- Discuss - Mailman 3

RFC: Storm URI IPs to XS list?
by Jeff Chan 11 Sep '07

11 Sep '07

As we know, the storm malware is responsible for a large number of compromised computers in botnets, for DDOS, for e-card, PDF, and stock spams, etc. A large number of storm e-card-advertised URI IP addresses are available from the XS data source but are not currently being listed on XS. (Those IPs, of course are all or mostly bot-hosted web sites with malware loaders to further spread storm by compromising more computers and growing the botnets by infecting anyone who visits the sites.) Shall we: 1. Blacklist those on XS 2. Add XS into multi.surbl.org as the 128th bit In principle #1 and #2 could be separate issues, but to get maximum benefit if #1 is done then #2 should probably be done also. XS will have likely have much other data added to it in future, including non-storm domain names and other URI hosts. This would only be a first step. It's also worth noting that we don't intend XS to be a malware list; we're still focussed on unsolicited messages and that is the aspect that arguably makes the storm IPs appropriate for inclusion: their appearance in huge amounts of bot-sent unsolicited messages. It just happens that the messages are primarily meant to propagate storm, but they're still unsolicited, bulk, etc. Also, regarding storm URI IPs, some are currently being added to SC and WS. Some are probably going onto JP and PH also. But the XS collection would probably be more comprehensive than the others for now. Comments? Jeff C.

10 37

lists.surbl.org
by Paul Freeman 17 Aug '07

17 Aug '07

http://lists.surbl.org/ seems to be down for me, can anyone else reach it? -- Kindest regards Paul Freeman, NOC4 Limited +44(0)1844 318 083 (Direct) +44(0)1844 318 104 (Fax) ------------------------------------------------------------------------ *Confidential Information.* This e-mail and any attachments (“the message”) contains information from noc4, which may be privileged and/or confidential. The message is intended for use only by the organisation(s) or individual(s) named above (“the recipient”). If you are not the intended recipient, please be aware that any form of disclosure, copying, distribution or use of the contents of the message is strictly prohibited. If you have received the message in error, please notify us by telephone or e-mail as detailed at the bottom of this message immediately. Activity and use of the noc4 e-mail system is monitored and recorded to secure its effective operation and for other lawful business purposes. The opinions and beliefs expressed in this email may not necessarily be those of NOC4 Limited. NOC4 Limited 2 Manor Farm Cottages, Rycote Lane, Thame, OX9 2HF Registered in England and Wales, Company No. 05356870 VAT Registration No. GB 807 9233 20 *T* +44(0)1844 318 084 *F* +44(0)1844 318 104 *E* * * *sales(a)noc4.net <mailto:sales@noc4.net>* *support(a)noc4.net <mailto:support@noc4.net>* *accounts(a)noc4.net <mailto:accounts@noc4.net>* * *

2 1

When did a specific URL get into SURBL?
by Kelly Jones 11 Aug '07

11 Aug '07

How can I tell when a specific URL was entered into SURBL? Is there an RSS news feed or DNS text record or something that tells this? My scenario: my tech-savvy user gets an email advertising spammer.com and says "I did 'host spammer.com.multi.surbl.org' and SURBL's blocking this domain-- why did it get through?". I want to answer (accurately) "spammer.com is in SURBL *now*, but it wasn't when you received the mail-- spammer.com was entered into SURBL at xxxx, while the email you forwarded came in earlier, at yyy". Any way to do this? We seem to get a lot of spam that slips by SURBL, but shows up in multi.surbl.org shortly thereafter (I realize that someone has to receive the spam before a URL can added to SURBL...) Another interesting use would be figuring out how long to quarantine possible spam-- in most cases, holding suspicious emails for just 12 hours would vastly reduce the amount of spam we get. -- We're just a Bunch Of Regular Guys, a collective group that's trying to understand and assimilate technology. We feel that resistance to new ideas and technology is unwise and ultimately futile.

3 2

service problem?
by Hajdú Zoltán 26 Jul '07

26 Jul '07

Hello! I got (false?) positive answers to all IP addresses resolved by the multi.surbl.com. The returned address is 72.52.9.9. Is there any known problem with the service? # host 4.3.2.1.multi.surbl.com 4.3.2.1.multi.surbl.com has address 72.52.9.9 # rblcheck -t -s multi.surbl.com 1.2.3.4 checking 1.2.3.4 1.2.3.4 RBL filtered by multi.surbl.com Yours sincerely, Zoltan Hajdu System Administrator Jasmin Media Group Ltd.

5 6

Re: [SURBL-Discuss] webfusion.co.uk
by Rob McEwen 28 Apr '07

28 Apr '07

Phil, I removed it from SURBL. (it may take a few minutes to propogate) BTW - in the future, please sent any such requests to "whitelist <AT> surbl.org" Thanks for your help! Rob McEwen PowerView Systems rob(a)PowerViewSystems.com -----Original message----- From: "Phil $Medway Hosting$" phil(a)medwayhosting.com Date: Sat, 28 Apr 2007 08:31:00 -0400 To: "SURBL Discussion" discuss(a)lists.surbl.org Subject: [SURBL-Discuss] webfusion.co.uk Hi there I was just wondering about the listing of webfusion.co.uk on SC and OB. webfusion.co.uk are a rather large hosting company and their domain name appears on most emails sent out by 123-reg.co.uk who are one of the largest UK domain registrars. This listing is causing domain renewal notices etc to be rejected. I have now whitelisted them locally, but I was wondering if they really ARE spamming or is this an FP? Many thanks Phil _____________________________________________ Website Hosting from only £5.00 per month. www.medwayhosting.com - +44 (0)1634 856965 _____________________________________________ Digital & Traditional Printing, and much more www.medwayprint.com - +44 (0)1634 281199 _____________________________________________ _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

webfusion.co.uk
by Phil (Medway Hosting) 28 Apr '07

28 Apr '07

Hi there I was just wondering about the listing of webfusion.co.uk on SC and OB. webfusion.co.uk are a rather large hosting company and their domain name appears on most emails sent out by 123-reg.co.uk who are one of the largest UK domain registrars. This listing is causing domain renewal notices etc to be rejected. I have now whitelisted them locally, but I was wondering if they really ARE spamming or is this an FP? Many thanks Phil _____________________________________________ Website Hosting from only £5.00 per month. www.medwayhosting.com - +44 (0)1634 856965 _____________________________________________ Digital & Traditional Printing, and much more www.medwayprint.com - +44 (0)1634 281199 _____________________________________________

1 0

FUN: Help Rob McEwen test his new anti-spam tools!
by Rob McEwen 27 Apr '07

27 Apr '07

FUN PROJECT: Help Rob McEwen test his new anti-spam tools! (NOTE: I have been granted official permission from Jeff Chan to make this announcement on the SURBL list!) As many already know... I'm one of a **small** handful of organizations with authority to blacklist and whitelist "at will" on SURBL and I've provided much administrative assistance to SURBL for years, particularly in preventing false positives. Of course, my efforts there are miniscule compared to Jeff Chan's great work! Still, Jeff has thanked me countless times for my assistance. Most importantly, I have an "insider's view" and **uncommon expertise** into what it takes to make a "world class" blacklist and, within the next few business days, I will be officially releasing my 2 new "Invaluement Spam Blocklists": (1) The "Invaluement-URI" blocklist (much like SURBL & URIBL) ..AND.. (2) The "Invaluement-SIP" blocklist, a Sender's IP blocklist (a.k.a. an "RBL", like DSBL, SBL, etc.). SIP = "Sender's IP" Proverbs 15:22 says, "Without counsel plans fail, but with many advisers they succeed." NOT that these two lists will be built by committee... but, along these lines, I sure could use some feedback! You may be asking: --WHY SHOULD WE USE THESE LISTS? --HOW ARE THEY HELPFUL? --WHAT ARE THESE? First, if you are already using SURBL & URIBL, continue to do so! Invaluement-URI will NOT replace SURBL & URIBL as those lists WILL catch things that Invaluement-URI will miss or not catch as quickly. However... ************************************** REGARDING: "Invaluement-URI" blocklist ************************************** (A) The "Invaluement-URI" blocklist is catching over 1,000 URIs (per week) minutes, hours, and even days BEFORE surbl or uribl or even uribl-red! Did you catch that? Let me repeat: ****Invaluement-URI is listing over 1,000 URIs (per week) minutes, hours, and even days BEFORE surbl or uribl or even uribl-red!**** (If a URI showed up on ANY 1 of these lists, I didn't count it towards that tally. I ONLY counted items which were not on ANY of those other lists!) Q: Why? How? A: Mostly because Invaluement-URI is a "fast reacting" list! Often even faster than URIBL-RED!! Q: Why is this important? A: Because many new series of spams are listed on Invaluement-URI lightening fast and this will help you block much spam that would otherwise pass through your spam filtering during those minutes/hours BEFORE the URI is listed on SURBL or URIBL. (B) The "False Positive Rate" for Invaluement-URI is extremely low -- and might even be better than SURBL's already very low FP rate! I have yet to spot a single egregious FP... and the **few** that I have spotted (and removed) were VERY questionable to begin with! NOTE: Being aggressive and fast is easy... but doing such **without** the FPs is incredibly difficult. Years of programming and analysis went into the development of these two lists! (C) Additionally, Invaluement-URI is catching many URIs, particularly phishes, that **might** NEVER be getting in SURBL or URIBL... or at least that seems to be the case as several days have gone by without them being listed. NOTE: You might ask, "Rob, why haven't **you** placed these into SURBL or requested them be listed in URIBL?" The answer is simple. In recent weeks, finishing touches on these new lists have consumed most of my time and energies. But I do plan to use this knowledge/data to do more submissions to SURBL & URIBL. However, even then, for various reasons, such submissions will have to be "hand-submitted" and "hand-checked". Therefore, Invaluement-URI will STILL haVE the "upper hand" in being a fast-reaction list. ************************************** REGARDING: "Invaluement-SIP" blocklist ************************************** I find that many Sender's IP blocklists (a.k.a. "RBLs"): (1) tend to catch much spam without FPs, but also seem to have diminishing returns... sort of an upper limit in their effectiveness... a "glass ceiling" ...OR... (2) block much legit mail and/or very credible sources... or even purposely "punish" sources of legit mail for those ISP's/ESP's who are lacking in their prevention of spams sent from their network. So you are "stuck" with one type of Sender's IP blocklist being helpful, but very limited... and the other type too aggressive to be used, requiring that you "score" it very, very low in your filtering to prevent FPs... thus minimizing its effectiveness! IN CONTRAST... you'll find Invaluement-SIP to be a "best of both worlds" Sender's IP Blocklist. It is as aggressive and "fast reacting" as many of the best... listing MANY IPs that are not yet on other RBLs... but NOT having the high FP rate found on many other "aggressive" IP blacklists. ************************** REGARDING: BOTH blocklists ************************** LOW MEMORY FOOTPRINT: While both are "quick reacting"... both are also "quick expire time" lists. If a spam hasn't been seen containing that URI or from that Sender's IP for more than a few weeks, it gets expired and removed. This keeps the "memory footprint" very low... and this opens up multiple possibilities... like possible use in spam appliances or even routers which otherwise couldn't efficiently work with lists that have almost a million or more entries... many of which are so outdated that they include items practically never seen "in the wild" anymore. Additionally, this smaller "footprint" also allows for fast data transfers / updates. These lists are ONLY available via RSYNC or BIND "zone transfers". But because the dataset is so relatively small, the updates are (and can be!) more frequent... allowing my "quick strike" capabilities to help you in your "real time" spam filtering. Amazingly I provide **2 minute update frequency** for RSYNC access and 4 minute expire time on zone transfers! (Compare this to some blacklists which take longer than this just to get to complete a single transfer!) QUALITY AND DISCERNMENT: Both lists have an amazing ability to block the very dirty ESPs which are more "pretenders" who are trying to "look" like legit ESPs, but haven't really ever sent to a true confirmed opt-in subscriber. Yet, at the same time, both Invaluement lists are very good at NOT targeting ESPs know to have sent **some** amount of legit opt-in e-mail. In other words, e-mail admins probably won't have to use that sledgehammer as often if they would employ this "surgeon's scalpel". Additionally, **spammers beware** messages are kept "on file" as "evidence" for EVERY SINGLE LISTING. In the event of a suspicious listing being questions by the sender, the intended recipients WILL be contacted to confirm or deny that they opted in! Also, MUCH behind the scenes auditing takes place to ensure quality! *********************************** PRICE: What are the fees for usage? *********************************** First, these lists are NOT for free. The are available ONLY via RSYNC or BIND Zone Transfer. The price ranges from $12.50/month to $605/month, depending on such things as # of users being protected, willingness to allow us to list you as a subscriber, linking to our website, etc. I expect that most subscribers will pay either the lowest price, or close to the lowest price. The higher prices are more for exotic users and VERY large ISPs or filtering providers. One price procures access to BOTH Invaluement-SIP **and** Invaluement-URI. ALSO: No anonymous usage allowed. Payments will be via paypal... but the basic contact information provided at the time of signup must be legit and authentic. **************************** WEEKEND PROJECT INSTRUCTIONS **************************** For the next 2-4 days, I'll provide FREE access to these lists. Send me an e-mail with the following: (1) Name & contact information, including phone number & e-mail address, company, etc. (2) Tell me the approximate number of mailboxes/users that your use of this product will protect if/when you decide to officially subscribe. (3) Let me know if you need RSYNC access, or Bind Zone Access, or both (4) Include the IP address that I should grant permission for the access type specified. *************************************** STEEP DISCOUNTS IN RETURN FOR TESTING!! *************************************** The first 10 people who post a thoughtful and detailed analysis of the results of their testing went will get a special discount if/when they decide to subscribe. The post must be to either the SpamAssassin list or the SPAM-L list. Please refrain from further posts on the URIBL & SURBL lists as I have permission to make this announcement there... but NOT to discuss this in depth there since those lists are NOT for general spam fighting techniques/tools. The first 10 people who spot an egregious FP will get this same discount. Sent the (munged) URI to my address along with the message it was spotted in zipped. SPECIAL DISCOUNT: If you protect less than 100,000 users/boxes, you'll get the first 6 months at $1/month. If you protect more than 100,000 users, you'll get the first 6 months at half the regular price (which would first be calculated depending on other options chosen, THEN the ADDITIONAL discount applied. Testing access will be cut off soon after the product is "officially" released... but these discounts will STILL be obtainable (to be applied to subsequent months) until the 10 & 10 spots have filled up. *************************** HOW TO JUDGE/TEST THIS DATA *************************** Simple. (1) Does using these lists cause your filtering to block MORE spams than it otherwise would if you didn't use this list. (2) Does it do with WITHOUT causing FPs... or is the FP rate low compared to other such lists. IMPORTANT: Testing must be done on "live" data and using constantly synced datalists. Otherwise, you diminish many of the most important the advantages that set this list apart from others. You can "score" the "hits" low on live data if you want to test it in a "safe" way. Try to devise a system where you can examine what both of these lists "hit" on that got overall missed by your spam filter. Running the lists against recent corpuses will only work for spotting FPs... but, even then, be sure it wasn't really a "False Negative"! Remember, if you are blocking 96% of all spam and use of these two lists improves your catch rate to 97%... a one percent reduction might not seem like a lot... but the key percentage is the drop in the spam that your users SEE!! Therefore, if the amount of spam which gets past your filter through drops from 4% down to 3%, this is a whopping 25% reduction in the amount of spam that your users see. That is huge! If someone did that for you, what would you do in return? You'd hug them... take them out to dinner... thank them profusely. I contend that these "Invaluement blacklists" will be "on par" with those kind of results and you'll find the fees to be low compared to what you are getting in return. *************** GETTING STARTED *************** Contact me, Rob McEwen, today and I'll provide you the access information. For access, send the requested information to the following: invaluement(a)PowerViewSystems.com (PLEASE - keep discussion about this on the SURBL list to an absolute minimum. SA and SPAM-L are more appropriate. Or e-mail me directly.) Rob McEwen PowerView Systems invaluement(a)PowerViewSystems.com

1 0

Re: [Uribl-discuss] Fw: Requesting Your Permission or "Why Mardev and Outward Media should be RBL Listed"
by Kevin A. McGrail 19 Apr '07

19 Apr '07

> When the legislation was first passed we did support opt out for B2B, > small business who for the first time can trade with big business on an > equal footing would have been slaughtered. > > We fully anticipate however that opt in legislation is on the cards and > have adopted that policy from day one. Do you not understand that these two statements are mutually exclusive? How can you possibly promote the legal changes for opt-out and then claim a policy of opt-in from day one? Small business don't deserve to be able to SPAM business just because they aren't large. As far as I'm concerned Mardev was principally involved in passing the convoluted law to being with making you a two-faced, wish-washy, snake-oil selling salesperson hiding behind laws and blowing wherever the winds take you. However, if Mardev doesn't actually send B2B opt-out emails, then I imagine you won't end up on an RBL. But if you do, expect to be submitted for listing in a heartbeat. KAM

1 0

Re: [Uribl-discuss] Fw: Requesting Your Permission or "Why Mardev and Outward Media should be RBL Listed"
by Kevin A. McGrail 19 Apr '07

19 Apr '07

> We collect 100% of our emails by opt in and document every permission. > And, if you had read anything I have written you would know that I > recommend that all other companies follow this policy and go beyond the > legislation. > > We do no mass broadcasting. A typical communication would be an email to a > farmer who has told us that he has pigs, receiving a notification about a > swine flu inoculation. Really? While this might be a personal position, the evidence again Mardev available from a simple web search does NOT agree. "Mardev is the list management division of Reed Business Information (RBI), the world's largest business information supplier. We specialize in business-to-business (B2B) lists for direct marketing campaigns. Our lists cover all market sectors including manufacturing, mining, entertainment, finance, media, building & construction & travel. We have access to over 300 B2B databases worldwide, including 300,000 Australian records." >From the Department of Trade and Industry in the UK, you even supported changing the law in the UK asking that the law allow B2B SPAM without consent based on the opt-out principle: http://www.silicon.com/research/specialreports/thespamreport/0,39025001,391… "We have reviewed the responses in detail to ensure that we provide you with an accurate list and have found that six organisations supported opt-out for business-to-business direct marketing emails." Those six organisations, according to the DTI, were Cable & Wireless, Information & Research Services, Holiday-Rentals.com, Mardev, Masterclass and Taylor Wessing. So, as I understand it, no only is it legal in the UK to use opt-out b2b mailing practices but your firm helped change the law for this. And your firm directly utilizes AND advertises based on this loophole: http://www.prnewswire.co.uk/cgi/news/release?id=140795 DecisionMaker Portrait allows marketers to identify the contacts available within DecisionMaker - Mardev's business targeting database of over 2.8m named UK records - that are most likely to respond to their proposition. The model offers a sophisticated method of selecting prospects that will significantly improve response rates and win more business. Is what you are doing legal, sure. Is it spam? In my opinion, yes. KAM

1 0

btassets.co.uk
by Phil (Medway Hosting) 19 Apr '07

19 Apr '07

Hi folks Could someone from surbl kindly give me an idea of what the problem is with btassets.co.uk please ? I am currently having a major row with them, but have actually achieved getting their Chairman's Dept interested - mainly because I have told them the abuse I am seeing will be chargeable at £50 +vat per email and they have already attempted to deliver 250 !! Any info would be useful. Many thanks Phil _____________________________________________ Website Hosting from only £5.00 per month. www.medwayhosting.com - +44 (0)1634 856965 _____________________________________________ Digital & Traditional Printing, and much more www.medwayprint.com - +44 (0)1634 281199 _____________________________________________

3 3

Fw: Requesting Your Permission
by Kevin A. McGrail 19 Apr '07

19 Apr '07

HITN ConfirmationBelow is an email I received, purportedly on behalf of Avis from a company called Outward Media. Does anyone know if this is a legit firm? To me it looks potentially legit but that Avis has given the marketing duties to a questionable firm. For example, I haven't used the email address below in close to 4 years! Anyone ever heard of csmarketingmail.com or Outward Media? They claim to be CAN-SPAM compliant but, as written before, this isn't a legal issue as much as a consent issue. And from the info at http://www.outwardmedia.com/b2b.html, it looks to me like they mine data: Domain match - Our proprietary software process generates primary corporate email address at 8.5 million companies using associated email domain and historically accurate email domain pattern. Thoughts? Regards, KAM ----- Original Message ----- From: Outward Media To: kmcgrail(a)peregrinehw.com Sent: Wednesday, April 18, 2007 3:12 PM Subject: Requesting Your Permission Dear subscriber, Outward Media, Inc. (OMI) is an email marketing agency. OMI is asking your permission to send you special offers from Avis Rent A Car via e-mail. Avis strives to make it easier for you to do business with them and they would like to provide you with relevant and valuable information about their services, as well as special promotions designed to help meet your business travel needs. While we find the majority of people appreciate receiving this information, you may request to be excluded from future Avis mailings. You may unsubscribe by clicking the following link: Unsubscribe Please do not reply to this e-mail. OMI provides CAN-SPAM compliant email services. If you opt not to recieve business emails from Avis, your email address will be removed from the file within 10 business days of opting-out. You can learn more about Avis online at www.avis.com Thank you for the opportunity to share information with you.. Sincerely, Outward Media Inc. 9229 Sunset Boulevard, Suite 306, Los Angeles, CA 90069 www.outwardmedia.com This email message is on behalf of: Avis World Headquarters 6 Sylvan Way Parsippany, NJ 07054 (973) 496-3500 .

2 1

Re: Strange blacklisting
by Jeff Chan 16 Apr '07

16 Apr '07

On Sunday, April 15, 2007, 6:22:58 PM, AshtonWood AshtonWood wrote: > Hi there, > It has come to our attention that our domain securestix.com may have ended > up on a "Blacklist" of yours recently. > This may have been from our most recent once-only mail out to a list > supplied by the organisers of a trade show we recently exhibited at. > We've checked all of your lists in surbl.org, but cant find out domain in > there, yet the messages we are receiving indicate that surbl.org is the > group blacklisting us. > Can you please have a look and advise if we are in fact blacklisted? > You can call me directly to discuss if required. > Ashton Wood > Director > Ph: 0412 281 900 > Intl: +61 412 281 900 Please send all removal requests to whitelist at surbl. org as described in the removal instructions at: http://www.surbl.org/lists.html#removal Jeff C. -- Don't harm innocent bystanders.

1 0

Difficulty with rsync information change request
by Bryan K Walton 03 Feb '07

03 Feb '07

Hi guys, I'm curious if anybody can help me with some problems we are having with our rsync access. We currently have rsync access for our mailserver. But we have since built a new mailserver that currently sits in front of the one with rsync access. We would like to change our rsync access from this existing server to the new one, as we will be taking the old one down soon and do not currently have an estimate for when it will come back online. Over the last two months, I requested rsync access for this new box a total of four times (two requests on the surbl.org website, and the other two as direct emails to the email address that gave us the original access, an account belonging to a Raymond Dijkxhoorn). Anyway, we have heard nothing back about our request. Is there anybody on this list who can assist me in this change? Thanks, Bryan Walton Machlink.com

2 2

List of URL redirectors and Perl code to parse them?
by Kelly Jones 16 Jan '07

16 Jan '07

I know that rd.yahoo.com (for example) is a URL redirector that spammers use to get around SURBL. I also know that if I see a URL like rd.yahoo.com/?http://foo.bar.com, I should actually lookup bar.com.multi.surbl.org. Not all redirectors are this simple: some allow MIME-encoding or %-encoding of the target URL, others use different characters to separate the target URL from the redirector, etc. Is there a fairly complete list of URL redirectors I could use, along with code (ideally Perl code) that converts/de-obfuscates "redirector URL" to "target URL"? -- We're just a Bunch Of Regular Guys, a collective group that's trying to understand and assimilate technology. We feel that resistance to new ideas and technology is unwise and ultimately futile.

3 5

Re: [SURBL-Discuss] Why is multi's rsync file so large?
by Rob McEwen (PowerView Systems) 11 Jan '07

11 Jan '07

> You can easily strip it out the text field with sed, awk, cut, > perl, grep, etc. Remove the text before you load the zone into > rbldnsd, for example as a filter in your rsync cron job (scheduler). Thanks Jeff! I'm looking into this now! Rob McEwen PowerView Systems rob(a)PowerViewSystems.com

1 0

Re: [SURBL-Discuss] Local Caching Name Server
by Rob McEwen (PowerView Systems) 11 Jan '07

11 Jan '07

I recommend TreeWalk. Upon installation, it defaults to a caching name server. SEE: http://ntcanuck.com/ Rob McEwen PowerView Systems rob(a)PowerViewSystems.com -----Original message----- From: Jeff Chan jeffc(a)surbl.org Date: Thu, 11 Jan 2007 03:10:35 -0500 To: Max Yang onmywayup(a)hotmail.com Subject: Re: [SURBL-Discuss] Local Caching Name Server > On Wednesday, January 10, 2007, 10:12:32 PM, Max Yang wrote: > > Hi > > > I want to set up a local caching name server, in a Windows XP Pro box > > How could I do it? > > Max > > I found this using google: > > http://www.microsoft.com/technet/prodtechnol/winxppro/reskit/c24621675.mspx > > Jeff C. > -- > Don't harm innocent bystanders. > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Re: [SURBL-Discuss] Local Caching Name Server
by Jeff Chan 11 Jan '07

11 Jan '07

On Wednesday, January 10, 2007, 11:04:54 PM, Max Yang wrote: > I don't think that it's an answer for my question OK maybe you want to run rbldnsd under Windows? Fortunately there is now a Windows port: http://www.itefix.no/wrbldnsd/ Jeff C. -- Don't harm innocent bystanders.

1 0

Local Caching Name Server
by Max Yang 11 Jan '07

11 Jan '07

Hi I want to set up a local caching name server, in a Windows XP Pro box How could I do it? Max _________________________________________________________________ 聰明搜尋和瀏覽網路的免費工具列 — Windows Live 搜尋工具列 http://toolbar.live.com/

2 1

Re: [SURBL-Discuss] Why is multi's rsync file so large?
by Rob McEwen (PowerView Systems) 11 Jan '07

11 Jan '07

Raymond Dijkxhoorn said: > In a era where you talk about gigabytes ram? Talking about this only costs > more ;) eh eh ... Excellent point. And I apologize in advance that this has now veered away from SURBL. (originally, I mistakenly thought this file size bloat might have been an SURBL problem... but it turns out there is NOT really any technical problems) ...but while we are "here"... On my server, I now have a large combination of various rsync subscriptions to various RBLs and DNSBLs that I use in my RBLDNSD. The problem is that my RBLDNSD program now uses a whopping 500MB of RAM. (again, not SURBL's fault... this is a combination of many different lists) So far, that isn't enough RAM to cause problems... but I noticed some sluggishness on my server today and, it turns out that sometimes, when RBLDNSD is "refreshing" its data, it re-builds an entire extra copy of the data in memory, along side the original copy. And this rebuilding can sometimes take several minutes to complete. Apparently, when done, it kills the old copy and start using the new copy. (again... I don't know why it has to rebuild the whole thing... but, then again, I don't know a whole lot about the inner programming of RBLDNSD) When this gigabyte of RAM is being used, I actually see a marked performance decline on my 2GB or Ram server. I know that one could argue that I ought to get more ram for my server... but I think instead I'll program a utility to periodically strip all these comments out of the records and point RBLDNSD to the stripped down versions. I'd be curious as to what the RBLDNSD performance and memory usage ends up being! Also, **getting back to SURBL** ...if you were to offer a "multi" file with comments stripped out, wouldn't this save bandwidth and rsync server resources if folks used that instead of the current offering? Rob McEwen PowerView Systems rob(a)PowerViewSystems.com (478) 475-9032

2 1

Re: [SURBL-Discuss] Why is multi's rsync file so large?
by Rob McEwen (PowerView Systems) 11 Jan '07

11 Jan '07

>Just look inside the file and you will see? Since multi used shared lists >each comment line is added for each host seperately and not like the >seperate lists one comment field for all. OK. That makes sense... but I have a follow-up question. Does rbldnsd take up more memory by including that comment as the equivalent of a "text record" for DNS lookups that might attempt such a lookup against rbldnsd? If so, I'm thinking that, as beneficial as this might be in some scenarios, it sure probably uses a whole lot of extra ram on the server hosting the rbldnsd, correct? Rob McEwen PowerView Systems rob(a)PowerViewSystems.com (478) 475-9032

3 2

Why is multi's rsync file so large?
by Rob McEwen (PowerView Systems) 10 Jan '07

10 Jan '07

Why is multi's rsync file so large? Am I doing something wrong with my rsycn? I'm thinking that multi should be, at most, the sum of the parts of the other lists... In fact, it should really probably should be **smaller** than the sum of its parts because of MUCH overlapping data getting consolidated in multi. 01/10/2007 02:03 PM 8,883 ab.surbl.org.rbldnsd 12/23/2006 11:53 AM 101,506 be.surbl.org.rbldnsd 01/10/2007 02:12 PM 5,760,311 jp.surbl.org.rbldnsd 01/10/2007 02:19 PM 75,027,410 multi.surbl.org.rbldnsd 01/10/2007 02:11 PM 6,826,763 ob.surbl.org.rbldnsd 01/10/2007 01:48 PM 330,910 ph.surbl.org.rbldnsd 01/10/2007 02:11 PM 1,435,961 sc.surbl.org.rbldnsd 07/09/2006 10:44 PM 0 sc2.surbl.org.rbldnsd 01/10/2007 01:03 PM 5,905,033 ws.surbl.org.rbldnsd 01/08/2007 03:44 AM 810 xs.surbl.org.rbldnsd 10 File(s) 95,397,587 bytes 0 Dir(s) 105,311,490,048 bytes free ...and some of these lists are no longer used in multi (or never were to begin with). Given the size of the component parts, shouldn't the multi file be somewhere around 10-20 MBs? Rob McEwen PowerView Systems rob(a)PowerViewSystems.com

3 2

Re: [SURBL-Announce] SURBL testpoint return values changed for multi.surbl.org
by Todd Vierling 16 Dec '06

16 Dec '06

On 12/15/06, Jeff Chan <jeffc(a)surbl.org> wrote: > test.surbl.org 604800 IN A 127.0.0.126 > 604800 IN TXT "multi.surbl.org permanent test point" Juwt as a minor nit, the trditional test domain is "example.com", and most RHSBL type lists have a test point there. Maybe this should also be a test point for SURBL? -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> <todd(a)vierling.name>

2 1

Re: [SURBL-Discuss] Who does run surbl? How often do list update?
by s.takeshi＠daikodenshi.co.jp 29 Nov '06

29 Nov '06

Dear Jeff Chan, Thank you for your answer. > The SURBL data come from many sources, as described at: Are each sources run as NPO? and Why are each sources selected? Are they on the strength of past achievements ? Sincerely 2006/11/29 13:49, Jeff Chan <jeffc(a)surbl.org> wrote: > > On Tuesday, November 28, 2006, 8:07:41 PM, s takeshi wrote: > > Who does run surbl? > > The SURBL data come from many sources, as described at: > > http://www.surbl.org/lists.html > > Was there a specific issue that you are trying to address? > > > How often do lists update? > > The lists update every few minutes. > > Cheers, > > Jeff C. > -- > Don't harm innocent bystanders. > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss

1 0

Who does run surbl? How often do list update?
by s.takeshi＠daikodenshi.co.jp 29 Nov '06

29 Nov '06

Dear mailing list user, I come from japan. Please answer. Who does run surbl? How often do lists update?

2 1

Blacklisting 4th level domains possible? (dsl.connexus.net.au)
by Kelly Jones 24 Nov '06

24 Nov '06

Can SURBL blacklist 4th level domains? "connexus.net.au" is a perfectly valid domain, but subdomains of "dsl.connexus.net.au" are a bit suspicious. I got a spam referencing 106-147.dsl.connexus.net.au, probably someone running a webserver on their DSL connection. Reading http://www.surbl.org/implementation.html and http://spamcheck.freeapp.net/two-level-tlds makes me think only 2nd and 3rd level domains can be blacklisted. Am I wrong and/or is there any chance this will change? In theory, 3rd level domains like "connexus.net.au" could be added to two-level-tlds (ok, the name would have to change), and the implementation rule would be: 1) If the tail of your domain is listed in two-level-tlds, check one level deeper. Examples: if your domain ends in "guernsey.gg", SURBL-check "whatever.guernsey.gg"; if you domain ends in "connexus.net.au", check "whatever.connexus.net.au" 2) If the domain's not listed in two-level-tlds, check 2 levels deep (eg, "whatever.com").

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss