Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

FP: imagerocket.com
by Bret Miller 10 Sep '04

10 Sep '04

The imagerocket.com domain is listed in WS and appears in a message received today from bizrate.com. I use bizrate myself (though this message wasn't to me), so I know they aren't hard-core spammers. The message source is attached. I'm not familiar with imagerocket.com, so can't say whether they'd be a good spam indicator if the message wasn't from bizrate.com. Bret ---------- Send your spam to: bretmiller(a)wcg.org Thanks for keeping the internet spam-free!

3 2

RE: [SURBL-Discuss] Draw the line (was: Need help checking FP lis t from Theo)
by Chris Santerre 10 Sep '04

10 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, September 09, 2004 3:46 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Draw the line (was: Need help checking FP >list from Theo) > > >On Wednesday, September 8, 2004, 2:08:08 PM, SM wrote: >> Hi Chris, >> At 08:09 08-09-2004, Chris Santerre wrote: >>>NO it doesn't! The point was..... its interesting!! :) >123inkjets has been >>>linked to a ton of other spam domains. The fact that they >have customers >>>makes it legit???? SO anyone who falls for these spams and >buys something, >>>makes it legit? Think about that. Where do you draw the line? > >> If a few legitimate customers are enough to get a domain off >a blacklist, >> then most of the domains currently listed will sooner or later get >> off. There will always be false positives because one man's spam is >> another man's ham. Someone should draw the line somewhere. > >Yes, we have drawn a line. A domain that's mostly used in >spam will probably get listed. A domain that's only being >used in spam will definitely get listed. A domain that's >mostly used in legitimate messages probably won't get >listed. A domain that's only used in legitimate messages >definitely won't get listed. > So what does that mean for 123inkjets? If I understand you correcly, your are whitelisting this spammer because a legit newsletter happens to have links to them in it. Be it either an ad or whatever. So instead of the newsletter breaking ties with the spammer, the spammer domain gets a free ride? --Chris

2 1

RE: Start an IP list to block?
by Matt Kettler 10 Sep '04

10 Sep '04

At 05:23 PM 9/9/2004, Chris Santerre wrote: >OOOOOOHHHHH yeah! I didn't know that! Are we sure this is actually what it >means and not just a miss-syntaxed paragraph? It actually resolves the IP >against the RBL lookup? > >If so....well then...problem solved, and devs get a cookie :) Actually, upon closer read it checks the IP of the NS record.. So it's essentially blacklisting the IP's of the DNS servers that spammers are using. So, for http://www.merchantsoverseas.com, it would look at your NS records: MerchantsOverseas.com. 18185 IN NS auth20.ns.wcom.com. MerchantsOverseas.com. 18185 IN NS auth10.ns.wcom.com. And would check the IPs 198.6.100.37 (auth20.ns.wcom.com) and 198.6.100.21 (auth10.ns.wcom.com)

2 1

RE: Start an IP list to block?
by Smart,Dan 10 Sep '04

10 Sep '04

> -----Original Message----- > From: Scott A Crosby [mailto:scrosby@cs.rice.edu] > Sent: Thursday, September 09, 2004 5:23 PM > > We should be a bit more careful than this --- require that a > new URL has to resolve to the same IP address as, say, at > least 3 other SURBL entries before being automatically added > on. Also, there should also be a list of IP's for which this > automatic logic won't be triggered. This would be important > for a poorly run but popular virtual server that's slow at > kicking off spamvertized sites. This really sounds a lot like how DCC (w/greylisting) works. Use the public DCC servers to post detection of these same IP URLs, and when its confirmed by enough sites, it triggers a big score. <<Dan>>

1 0

RE: Start an IP list to block?
by Chris Santerre 10 Sep '04

10 Sep '04

>-----Original Message----- >From: jm(a)jmason.org [mailto:jm@jmason.org] >Sent: Thursday, September 09, 2004 5:17 PM >To: Raymond Dijkxhoorn >Cc: Alex Broens; >users-return-15498-sa-list=alexb.ch(a)spamassassin.apache.org; SURBL >Discussion list (E-mail); Spamassassin-Talk (E-mail) >Subject: Re: Start an IP list to block? > > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >Raymond Dijkxhoorn writes: >> Hi! >> >> > Chris, Raymond , >> > >> > I went thru a random few of these and they're were listed >at Spamhaus. >> > Using spamhaus at SMTP level or SA doing RBL lookups would >have caught and >> > stopped them... Spamcop probably has quite a few of them >listed as well >> >> No, that wont work. The spams are sended in via >trojans/proxys only the >> websites are static. SOME are blocked with DSBL and so but >most of the >> time they start a spamrun with a fresh set it seems. >> >> So yes, they are inside spamhaus, but only the websites, >didnt see mails >> sended out from there (yet). > >Are their NS records listed in the SBL? > >- --j. No, but extremely easy to add. However....I'm not sure Jeff would like that. Would have to be a seperate list. -_Chris

3 3

Re: [SURBL-Discuss] RE: Start an IP list to block?
by Patrik Nilsson 10 Sep '04

10 Sep '04

At 17:23 2004-09-09 -0400, Chris Santerre wrote: > >-----Original Message----- > >From: Matt Kettler [mailto:mkettler@evi-inc.com] > >Chris, SA 3.0 appears to already support checking DNS > >blacklisting of URLs > >based on resolved IP. That's actually resolved IPs of the hostnames for the *name servers* for the domain in the uri, not the resolved IPs for the actual host names in the URI: > >and from URIDNSBL.pm: > > > > This works by analysing message text and HTML for URLs, > extracting the > > domain names from those, querying their NS records in DNS, > resolving > > the hostnames used therein, and querying various DNS blocklists for "used therein" refers to the NS records. Patrik

1 0

Re: [SURBL-Discuss] Start an IP list to block?
by Patrik Nilsson 10 Sep '04

10 Sep '04

At 16:56 2004-09-09 -0400, Chris Santerre wrote: >OK, this isn't the first time we've had this discussion, but Raymond and I >felt this should be made public again. He ran thru some tests of 1500+ >domains and found the following data. Looks like they maybe send from >zombies, and never their hosts. IPs are similar across the board. > >So is there a way to use the IP info in a good way? Could SA or SURBL do a >quick ping of the URL and match against a URL? This would allow us to simply >list 1 IP instead of all these domains. Why not simply use what's already available - uridnsbl with SBL? >See this list, most of them all use the same IP, pill spammers... >abducted2550pirrs.com has address 219.254.32.111 abducted2550pirrs.com name servers are in SBL. >acdfiaj.info has address 219.254.32.69 abducted2550pirrs.com name servers are in SBL. >agronomy9603dryg.com has address 219.254.32.111 agronomy9603dryg.com name servers are in SBL. Etc... Patrik

1 0

RE: Start an IP list to block?
by Chris Santerre 10 Sep '04

10 Sep '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Thursday, September 09, 2004 5:10 PM >To: Alex Broens >Cc: users-return-15498-sa-list=alexb.ch(a)spamassassin.apache.org; SURBL >Discussion list (E-mail); Spamassassin-Talk (E-mail) >Subject: Re: Start an IP list to block? > > >Hi! > >> Chris, Raymond , >> >> I went thru a random few of these and they're were listed at >Spamhaus. >> Using spamhaus at SMTP level or SA doing RBL lookups would >have caught and >> stopped them... Spamcop probably has quite a few of them >listed as well > >No, that wont work. The spams are sended in via trojans/proxys >only the >websites are static. SOME are blocked with DSBL and so but most of the >time they start a spamrun with a fresh set it seems. > >So yes, they are inside spamhaus, but only the websites, didnt >see mails >sended out from there (yet). > Agreed. They may be listed, but for mail, not hosting. They use other IPs to send, and keep the host on their IPs. SOme of the bigger spammers are saying "Screw SURBL, I've got enough dough to get a new domain for every run, and it still remains profitible." To which we have 2 replies: 1) Those registers are going to feel some rath soon from the antispam community. 2) We gonna mark the IP, you silly little monkeys! I think the code should be added into the SURBL code. It would need to be a patch for SA 3.0 as it is prbly too late for it to go in now. But it should be simple to grab the IP of the 20 random URL domains and match against SURBL as well. Then they can purchase as many domains as they like, won't matter a bit. --Chris

3 2

RE: Start an IP list to block?
by Chris Santerre 09 Sep '04

09 Sep '04

>-----Original Message----- >From: Matt Kettler [mailto:mkettler@evi-inc.com] >Sent: Thursday, September 09, 2004 5:18 PM >To: Chris Santerre; SURBL Discussion list (E-mail) >Cc: Spamassassin-Talk (E-mail) >Subject: Re: Start an IP list to block? > > >At 04:56 PM 9/9/2004, Chris Santerre wrote: >>So is there a way to use the IP info in a good way? Could SA >or SURBL do a >>quick ping of the URL and match against a URL? This would >allow us to simply >>list 1 IP instead of all these domains. > >Chris, SA 3.0 appears to already support checking DNS >blacklisting of URLs >based on resolved IP. (as well as surbl-style based on domain >name). So >theoretically, SURBL could open up a separate list based on >IP's (i.e.: >multi.dnsbl.surbl.org) > > >Take a look at the example where it checks the resolved IP of >a URL against >the SBL (an IP based list): > > uridnsbl URIBL_SBL sbl.spamhaus.org. TXT > header URIBL_SBL >eval:check_uridnsbl('URIBL_SBL') > describe URIBL_SBL Contains a URL listed >in the SBL >blocklist > tflags URIBL_SBL net > > >and from URIDNSBL.pm: > > This works by analysing message text and HTML for >URLs, extracting the > domain names from those, querying their NS records in >DNS, resolving > the hostnames used therein, and querying various DNS >blocklists for > those IP addresses. This is quite effective. > > SYNOPSIS > > loadplugin Mail::SpamAssassin::Plugin::URIDNSBL > uridnsbl URIBL_SBLXBL sbl-xbl.spamhaus.org. TXT > OOOOOOHHHHH yeah! I didn't know that! Are we sure this is actually what it means and not just a miss-syntaxed paragraph? It actually resolves the IP against the RBL lookup? If so....well then...problem solved, and devs get a cookie :) --Chris (todays choices are: Oreo or NutterButter.)

2 1

RE: Start an IP list to block?
by Chris Santerre 09 Sep '04

09 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, September 09, 2004 5:26 PM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail); Spamassassin-Talk (E-mail) >Subject: Re: Start an IP list to block? > > >On Thursday, September 9, 2004, 1:56:33 PM, Chris Santerre wrote: >> OK, this isn't the first time we've had this discussion, but >Raymond and I >> felt this should be made public again. He ran thru some >tests of 1500+ >> domains and found the following data. Looks like they maybe send from >> zombies, and never their hosts. IPs are similar across the board. > >> So is there a way to use the IP info in a good way? Could SA >or SURBL do a >> quick ping of the URL and match against a URL? This would >allow us to simply >> list 1 IP instead of all these domains. > >> (I'm well aware of virtual hosts! So only the filthiest of >spammers would be >> put on this IP list. Then their IP better boot them or >anyone hosted on that >> box would feel the rath of SURBL.) > >Yes, we've already discussed reasons why we're using only the >data actually found in spam URIs. The potential for collateral >damage in looking at resolved IPs is too high. > >It would be very easy for a large hosting provider to have 1 >bad guy sharing a web server with 100 or 1000 non-spammers. >Given that we can't see those other 100 or 1000, it would be >very easy for us to add that 1 IP address and block the >other 100 or 1000 *without even knowing it*. > >It is a question about the limits of knowledge. In our >universe we can't see the potential collateral damage from >listing a shared host, so we should not do it. From our >point of view it's not knowable. Sure the hosting company >knows whether that's the case, but we can't. > >I'd encourage people with questions like this to read up or >take some classes on epistemology or the theory of knowledge. >Or just contemplate the possibilities harder... ;-) LOL, I love our conversations ;) Well when I said filthy, I meant down right Christina Aguleira raunchy spammers! The drippiest of rotten stinking spammers. Basically those hosted by spam friendly hosts. This is a step I was sure you would not want to do, but I can think of a ton on the SPAM-L list who would jump at the chance. Makes ISPs become more responsible. However this is just theory discussion anyway...or is it :p --Chris

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss