- Discuss - Mailman 3

RE: [SURBL-Discuss] Possible FP interweave...
by Chris Santerre 20 Sep '06

20 Sep '06

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Wednesday, September 20, 2006 11:27 AM > To: Chris Santerre > Cc: SURBL Discussion List (E-mail) > Subject: Re: [SURBL-Discuss] Possible FP interweave... > > > On Wednesday, September 20, 2006, 8:02:05 AM, Chris Santerre wrote: > > 2.0 URIBL_WS_SURBL Contains an URL listed in the > WS SURBL blocklist > > [URIs: interweave.com] > … [View More]

2 1

Possible FP interweave...
by Chris Santerre 20 Sep '06

20 Sep '06

2.0 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: interweave.com] 3.9 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist [URIs: interweave.com] *might* be an FP. We do business with them. I can't find much in NANAS. And the IP 63.79.28.36 comes up clean. Thanks, Chris Santerre SysAdmin and Spamfighter www.rulesemporium.com www.uribl.com

2 1

[ob] FP?? worklifereward.com-M
by List Mail User 20 Sep '06

20 Sep '06

Hi, This looks like an FP - worklifereward.com-M is owned by Office Depot and is in several URLs in this week's email "flyer". Of course, they have also switched ESPs to postfuture.com-M (Yes, the same) and are mailing from an IP in multiple BLs (64.5.35.226 is currently listed at BLARS, FIVETEN, PSBL, SpamCop and on SPEWS Level 2; Both the PSBL and SpamCop have "reasonable" delisting requirements, so there is trouble). Paul Shupak track(a)plectere.com

2 1

FP: minilien.com
by John Wilcock 15 Sep '06

15 Sep '06

Just spotted this one, on both black.uribl.com and ab.surbl.org - it's a very widely used French-language URL-shortening service. I'd say this is a definite FP. I can see people getting confused about whether minilien are really white hat, given that it now redirects to a page on the unfortunately-named digipills.com - but AFAICT this is also a genuine domain originally created by a medical student and offering free hosting for genuine medically-related content. John. -- -- Over 3000 … [View More]

4 10

Re: [SURBL-Discuss] hotlog.ru?
by List Mail User 14 Sep '06

14 Sep '06

I don't know about any "keystroke logger", but hit13.hotlog.ru-M and click.hotlog.ru-M are the pages used to count "hits" for send-safe.com - There is an open SBL for that alone. Definately "spam support" services. Paul Shupak track(a)plectere.com

1 0

RE: [SURBL-Discuss] FP: minilien.com
by Chris Santerre 14 Sep '06

14 Sep '06

I had delisted them until I saw this post. I like Christians train of thought. I know he has contacted them. Based on what they do, I'll either leave it listed or remove. --Chris > -----Original Message----- > From: Christian Stigen Larsen [mailto:csl@sublevel3.org] > Sent: Wednesday, September 13, 2006 9:32 AM > To: SURBL Discussion list > Cc: uribl-discuss(a)lists.maddoc.net > Subject: Re: [SURBL-Discuss] FP: minilien.com > > > > Den 13. sep. 2006 kl. 15.07 … [View More]

1 0

hotlog.ru?
by MRSCAPTGATOR＠aol.com 14 Sep '06

14 Sep '06

Hey Jeff, did you ever find out what that hotlog.ru was? I believe it may be like a worm were all keystrokes web pages ect. are logged. What do you think? I have reason to believe this! Cin [SURBL-Discuss] hotlog.ru? Jeff Chan _jeffc at surbl.org _ (mailto:discuss@lists.surbl.org?Subject=[SURBL-Discuss]%20hotlog.ru?&In-Reply-To=) Mon Aug 8 06:53:00 CEST 2005 * Previous message: _[SURBL-Discuss] Why you should check Phish IPs first :/ _ (http://lists.surbl.org/pipermail/… [View More]

1 0

Re: [SURBL-Discuss] What to tell senders
by Jeff Chan 12 Sep '06

12 Sep '06

On Tuesday, September 12, 2006, 7:09:14 AM, Joseph Brennan wrote: > Regarding rejection, I realize I just popped up on this list without > intro. Columbia University's mail system refuses about 1 million > messages a day based on Spamhaus, NJABL, DNSBL, high Spamassassin > score, and rules written in Mimedefang. SURBL looks like a good > addition to our arsenal. Sounds reasonable. :-) > Logging in test yesterday and overnight suggests that SURBL will > catch 50,000 … [View More]

1 0

What to tell senders
by Joseph Brennan 12 Sep '06

12 Sep '06

When we reject a message because it contains a URI that is in SURBL, should our 550 message refer the sender to www.surbl.org? The surbl web pages seem to be addressed to mail system administrators rather than general email users. I'm asking partly so that we don't raise the support load on the surbl folks when we start rejecting. Of course there should be near zero instances of ordinary people ever seeing the reject message, making this a moot question. Is any other system directing … [View More]

3 3

Re: [SURBL-Discuss] What to tell senders
by Rob McEwen (PowerView Systems) 11 Sep '06

11 Sep '06

Joseph Brennan asked: > When we reject a message because it contains a URI that is in SURBL, > should our 550 message refer the sender to www.surbl.org? The surbl Joseph: I can't speak officially for SURBL, but I'd suggest stating something like the following in the SMTP return text: "blocked by XXX due to containing a URI listed at www.surbl.org" where "XXX" = your organization or your spam filter. The idea is that we WANT legit senders to give SURBL immediate feedback if/when … [View More]

1 0

RE: Inetesting new URI ploy
by Chris Santerre 11 Sep '06

11 Sep '06

> -----Original Message----- > From: Bill Landry [mailto:billl@pointshare.com] > Sent: Monday, September 11, 2006 2:55 PM > To: users(a)spamassassin.apache.org; discuss(a)lists.surbl.org > Subject: Inetesting new URI ploy > > > Just came across one of these in a spam message: > > bang Locals @ www.nowdatenow. com oopsy no space before com > > Oh what will they try next...? They will take a page from google... Please figure this out and type in your … [View More]

1 0

Inetesting new URI ploy
by Bill Landry 11 Sep '06

11 Sep '06

Just came across one of these in a spam message: bang Locals @ www.nowdatenow. com oopsy no space before com Oh what will they try next...? Bill

1 0

Re: [SURBL-Announce] surblhost is a C command line program to query SURBLs
by Jose Marcio Martins da Cruz 18 Aug '06

18 Aug '06

Hi, Jeff Chan wrote: > Christian Stigen Larsen reports: > > "I've made a simple C commandline program to query multi.surbl.org > > I'd be very happy to receive comments. The program is available > from http://surblhost.sourceforge.net (source only)." I'm sending a little patch attached (configure.ac). It's needed to correct three small things : - under solaris, this program shall also be linked against libnsl and libsocket - you've hardcoded CFLAGS and LDFLAGS (-Wall) … [View More]

2 2

Logo competition
by Jeff Chan 18 Aug '06

18 Aug '06

Do we have any artists here, or access to artists who would like to try to design a logo for the SURBL project? Jeff C. -- Don't harm innocent bystanders.

2 5

Java SURBL client
by Jörg Zieren 16 Aug '06

16 Aug '06

Dear all, this may be of interest to some: The current version of Camel's Eye, a GPL'd client-side Java POP3/SMTP proxy, has support for SURBL (and others). More info is available on http://zieren.de/ce -Jörg -- Jörg Zieren http://www.zieren.de +49 170 7516134 For a list of common abbreviations, see http://www.zieren.de/abk.html Please do not communicate my address to *any* website/service/company

1 0

Program comments: surblhost
by Christian Stigen Larsen 16 Aug '06

16 Aug '06

Hi, I've made a simple C commandline program to query multi.surbl.org I'd be very happy to receive comments. The program is available from http://surblhost.sourceforge.net (source only). Thanks! -- Christian Stigen Larsen, http://csl.sublevel3.org

2 3

Re: Spam in progress bit ...
by opencomputing＠gmail.com 11 Aug '06

11 Aug '06

>>The idea was that data mining in surbl logs (or other RBL / URI services >>by a large number of servers) might enhance accuracy by allowing >>accurate realtime detection of spams in progress. I might be wrong, or >>maybe it's not surbl's role to do such analysis. >> >> > >We allready do.... > > Does that mean that you use this query patterns for a particular URI to delist it, if it is never queried too often from geographically diverse … [View More]

1 0

Spam in progress bit ...
by Eric Montréal 10 Aug '06

10 Aug '06

Just an idea, I don't know if this have ever been discussed. In the course of operating the surbl lists the realtime amount of requests for each listed domain (and each not listed domain as well) and the IP of servers using surbl to do the tests is known. I don't have the data, but I suppose a spam run in progress should be easy to identify by the high number of requests for the spamvertized domain in a short period of time coming from a large number of geographically diverse mail … [View More]

6 7

Re: Spam in progress bit ...
by opencomputing＠gmail.com 10 Aug '06

10 Aug '06

>When was the last time Microsoft got listed in surbl ? > >Smaller lists might end up being sent from a false positive domain and >the idea is that surbl test pattern >(queries/minutes, burst/continuous, historical comparisons, geolocation >and perhaps other metrics) should >allow to differentiate between such a list and a spam run. > > Spammers could add some fake URIs like yahoo.com, gmail.com, microsoft.com to their spam runs so that their mails get a hammy … [View More]

4 3

TLD "fakeouts" - in, at, it, is, to, so
by Rob McEwen (PowerView Systems) 10 Aug '06

10 Aug '06

I've noticed more and more that whenever a fully qualified domain ends in a two letter combo that is actually an english word, this create a problem because often people will start a new sentence with one of these short words and forget to put a space after the last period and before the new "sentence.Like" this! (is that example, if "like" were a TLD, then "sentence.Like" might get picked up by a spam filter for SURBL checking. The problem here is that MANY domains, for example, that end in ".… [View More]

3 2

dns2.registerly.com listed on Spamhaus
by Joe Wein 09 Aug '06

09 Aug '06

I noticed today that the IP range for one of the default name servers for registerfly domains is now listed on SBL http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45242 This includes dns2.registerfly.com but not dns1.registerfly.com. If any of you use SBL listings of name servers for making decisions whether to blacklist suspect domains, be careful not to cause false positives! In any case I hope registerfly will get the message soon and kick off the spammers who've been registering masses of … [View More]

4 3

RE: [SURBL-Discuss] dns2.registerly.com listed on Spamhaus
by Chris Santerre 09 Aug '06

09 Aug '06

> -----Original Message----- > From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] > Sent: Wednesday, August 09, 2006 10:43 AM > To: Jeff Chan; SURBL Discussion list > Subject: Re: [SURBL-Discuss] dns2.registerly.com listed on Spamhaus > > > Hi! > > >> http://www.spamhaus.org/sbl/sbl.lasso?query=SBL45242 > > > >> This includes dns2.registerfly.com but not > dns1.registerfly.com. If any of > >> you use SBL listings of name … [View More]

1 0

Mutogen.be does _not_ appear to be a free hosting site
by William Stearns 02 Aug '06

02 Aug '06

Good afternoon, all, Click on the "Register" link. Am I missing something, or are the spammers setting up fake free hosts now? Cheers, - Bill --------------------------------------------------------------------------- /* * Leonard, I'll tie you, draw around you a pentagram * and read this file. Aloud. */ - from kernel 2.3.40-pre6's drivers/block/DAC960.c -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, … [View More]

2 1

RE: [SURBL-Discuss] Rolex spam on hijacked domains
by Chris Santerre 30 Jun '06

30 Jun '06

> -----Original Message----- > From: Joe Wein [mailto:joewein@pobox.com] > Sent: Friday, June 30, 2006 10:13 AM > To: SURBL Discussion list > Subject: [SURBL-Discuss] Rolex spam on hijacked domains > > > I've seen at least two cases today of domains used in fake > Rolex etc. spams > that were untypically old. The oldest was > > Domain Name: ALLREDMETAL.COM > Registrar: ENOM, INC. > Whois Server: whois.enom.com > Referral URL: http://… [View More]

2 1

Rolex spam on hijacked domains
by Joe Wein 30 Jun '06

30 Jun '06

I've seen at least two cases today of domains used in fake Rolex etc. spams that were untypically old. The oldest was Domain Name: ALLREDMETAL.COM Registrar: ENOM, INC. Whois Server: whois.enom.com Referral URL: http://www.enom.com Name Server: NS2.ALLREDMETAL.COM Name Server: NS1.ALLREDMETAL.COM Status: REGISTRAR-LOCK EPP Status: clientDeleteProhibited EPP Status: clientUpdateProhibited EPP Status: clientTransferProhibited Updated Date: 29-Jun-2006 … [View More]Creation Date: 03-Apr-1997 Expiration Date: 04-Apr-2010 It is currently hosted in Russia even though it was the domain of a company in North Carolina. It was registered years ago and paid a few years in a advance. This does not look like a spammer domain at all. Here are the contact details of the owner obtained via archive.org: Allred Metal Stamping Works 1305 Thomasville Rd. High Point, NC 27260 M-F, 9 AM-5 PM EST 800.299.7421 336.886.5221 Fax: 336.841.6201 It almost looks like the domain registration was hijacked, because the domain was updated yesterday. Here is the corresponding spam: ===== Received: by mx0.webpack.hosteurope.de (theta.mc1.hosteurope.de) running EXperimental Internet Mailer (even more power) using esmtp from 86-63-112-191.asta-net.com.pl ([86.63.112.191] helo=BABY) id 1FwEsI-0004E4-U8 for MYEMAILACCOUNT; Fri, 30 Jun 2006 11:01:19 +0200 Message-Id: <00d301c69c1b$88371880$343d3681@vjyssa> From: "saunder mason" <wilmeraguilar(a)purinmail.com> To: "garald mckenna" <MYEMAILACCOUNT> Subject: Luxury Date: Fri, 30 Jun 2006 08:04:44 +0000 TOP BRANDS - LOW LOW PRICES Jewelry * Handbags * Pens * Watches * Neckties * Clutches * Wallets Leather, silk and white gold sound good? Visit our site for real photos. Everything comes with a certificate, tags and all the extras, plus a warranty. http://allredmetal.com/luxury/ salt prairie fly frame fresh-fallen corn shocker kettle net soul-imitating vacuum vessel snow hut chlorine azide sad-seeming feed store weight-lifting hermit warbler drift bottle wife-bound game bird trip catch bore meal key desk blue-glimmering gathering coal magnifying glass tone painting ten-hour blood baptism cotton plugger jack block ===== These hijacked domains all contain several folders, with mortgage spam sites, gambling sites, fake rolex sites, etc. The oldest folder on this site almost exactly matches the site renewal date. Here's another one: Domain Name: MINIEXAMINER.COM Registrar: ENOM, INC. Whois Server: whois.enom.com Referral URL: http://www.enom.com Name Server: NS2.MINIEXAMINER.COM Name Server: NS1.MINIEXAMINER.COM Status: ACTIVE EPP Status: ok Updated Date: 26-Jun-2006 Creation Date: 05-Apr-2001 Expiration Date: 05-Apr-2008 and ==== TOP BRANDS - LOW LOW PRICES Jewelry * Handbags * Pens * Watches * Neckties * Clutches * Wallets Leather, silk and white gold sound good? Visit our site for real photos. Everything comes with a certificate, tags and all the extras, plus a warranty. http://miniexaminer.com/luxury/ pig hutch integral cover fuzzy-legged para red terra orellana rub-dub rock basin lavender grass willow acacia singing master tariff treaty grid leak Nonintercourse act slow-contact single-hung gopher plum queer-tempered transmission bands cloth doubler long-stroke ginger root big bluestem Non-egyptologist plague-smitten sab-cat vice-librarian wheat thief ==== The month/day of expiration (ignoring the year) of both domains is almost the same. Both now point to the same server in Russia. And take a look at this - "domain pending transfer": ===== Registrant Contact: DICK HUSSEY ENTERPRISES NA NA (NA) NA Fax: PO BOX 500280 MALABAR, FL 32950-0280 US Administrative Contact: RegisterFly.com, inc. Domain Pending Transfer (transfers(a)registerfly.com) +1.9737362545 Fax: +1.9737361355 404 Main Street 4th Floor Boonton, NJ 07005 US Technical Contact: NA LLC Network Solutions (customerservice(a)networksolutions.com) +1.8886429675 Fax: +1.5714344620 13200 Woodland Park Drive Herndon, CO 20171-3025 US ===== Anybody else noticed anything like this? Joe Wein [View Less]

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss