- Discuss - Mailman 3

RE: [SURBL-Discuss] Pleaae beta test ds.surbl.org - 6dos data
by Chris Santerre 29 Jun '04

29 Jun '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, June 29, 2004 1:21 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Pleaae beta test ds.surbl.org - 6dos data > > >On Monday, June 28, 2004, 7:46:16 PM, David Coulson wrote: >> Jeff Chan wrote: >>> Please do not use ds.surbl.org for production mail servers as it >>> is hosted only on my name server. > >> Even though it took a day to load (almost), I've got it >running on ns10 >> if you want to add that to the NS glue. > >Thanks David. I'd like to see what kind of false positive rates >we see before committing to running it for real. > >As a data point, 6dos hit 300 whitelist entries out of 120,000 >records, which is about a ten times greater whitelist hit *rate* >than ob.surbl.org. > 0.25% fp rate, so it has an S/O rating of 99.75 :) Actually that is great info. Can we get the whitelist hits? This might be a great way to tweak the 6dos list. I'm also very interested in who hit the whitelist. I'd like to see the xref in 6dos to see who these people are dealing with. I think RSK would be interested as well. Even if we have to clean up 1-2% of these listed, look how many evil domains we get. But I fully understand your philosophy on this Jeff. Some of these evil domains may not have spammed.....yet. ;) --Chris

2 1

Just to say thanks
by David Thurman 29 Jun '04

29 Jun '04

We are using the spamcop_uri with the 3 main feeds, ws, ob, ab and the main man and we are seeing a reduction of 4-5 in our mail box in the mornings to 1, of course all the other junk is nailed with SA. Great idea and a great addition to fighting the ads for pills, my small p*nis and my girlfriends undersized headlight notifications as well as the fact that I am approved for high interest loans. I am so gullible that I now can rest easy knowing I won't be taken ;) Thanks to the SURLB team... -- David Thurman The Web Presence Group http://www.the-presence.com Web Development/E-Commerce/CMS/Hosting/Dedicated Servers 800-399-6441/309-679-0774

2 1

RE: [SURBL-Discuss] rDNS entries
by Chris Santerre 29 Jun '04

29 Jun '04

>-----Original Message----- >From: Dave Navarro [mailto:dave@basicguru.com] >Sent: Friday, June 25, 2004 12:53 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] rDNS entries > > >One thing I notice is that the IP addresses of blacklisted >domains are not >always listed in the BL as well. > >For example, when I look up: > > ghcclccc.biz.multi.surbl.org > >It's listed. However, when I look up: > > 72.2.139.221.multi.surbl.org > >it's not listed. > >Might I suggest that all domains listed in the BL also include >corresponding IP addresses? > That might hurt a lot of virtually hosted and legit sites. We only list IPs if a spam URL explicitly lists the IP. --Chris

3 3

Pleaae beta test ds.surbl.org - 6dos data
by Jeff Chan 29 Jun '04

29 Jun '04

Please beta test ds.surbl.org which is the 6dos data turned into a SURBL. In particular, please check the false positive rate and let us know what you find. Please do not use ds.surbl.org for production mail servers as it is hosted only on my name server. (Chris, the list has about 120,000 entries. Were there some .c files which we should exclude?) Please note that I have removed ob2.surbl.org as it was for testing only and the data source for it is now used as ob.surbl.org. Jeff C.

3 5

RE: [SURBL-Discuss] The beast has been fed. 6dos now in WS.surbl. org
by Chris Santerre 29 Jun '04

29 Jun '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, June 28, 2004 5:28 PM >To: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] The beast has been fed. 6dos now in >WS.surbl.org > > >On Monday, June 28, 2004, 12:31:24 PM, Chris Santerre wrote: >> The '6dos' project domains have now been fed into >ws.surbl.org. This is a >> huge collection of spam domains. The reason I did this now >is the format is >> changing and it would have been a nightmare to do this later. > >> I briefly looked thru them, but there are a LOT. I expect a >few FPs. But for >> the shear number of domains you can't beat it. I will remove >any reported >> FPs. Bill if you want to whitelist some if I can't get to >them right away, >> go ahead. I will post when I remove, or if they are spammers and the >> whitelist needs to be removed. > >> This is a great addition. And NO I can't tell you the source >of the '6dos' >> project. You will just have to contact me with any questions :) > >NO!!!!!!! DO NOT DO THIS. Stop yelling or I'll start calling you my wife ;) DOn't think I won't.....honey! :P > >Rich's list is way too big and inaccurate for our use in terms >of false positives. It will ruin SURBLs and people's use of them. Yes and no. But have a look at the file I posted. > >The huge list is probably the reason Bill's server is choking >now. Damn I hope it wasn't the list that killed it! That would suck! But size wise it didn't look any bigger then some of the other lists people had submitted. But I have no problems making this a seperate SURBL list. The data is very good once you look at it. Sorry if I seem testy. I'm on a 3 week schedule of no Hockey. I'm ready to kill at a moments notice :) --Chris

2 1

RE: [SURBL-Discuss] The beast has been fed. 6dos now in WS.surbl. org
by Chris Santerre 29 Jun '04

29 Jun '04

Agreed. But I still think you should leave the updated version up ;) Here is what I added: http://www.merchantsoverseas.com/domains-1.tar.gz link good until 2 PM tomorrow. >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, June 28, 2004 7:35 PM >To: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] The beast has been fed. 6dos now in >WS.surbl.org > > >I spoke with Bill Stearns and Chris Santerre separately by >phone, and what we came up with is to put the 6dos data into a >new, separate list, reflecting that it's a larger data source >with a different philosophy behind it. It tends to be more >inclusive than some of the other lists, meaning it may have >greater potential for false positives. And at about 80,000 >entries, it's clearly a larger list then our others, which >currently max out at about 20,000 for ob and ws (natively). >The 80,000 records in 6dos probably have *not* been hand-checked. > >Chris expressed that he's becoming more comfortable using 6dos >since the author has been adding some more cross-checking of the >data, but we all agreed the data may be better in a separate >list. Maybe I'll call it 6d or 6dos.surbl.org. > >By the way Bill's server is being worked on right now, so >we don't have the ability to update ws to disable the 6dos >inclusion. Chris will do that when he's able to next. > >Until then I've reverted ws.surbl.org to an older version of >the list that I had from three days ago. That should be >reasonably close to the pre-6dos version that was being >served before. > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

The beast has been fed. 6dos now in WS.surbl.org
by Chris Santerre 29 Jun '04

29 Jun '04

The '6dos' project domains have now been fed into ws.surbl.org. This is a huge collection of spam domains. The reason I did this now is the format is changing and it would have been a nightmare to do this later. I briefly looked thru them, but there are a LOT. I expect a few FPs. But for the shear number of domains you can't beat it. I will remove any reported FPs. Bill if you want to whitelist some if I can't get to them right away, go ahead. I will post when I remove, or if they are spammers and the whitelist needs to be removed. This is a great addition. And NO I can't tell you the source of the '6dos' project. You will just have to contact me with any questions :) So the beast has been fed a proper dinner. Be ready for a few burps! Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 3

ws / be / bigevil.cf
by Mariano Absatz 29 Jun '04

29 Jun '04

Hi, according to http://www.surbl.org/lists.html#be be.surbl.org is deprecated and ws.surbl.org has the data from bigevil.cf. Does that mean that if I use 'ws.surbl.org' I can stop using bigevil.cf altogether? Or are there reasons to keep using bigevil.cf even when I use ws.surbl.org? Regards. -- Mariano Absatz El Baby ---------------------------------------------------------- When I was kidnapped, my parents snapped into action. They rented out my room. -- Woody Allen

2 1

RE: [SURBL-Discuss] Re: [SARE] Bigevil IMPORTANT update/test.
by Chris Santerre 28 Jun '04

28 Jun '04

I will be coming out with a wildcard BE. But not for a while. I have to finish a ton of stuff. DOn't worry, I'm sure there will be a grand announcment. ;) --Chris >-----Original Message----- >From: Andy Jezierski [mailto:ajezierski@stepan.com] >Sent: Friday, June 25, 2004 12:30 PM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail); Spamassassin-Talk (E-mail) >Subject: [SURBL-Discuss] Re: [SARE] Bigevil IMPORTANT update/test. > > > > > > >Chris Santerre <csanterre(a)MerchantsOverseas.com> wrote on 06/25/2004 >11:21:20 AM: > >> I have no idea how this will effect systems under heavy load. Those >systems >> should definitely stay with SURBL as this is just a local >regex copy of >it. >> But for those systems that can't/won't use SURBL and want a >local copy of >> this larger bigevil here is the link: (~600k) >> > >Will you be coming up with a MiniEvil that contains just the wildcard >rules? Or have all the wildcard sites been added to surbl >individually? > >Andy > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] ob and ab added to multi.surbl.org, docs upda ted for multi use
by Chris Santerre 28 Jun '04

28 Jun '04

>Nah. go ahead and announce! other products will want to use >it, no need for them to wait for SpamAssassin. ;) OUCH, thats not funny! ;) --Chris

1 0

RE: [SARE] Bigevil IMPORTANT update/test.
by Chris Santerre 28 Jun '04

28 Jun '04

Yes this is exactly what will be happening. There will be a dynamic only bigevil. Not only looking for domain names. But things like directory names in a recent spam campaign, or anything else in common with a recent spam storm. No time set yet for this to happen. But it will be a whole different ruleset. I need to finish the set I'm working on now. --Chris >-----Original Message----- >From: Jesse Regier [mailto:jregier@accesshub.com] >Sent: Friday, June 25, 2004 6:13 PM >To: Spamassassin-Talk (E-mail); SURBL Discussion list (E-mail) >Subject: Re: [SARE] Bigevil IMPORTANT update/test. > > >Wouldn't it make sense to create two new lists > >BIGBIGEVIL: generated from the surbl list >WILDLYEVIL: Wildcard only domains > >and keep BIGEVIL the way it is for a few months or so? > >I am currently using ws.surbl.org and the current BIGEVIL list >via rules_du_jour on several servers. (I wanted to keep the >wildcard domains.) >If a lot of people are doing this they could be taken by >surprise when the >BIGEVIL list suddelnly gets bigger. > >Hey, thanks to you and all the ninjas, for all the good work!! > >Jesse > >On 25 Jun 2004 at 12:21, Chris Santerre wrote: >> >> The only updates I've been doing to the regular BE is >removing a few FPs. I >> will not officially make this new large file the regular >Bigevil for at >> least a week. > >-------------------------------------------------- >Jesse Regier >Computer Systems, Inc. >(402) 330-3600 >-------------------------------------------------- > >

1 0

Re: [SARE] Bigevil IMPORTANT update/test.
by John Wilcock 28 Jun '04

28 Jun '04

On Fri, 25 Jun 2004 17:13:03 -0500, Jesse Regier wrote: > BIGBIGEVIL: generated from the surbl list > WILDLYEVIL: Wildcard only domains > > and keep BIGEVIL the way it is for a few months or so? > > I am currently using ws.surbl.org and the current BIGEVIL list > via rules_du_jour on several servers. (I wanted to keep the wildcard domains.) > If a lot of people are doing this they could be taken by surprise when the > BIGEVIL list suddelnly gets bigger. Seconded. I don't use bigevil directly myself any more but I can see people having a huge evil surprise, particularly if the proposed change were to happen during the summer with many admins away on holiday leaving their boxes in the hands of often less experienced backups. John. -- -- Over 2400 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr

1 0

RE: [SURBL-Discuss] Please test ob, ob2, ab
by Joseph Burford 28 Jun '04

28 Jun '04

> > ob2.surbl.org > > Please beta test it against ob.surbl.org Jeff, Data from my test box is below, hope this helps. 25/06/2004 - 3,756 messages 1,816 marked as spam Description Total Ham % Spam % URL in ws.surbl.org 802 9 1.1 793 98.9 URL in ob.surbl.org 711 10 1.4 701 98.6 URL in sc.surbl.org 621 1 0.2 620 99.8 URL in ob2.surbl.org 617 1 0.2 616 99.8 URL in ab.surbl.org 377 6 1.6 371 98.4 URL in be.surbl.org 44 0 0 44 100 26/06/2004 - 2,362 messages 1,566 marked as spam Description Total Ham % Spam % URL in ob.surbl.org 678 1 0.1 677 99.9 URL in sc.surbl.org 626 0 0 626 100 URL in ob2.surbl.org 624 0 0 624 100 URL in ws.surbl.org 576 1 0.2 575 99.8 URL in ab.surbl.org 415 17 4.1 398 95.9 URL in be.surbl.org 70 0 0 70 100 27/06/2004 - 1,956 messages 1,313 marked as spam Description Total Ham % Spam % URL in sc.surbl.org 625 0 0 625 100 URL in ws.surbl.org 622 2 0.3 620 99.7 URL in ob.surbl.org 590 0 0 590 100 URL in ob2.surbl.org 590 0 0 590 100 URL in ab.surbl.org 423 0 0 423 100 URL in be.surbl.org 32 0 0 32 100 Regards, Joseph

2 1

Multiple URIs
by David Coulson 27 Jun '04

27 Jun '04

I sent myself an e-mail with two URIs, two different domains, which are in a number of surbl lists (sc, ws and ob specificly). However, only the first domain was actually 'caught' and included in the spam filter report in SA (2.63). Shouldn't each specific domain which is included in a SURBL be used to establish a score? I know it's unusual for a spam to include a URI for two different domains, but shouldn't it increase the score anyway? David

4 4

[SURBL-Discuss] ob and ab added to multi.surbl.org, docs updated for multi use
by Jeff Chan 27 Jun '04

27 Jun '04

We've added the content from ab and ob into multi.surbl.org, so it now has all the currently active lists: http://www.surbl.org/lists.html with the following bitmasks representing the different lists: 2 = comes from sc.surbl.org 4 = comes from ws.surbl.org (and be.surbl.org) 8 = comes from phishing list (labelled as ph in multi) 16 = comes from ob.surbl.org 32 = comes from ab.surbl.org I've also updated the SURBL Quick Start page: http://www.surbl.org/quickstart.html to link to the updated URIDNSBL.pm page containing the urirhssub program which can use multi.surbl.org: http://spamassassin.org/full/3.0.x/dist/lib/Mail/SpamAssassin/Plugin/URIDNS… and also added sample configs for using multi.surbl.org based on the sample URIBL configs at: http://www.spamassassin.org/full/3.0.x/dist/rules/25_uribl.cf Would someone who has actually used urirhssub please check the sample configs and scores for correctness? Updating the documentation like this is in preparation for the release of SA 3.0. Does anyone have any thoughts on when we should announce the multi.surbl.org support? Should it wait until 3.0 is fully released or not? Jeff C.

2 2

[SURBL-Discuss] One resource in identifying spammers trying to use your service
by William Stearns 26 Jun '04

26 Jun '04

Good afternoon, administrator, Thanks for providing the tinyurl service - the links you provide are a lot easier to type. I'd like to offer one free resource to you in trying to keep your system from being abused by spammers. I maintain a blacklist of spam domains at http://www.stearns.org/sa-blacklist/ ; the specific file you'll probably want is http://www.stearns.org/sa-blacklist/sa-blacklist.current.domains . This is a list of ~22,700 spammer domains. Would you consider checking the domains people submit for tinyurl against that list as part of the tinyurl creation process, and if found, perhaps not provide a tinyurl for it? If you'd rather not check against a file that large or you want to do this over dns, you can also place a lookup for that domain against submitted.domain.ws.surbl.org - if you get back an "A" record for it, it's in the above list. More details at http://www.surbl.org . Please let us know if you have any questions or concerns. Cheers, - Bill --------------------------------------------------------------------------- "Silly hacker, root is for administrators." -- Unknown (Courtesy of Fabrice MARIE <fabrice(a)celestix.com>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

1 0

[SURBL-Discuss] Please test: ob.surbl.org - Outblaze spamvertised sites
by Jeff Chan 26 Jun '04

26 Jun '04

Please start testing: ob.surbl.org on your low-volume mail servers. Currently it's hosted only on a few name servers, so please don't put it into production on any high volume mail servers yet. We are particularly interested in hearing your False Positive rates. If the testing is successful we will ask the rest of our name servers to carry it, document it, announce it, etc. This list has about 40k domains on it. We still looking for ways to prune it down, for example by expiring domains that no longer resolve. If someone had a reliable master list of expired domains, that could be very helpful. The data for this list is kindly supplied by Outblaze, and they use it internally for blocking spams. Here is how Yusuf Goolamabbas describes the data sources: __ We gather the domains 4 different ways: 1) spam complaints that have been handled by a human (postmaster/abuse/support people who actually see the spam). for the next 3, "new" is defined as: Whois reports the domain as newly registered(registered within last 90 days) 2) crawling thru our undeliverable outbound queues. When we get spam from a domain (mailFrom), some bounces are generated. These bounces are handled by a central queue. That central queue is looked at every 60 minutes to see where emails are bound to. If the domain they are bound to is "new" - the domain is blocked. 3) spamtrap body analysis: We have an extensive set of spamtraps. The emails to these accounts are analysed and URLs are extracted. For any domain found in these emails, we check for "new" and if so, its blocked. 4) spam complaint body analysis: Similar to spamcop/yahoo/AOL, we have a feature that allows our users to complain about individual emails "This is spam". All these complaints are analysed and URLs extracted from bodies. If any of these are "new", they are automatically blocked. We currently do not have a whitelist as we have never needed it. Several things prevent the need for a whitelist: a) humans that are allowed to do the blocks know what they are doing :-) b) machines that are doing the blocks will only block based on "new" c) machines cannot block any domain that was previously blocked and then unblocked by human. We do not currently remove/expire domains automatically although its under consideration. Removal procedure is by contacting postmaster at outblaze.com __ We are working with Outblaze to not include some of the domains that are less appropriate for SURBLs, but so far the data looks like it could be quite useful. Please give it a try and let us know what you find. Thanks, Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

5 8

Re: [SURBL-Discuss] Hello
by Dave Navarro 26 Jun '04

26 Jun '04

At 6/25/2004, you wrote: >What lists did you tst, and in what way? I think quantity should not >matter, but quality does. Overhere its catching up 73% of my spam, i dont >see any other RBL doing that currently. Which lists are you checking against? I'm getting between a 10% and 20% catch rate. If I change my code to check both the domain and the IP address for each domain, that goes up to around 30%. I added code that allows me to add my own domains and IP's to a private blacklist. After adding about 100 or so to the private blacklist, I find that the catch rates goes up to 60%. I added another 300 to my private blacklist last night and its up to around 90%, but I did get 3 false positives last night. For my testing I'm simply adding an X-SPAM header and I'm only running it against my own personal domain, none of my clients. --Dave

3 2

Re: Please test ob, ob2, ab
by Alden Levy 26 Jun '04

26 Jun '04

FWIW, I haven't had any fp's, and I've been testing all three since they were released to this list. Of course, I only get about 100-200 spam per day (and 50-100 ham) on my domains. Thanks for all of your hard work! SURBL really reduced my unmarked spam considerably (~75%) over what slipped through with just MS and SA. Regards, Alden Alden Levy Engine No. 9, Inc. 130 W. 57th Street, Suite 12E New York, NY 10019 (212) 981-1122 (212) 725-7202 fax

2 1

RE: [SURBL-Discuss] One resource in identifying spammers trying t o use your service
by Chris Santerre 26 Jun '04

26 Jun '04

Did something like this go to tinyurl.com? Great work Bill! --Chris >-----Original Message----- >From: William Stearns [mailto:wstearns@pobox.com] >Sent: Friday, June 25, 2004 12:48 PM >To: contact(a)littleurl.com >Cc: ml-surbl-discuss >Subject: [SURBL-Discuss] One resource in identifying spammers trying to >use your service > > >Good afternoon, administrator, > Thanks for providing the littleurl service - the links >you provide >are a lot easier to type. > I'd like to offer one free resource to you in trying to >keep your >system from being abused by spammers. I maintain a blacklist of spam >domains at http://www.stearns.org/sa-blacklist/ ; the specific >file you'll >probably want is >http://www.stearns.org/sa-blacklist/sa-blacklist.current.domain >s . This >is a list of ~22,700 spammer domains. Would you consider checking the >domains people submit for littleurl against that list as part of the >littleurl creation process, and if found, perhaps not provide >a littleurl >for it? > If you'd rather not check against a file that large or >you want to >do this over dns, you can also place a lookup for that domain against >submitted.domain.ws.surbl.org > - if you get back an "A" record for it, it's in the >above list. >More details at http://www.surbl.org . > Please let us know if you have any questions or concerns. > Cheers, > - Bill > >--------------------------------------------------------------- >------------ > "Silly hacker, root is for administrators." > -- Unknown >(Courtesy of Fabrice MARIE <fabrice(a)celestix.com>) >--------------------------------------------------------------- >----------- >William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, >freedups, p0f, >rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org -------------------------------------------------------------------------- _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

3 2

Re: [SURBL-Discuss] Please test ob, ob2, ab
by jm＠jmason.org 26 Jun '04

26 Jun '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 My results, testing ph while I was at it: : jm 1351...; grep -v " 0\.500 " freqs OVERALL% SPAM% HAM% S/O RANK SCORE NAME 121405 22516 98889 0.185 0.00 0.00 (all messages) 100.000 18.5462 81.4538 0.185 0.00 0.00 (all messages as %) 13.453 70.3766 0.4925 0.993 1.00 1.00 SURBL_WS 3.807 20.3811 0.0334 0.998 0.50 1.00 SURBL_SC 2.650 14.2565 0.0071 1.000 0.50 1.00 SURBL_AB 0.019 0.0933 0.0020 0.979 0.50 1.00 SURBL_PH 12.624 67.6275 0.1001 0.999 0.50 1.00 SURBL_OB2 13.295 68.5113 0.7230 0.990 0.00 1.00 SURBL_OB OB2 looks pretty promising ;) The one PH fp is a link to this: http://qrxx.4t.com/barbieOS.htm (which no longer works, but 4t.com was a geocities-type hosting site as far as I know.) - --j. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Exmh CVS iD8DBQFA29FBQTcbUG5Y7woRApFTAKCPUG28qwlF7b4wjQkZzyUiZOckngCg1gV0 f9RqbGObobo3E47KBUQUDrI= =x9B1 -----END PGP SIGNATURE-----

4 6

RE: [SARE] Bigevil IMPORTANT update/test.
by Chris Santerre 25 Jun '04

25 Jun '04

>-----Original Message----- >From: Andy Jezierski [mailto:ajezierski@stepan.com] >Sent: Friday, June 25, 2004 12:30 PM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail); Spamassassin-Talk (E-mail) >Subject: Re: [SARE] Bigevil IMPORTANT update/test. > > > > > > >Chris Santerre <csanterre(a)MerchantsOverseas.com> wrote on 06/25/2004 >11:21:20 AM: > >> I have no idea how this will effect systems under heavy load. Those >systems >> should definitely stay with SURBL as this is just a local >regex copy of >it. >> But for those systems that can't/won't use SURBL and want a >local copy of >> this larger bigevil here is the link: (~600k) >> > >Will you be coming up with a MiniEvil that contains just the wildcard >rules? Or have all the wildcard sites been added to surbl >individually? > Yes I will be coming out with a wildcard BE. Scored much lower. WS.surbl.org will not contain those. I'm taking things one step at a time. I'm way behind in my other SARE projects even now. I can't thnk the other ninjas enough for picking up my slack. SARE and SURBL have great people involved in those projects. And of course, no of this would be possible without the great work of the devs! Who's Kung-fu is mighty! --Chris

1 0

[SURBL-Discuss] One resource in identifying spammers trying to use your service
by William Stearns 25 Jun '04

25 Jun '04

Good afternoon, administrator, Thanks for providing the littleurl service - the links you provide are a lot easier to type. I'd like to offer one free resource to you in trying to keep your system from being abused by spammers. I maintain a blacklist of spam domains at http://www.stearns.org/sa-blacklist/ ; the specific file you'll probably want is http://www.stearns.org/sa-blacklist/sa-blacklist.current.domains . This is a list of ~22,700 spammer domains. Would you consider checking the domains people submit for littleurl against that list as part of the littleurl creation process, and if found, perhaps not provide a littleurl for it? If you'd rather not check against a file that large or you want to do this over dns, you can also place a lookup for that domain against submitted.domain.ws.surbl.org - if you get back an "A" record for it, it's in the above list. More details at http://www.surbl.org . Please let us know if you have any questions or concerns. Cheers, - Bill --------------------------------------------------------------------------- "Silly hacker, root is for administrators." -- Unknown (Courtesy of Fabrice MARIE <fabrice(a)celestix.com>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

1 0

OT: RBL needed!
by Doc Schneider 25 Jun '04

25 Jun '04

This Off topic but figured most of us all get hit with this stuff. I am in need of a bit of help. I got a whole bunch of open relays doing rumpelstiltskin(sic) attacks on both my main mailserver and my seconary MX server... hitting the secondary and making it throttle the main one. Anyway is there a way to use some of these RBLs to basically deny these open relays to be able to even attempt these attacks? I'm running Sendmail 8.12.11 on Linux... both these boxen run RH 6.2 and are really locked down against other attacks. I use to just drop routes to these idiots but never a good solution IMNSHO 8*) I looked through the sendmail FAQs and didn't find anything that was helpful. Any idea would be more then welcome. -- -Doc --- MomNDoc Online Consultants http://www.maddoc.net/ momndoc(a)maddoc.net

4 5

RE: [SURBL-Discuss] A question on policy
by Chris Santerre 25 Jun '04

25 Jun '04

Why are you reading here? Content inline below.....go ahead...go read..... >-----Original Message----- >From: David Hooton [mailto:djh-lists@platformhosting.com] >Sent: Thursday, June 24, 2004 5:11 PM >To: 'SURBL Discussion list' >Subject: RE: [SURBL-Discuss] A question on policy > > >> -----Original Message----- >> From: discuss-bounces(a)lists.surbl.org [mailto:discuss- >> bounces(a)lists.surbl.org] On Behalf Of Jeff Chan >> Sent: Friday, 25 June 2004 6:56 AM >> To: SURBL Discuss >> Subject: Re: [SURBL-Discuss] A question on policy >> >> Apparently uptilt.com does appear in message bodies since I see >> it appearing once on SpamCop's spamvertised sites. Chris adding >> it to ws.surbl.org could be ok. > >FWIW - we have had uptilt.com listed in our internal lists for quite a >while. > Sure...tell us now ;) >Jeff's policy is pretty much identical to ours - we don't >generally block >first time offenders (read: Anthony Robbins) who are known to >generally be >reasonable quality content providers. Yeah I try to do the same. This particular thread had me questioning becase the person called the robbin's organisation and they seemed they were not going to do anything about it. So we will see. > >We do however block on site any "Marketing Partners" who have >decided to >"Market" to our customers who have not subscribed to the list >- in this case >uptilt.com > Being a marketing partner is a death sentance around here as well :) --Chris

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss