Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

enya1.cjb.net
by Chris Santerre 11 Aug '04

11 Aug '04

cjb.net is a redirecting service. However they 'appear' to not tolerate spammers. On thing I DON'T like is that when you go to this site, it tries to install "free access" plugin! (Thanx again FireFox!) ANyone got anymore on these guys? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

{Spam?} Re: Lowering TTLs
by Rob McEwen 11 Aug '04

11 Aug '04

Jeff said: >OK I'm going to go ahead and reduce the TTLs on the zones >to one hour. That's for all zones other than sc.surbl.org >which has a 10 minute TTL. It includes multi also. >Let's watch name server traffic and see if it changes much >as a result. Of course it's a little difficult to measure >this now since SpamAssassin 3.0 is also rolling out with SURBL >support. But if DNS traffic goes up too much we can back >this off. >I'd still like to experiment with shorter and longer TTLs >at some point to try to optimize them further. >Jeff C. I goofed by replying to this, thus hijacking his sub-thread with another topic. Hopefully, Im repairing the damage here :) I would add that another interesting question is: how many out there are using everything but multi in order to get catch more of the newer stuff faster? If so, it seems to me that the combined extra lookups done on multiple surbl lists would be a larger strain on resources when compared to doing a single lookup on the multi list where the multi list has a shorter TTL time. Follow? (I admit, I recently abandoned the multi list in favor of using ALL other lists for this very reason. I will now switch to two lists: multi & sc) Rob McEwen

2 1

RE: [SURBL-Discuss] RE: Pesky Pron Spam
by Chris Santerre 11 Aug '04

11 Aug '04

>-----Original Message----- >From: Rob McEwen [mailto:webmaster@powerviewsystems.com] >Sent: Wednesday, August 11, 2004 9:02 AM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] RE: Pesky Pron Spam >Importance: High > > >I keep getting this "pesky" pron spam which gets past my all >my filters (my >regex-based linguestic filter, my spamhaus.org RBL filter, and my SURBL >filter). > >I think that these are getting blocked the next day, but this >particular >spammer is very aggressive and keeps sending new stuff so I >keep getting the >new stuff before it gets a chance to get blocked. > >I have noticed some patterns in the e-mails. For example, they all have >three images stacked vertically. Therefore, I think that I >should be able to >catch these with the right formulation of rules within my >linguistic filter. > >You can find the raw contents of my most recent two of these >as follows: > >http://www.pvsys.com/pn01.txt > >http://www.pvsys.com/pn02.txt > >Does anyone have any suggestions? Note that I am not using >SpamAssassin. I >am using another program. However, if SpamAssassin already >handles this, >could someone point me to the rules that SpamAssassin uses so >that I can use >these as a guide? Any other suggestions? > >Thanks! > >Rob McEwen > > Look at these things they have in common. Need to look at rawbody code. alt=3d =2e(org|gif|htm) #split into 3 name=3dgenerator ==.HTM bgColor=3d face=3d src=3d border=3d title=3d face=3d <STYLE></STYLE> Needs to be one big meta rule HTH --Chris

4 4

Re: [SURBL-Zones] Lowering TTLs
by Jeff Chan 11 Aug '04

11 Aug '04

On Monday, August 9, 2004, 3:37:56 PM, Jeff Chan wrote: > I thinking about dropping the TTL on the lists that had 6 and 8 > hour TTLs down to 1 hour in order to get new entries active > sooner. We have not tested this to see what effect it would have > on traffic; an experiment we would still like to try with a > range of different TTLs. > Does anyone have any objections to this? It would still be > longer than the default 35 minute TTL that rbldnsd uses. OK I'm going to go ahead and reduce the TTLs on the zones to one hour. That's for all zones other than sc.surbl.org which has a 10 minute TTL. It includes multi also. Let's watch name server traffic and see if it changes much as a result. Of course it's a little difficult to measure this now since SpamAssassin 3.0 is also rolling out with SURBL support. But if DNS traffic goes up too much we can back this off. I'd still like to experiment with shorter and longer TTLs at some point to try to optimize them further. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

4 8

{Spam?} RE: [SURBL-Discuss] RE: Pesky Pron Spam
by Rob McEwen 11 Aug '04

11 Aug '04

I said: >However, I might integrate this domain >list "*namefromlist*.org" as a factor >in a compound rule. To be clear, I was referring to only the original list of 36 names, NOT the compiled list of 1300+ domain names. Rob McEwen

1 0

RE: [SURBL-Discuss] RE: Pesky Pron Spam
by Chris Santerre 11 Aug '04

11 Aug '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Wednesday, August 11, 2004 11:48 AM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] RE: Pesky Pron Spam > > >on Wed, Aug 11, 2004 at 09:49:39AM -0400, Chris Santerre wrote: >> Look at these things they have in common. Need to look at >rawbody code. >> >> alt=3d >> =2e(org|gif|htm) #split into 3 >> name=3dgenerator >> ==.HTM >> bgColor=3d >> face=3d >> src=3d >> border=3d >> title=3d >> face=3d >> <STYLE></STYLE> >> >> Needs to be one big meta rule > >...that will also catch pretty much every last MSHTML email ever sent. >That's just base64-encoded HTML, Chris. The empty STYLE element may >be unique, but I doubt it. > >I first successfully quarantined these by searching on > ><BIG><STRONG> >and ><STRONG><BIG> > >in the body. That should be sufficient without FPs. But these >others are >common enough that I wouldn't want to risk it, even in a big compound >rule. > >-- LOL yeah now that I look at it.......yup. Silly! I should never try to pattern match without coffee. Of course this was off the top of my head without any testing. The SARE ninjas would have flogged me good on that one :) --Chris

1 0

{Spam?} RE: [SURBL-Discuss] RE: Pesky Pron Spam
by Rob McEwen 11 Aug '04

11 Aug '04

Raymond said: >>But obviously is doesn't work.... The ones you >>mentioned are listed in 3 SURBL lists... you >>should be able to catch them up pretty easily. Yes, I am able to catch these easily now! Whenever I try to RESEND this through my filter, YES YES YES, they ARE easily caught by my SURBL filtering. My SURBL filter is working GREAT and the fact that these are NOW caught by SURBL is completely irrelevant to my original question. The problem is that this particular spammer is very, very proliferate and I keep getting the razer's edge of his first new spams using new domains that are not yet blocked by SURBL. These particular spams are also very sneaky about not allowing "pron keywords" into the body of the message. The fact that they are blocked by SURBL soon afterwards is besides the point. I'm simply looking for any suggestions or pointers for rules-based filtering which might catch this particular "series" of spam. Rob McEwen

1 0

RE: [SURBL-Discuss] RE: Pesky Pron Spam
by Rob McEwen 11 Aug '04

11 Aug '04

(I sent this again because I discovered that my original message when only to Raymond and not to the list) Raymond, Recall that I mentioned that I'm NOT a SpamAssassin user. Also, I am currently NOT using any Bayesian filtering... (although I do have plans to eventually add this as an additional layer of filtering). (Before you laugh, I would say that the filtering that I do use is very comparable to SpamAssassin when looking at what how effective it is against those e-mails which make it past SURBL and RBL.) Nevertheless, I can't answer your two questions because they are not applicable. Thanks for trying to help! :) Any other thoughts/suggestions? Rob McEwen PowerView Systems rob(a)PowerViewSystems.com (478) 475-9032 -----Original Message----- From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] Sent: Wednesday, August 11, 2004 9:08 AM To: rob(a)pvsys.com; SURBL Discussion list Subject: Re: [SURBL-Discuss] RE: Pesky Pron Spam Importance: High Hi! > I have noticed some patterns in the e-mails. For example, they all > have three images stacked vertically. Therefore, I think that I should > be able to catch these with the right formulation of rules within my > linguistic filter. > > You can find the raw contents of my most recent two of these as > follows: > > http://www.pvsys.com/pn01.txt > > http://www.pvsys.com/pn02.txt What are the SA scores you got on these? Might tell much more. Could be your bayesian filters are doing this. Bye, Raymond.

2 1

RE: [SURBL-Discuss] RE: Pesky Pron Spam
by Raymond Dijkxhoorn 11 Aug '04

11 Aug '04

Hi! > Recall that I mentioned that I'm NOT a SpamAssassin user. Also, I am > currently NOT using any Bayesian filtering... (although I do have plans to > eventually add this as an additional layer of filtering). Ok, i overlooked that i think. :) > (Before you laugh, I would say that the filtering that I do use is very > comparable to SpamAssassin when looking at what how effective it is against > those e-mails which make it past SURBL and RBL.) But obviously is doesnt work. I have a lot of those, with different txt, but the same URLs. The ones you mentioned are listed in 3 SURBL lists, do you should be able to catch them up pretty easilly. > > http://www.pvsys.com/pn01.txt > > http://www.pvsys.com/pn02.txt We only provide the lists, i guess you have to look on the 'thing' you are using whats going wrong. ;) Bye, Raymond.

1 0

RE: [SURBL-Discuss] mimedefang + spamcopuri = "timeout before dataread" in syslog
by Jason M. Burnett 11 Aug '04

11 Aug '04

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > > > My hunch is that it could be intermittent DNS timeouts. > > We're trying to get all the public name servers switched > over to rbldnsd, since it's much faster than BIND. That > may help. > > Can someone look through the sources and see how this > message comes up: "timeout before data read" ? I *think* it happens when a scanner run by Mimedefang (spamassassin, in this case) takes too long to return. I get the impression from the man page that this timeout is ten seconds, but I'm not sure. Anyone confirm? I took a shot at bumping that to 30, so I'll know in a couple days if that fixed it. -- Jason This email and any attachments thereto may contain private, confidential, and privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss