if this is true, >does anyone have a "feel" for exactly how long "bad" data stays on >sbl-xbl.spamhaus.org before it gets removed? No way to know. Most XBL listed IPs can be "self-removed", SBL mistakes that generate FPs are normally found out by us pretty quickly as either the blocked users or people who use us and like he, check their logs, let us know. >(Recognizing, of course, that >SpamHaus is probably the most reliable and respected free RBL in existence >and they rarely make mistakes in the first place). :-) >Any thoughts or suggestions? Has anyone examined their sbl-xbl.spamhaus.org >blocked messages lately? On large ISP type corpses, we still have a tiny fraction of true FPs. That being said, some places (with little volume or huge cheap bandwidth and lots of CPU) will just use SBL+XBL as a part of a SpamAssassin type formula. They won't toss on it being BL'd, but will want some other spammy trait to push it over the spam-score. >Rob McEwen

5 8

preparingforemergencies.co.uk false FP on OB
by Patrik Nilsson 15 Aug '04

15 Aug '04

preparingforemergencies.co.uk is listed on OB. It's a parody site that seem to be quite popular at the moment, getting forwarded in emails, mentioned in blogs, etc. I can't find any NANAS reports involving it. It is a quite recently registered domain though (26-Jul-2004) which might have contributed to it ending up on OB. Patrik

2 1

fp - sms dot ac
by Steven Champeon 15 Aug '04

15 Aug '04

...found in the latest Cryptogram (Bruce Schneier's mailing list). -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/

2 1

sounddogs.com FP on WS.
by Patrik Nilsson 15 Aug '04

15 Aug '04

sounddogs.com is listed on WS. It's an online sound effects library that's been around since 1998. 1100 posts mentioning sounddogs.com found in Google News. None of them a NANAS report related to abuse from sounddogs.com. patrik

2 1

cross-pollination with MT-Blacklist?
by jm＠jmason.org 15 Aug '04

15 Aug '04

Hi SURBLers -- has anyone talked to Jay Allen and the MT-Blacklist people? MT-Blacklist -- http://www.jayallen.org/comment_spam/ -- is a blacklist of "bad" URLs (sound familiar? ;). They have quite a small list from the looks of things, but cross-pollination could work both ways; if *they* looked up SURBL, or even just looked up a "blog-spam" SURBL sublist, that'd be a lot more sensible. BTW I bet the blog spammers and email spammers are the same people. (If blog spammers are the people who *used* to do referrer spamming, then I'm *sure* of it -- see http://taint.org/2003/08/14/040652a.html ). Also -- some info on that google technique posted here and in SpamAssassin-users recently -- read this: http://kalsey.com/2004/07/new_comment_spam_technique/ "It appears the spammers have a new tactic in increasing their PageRank. They find a site that doesn't delete comment spam and fill it with links. Then they boost the PR of that site by spamming it in blog comments. Once the spam-friendly's site has in increased Google ranking, all those spammed links in their comments will get a boost in rank as well." I'll bet that's it -- working like so: 1. spammer S sets up payload site 2. S spams comment spam everywhere to up its PageRank 3. S email-spams with the google search URL 4. top hit for that phrase is the payload site. --j.

1 0

FP Pattern for sbl-xbl.spamhaus.org
by Rob McEwen 15 Aug '04

15 Aug '04

RE: FP Pattern for sbl-xbl.spamhaus.org For a while now, my philosophy has been to use sbl-xbl.spamhaus.org to block at the connection level and not even allow these messages onto my server. Much of the remaining spam filtering is then done by SURBL-checking. However, more recently, I been testing samples of sbl-xbl.spamhaus.org blocked messages and I've noticed two things. (1) more false positives than I would want to see (though still a very tiny, tiny percentage overall) get blocked by sbl-xbl.spamhaus.org ...and... (2) those that ARE legitimate tend to be cases where a mistake was made and, by the next day (or later that same day), the offending IP is removed from sbl-xbl.spamhaus.org However, I must admit, I'm drawing sweeping conclusions from very little sampling of data. Therefore, don't take my word for it... Rather, is this consistent with anyone else's experience with sbl-xbl.spamhaus.org? The reason I mention this is that, if my initial conclusions are true, there would then be a strong argument for "holding" sbl-xbl.spamhaus.org blocked mail and giving it a "second try" some hours later. Also, if this is true, does anyone have a "feel" for exactly how long "bad" data stays on sbl-xbl.spamhaus.org before it gets removed? (Recognizing, of course, that SpamHaus is probably the most reliable and respected free RBL in existence and they rarely make mistakes in the first place). Any thoughts or suggestions? Has anyone examined their sbl-xbl.spamhaus.org blocked messages lately? Rob McEwen

4 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss