Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

Re: [SURBL-Announce] MEFilter and milter-link add SURBL support
by Chris Sweeney 02 May '06

02 May '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Anyone download this? I can't seem to find it listed on the downloads page even after login. Jeff Chan wrote: > Two applications add SURBL support to Sendmail and MailEnable > respectively: > > > Anthony Howe of SnertSoft reports that his milter-link/0.1 for > Sendmail "extracts URLs from the message body (text, HTML, and/or > MIME encoded)" and checks them against SURBLs, or after domain > resolution against RBLs. Written in C, milter-link does on-the-fly > MIME decoding without using temporary files. > > http://www.snertsoft.com/sendmail/milter-link/ > > > Martyn Keen reports that his MEFilter, a bolt-on for the MailEnable > mail server, adds beta SURBL support. Test results are very > favorable. > > http://www.mefilter.com/ > > > Cheers, > > Jeff C. - -- Thanks Chris Check me out! Finally setup a MySpace.com account http://www.osubucks.net csweeney(a)osubucks.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFEUondS9AMNDUYgIcRAkCuAKCOFPTbVrfeNCbgyifUlsBbCQM0KACdHZEF JJWwX7NzjdYaTtidOaB0Hg8= =m413 -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Re: [SURBL-Announce] milter-uri.pl is a Perl Sendmail milter
by Todd Vierling 28 Apr '06

28 Apr '06

On 4/28/06, Jeff Chan <jeffc(a)surbl.org> wrote: > Steve Freegard of Fort Systems Ltd. reports that milter-uri.pl is > a basic Sendmail milter written in Perl using Sendmail::PMilter > and SpamAssassin libraries. I happen to be the Sendmail::PMilter author. I suppose this would be a good time for me to go revisit the package and clean up a few things I've meant to do for a couple years. Unexpected attention can be a good motivator. ;) (BTW, if this makes it to the discuss@ list, I'm not on it, so if anyone needs my attention, keep me on Cc:.) -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> <todd(a)vierling.name>

1 0

Domains not getting listed on SURBL
by Guy Rosen 24 Apr '06

24 Apr '06

Hi, We noticed a whole bunch of domains which are used by spammers affiliated with AdultActionCam that are consistently not getting listed on SURBL, and I thought I'd point it out. Are they maybe doing something special there to prevent getting listed? These are a few examples: hookinghawks dot com Giggaty dot com jerkingcough dot com superflighter dot com largebegs dot com payperblew dot com rufflyruse dot com Slaptick dot com purplefist dot com fallingfallers dot com jarsfilling dot com dinkybars dot com lostloverznow dot com losingthefill dot com leadingloverz dot com Regards, Guy Rosen Lead Analyst, Operations Team Blue Security http://www.bluesecurity.com/

2 1

URI Blacklisting at the MTA level
by Steve Freegard 18 Apr '06

18 Apr '06

Hi All, I've written a basic Sendmail milter in Perl using Sendmail::PMilter which uses the SpamAssassin libraries with just the 20_uri_tests.cf rules file (so it is relatively light) to strip the URI's from a message and then check them against multi.surbl.org and black.uribl.com and reject any messages that contains blacklisted URI's. It's rough code at the moment - there's no whitelisting or any start/stop scripts for it yet and this is my first attempt at anything in Perl - I've been running it on our spam trap for a while now and it's worked very well, I have not tried it on a production system yet. I'm posting it here in case anyone finds this useful and for comment - It can be downloaded from http://www.fsl.com/support/milter-uri.pl -- installation instructions are in the file. Finally - I'd like to say thanks to everyone involved in both SURBL and URIBL projects, you all do an excellent job of making lives difficult for the spammers :-) Kind regards, Steve. -- Steve Freegard Development Director Fort Systems Ltd. Skype: smfreegard

2 1

Autoreply: [SURBL-Discuss] URI Blacklisting at the MTA level
by scottwolf＠aginet.com 17 Apr '06

17 Apr '06

I am out of the office April 10th - April 22nd. I will have limited access to voicemail and e-mail. If you need assistance please contact Dave at aginet(a)aginet.com or 252-255-5557. Scott Wolf Aginet

1 0

RE: [SURBL-Discuss] html hex codes used in links
by Matthew.van.Eerde＠hbinc.com 03 Apr '06

03 Apr '06

Nathan Barham wrote: > I received a phishing scam yesterday where the domain part of the evil > link was in html hex code. This seems to defeat any SURBL listing. > I'm using a postfix body check to handle it now, but does anyone have > a better idea? It could be worse. They could be using javascript to factor a given product of large primes, and then using the factors to build the IP address. -- Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer

1 0

html hex codes used in links
by Nathan Barham 03 Apr '06

03 Apr '06

Hello list, I received a phishing scam yesterday where the domain part of the evil link was in html hex code. This seems to defeat any SURBL listing. I'm using a postfix body check to handle it now, but does anyone have a better idea? Thanks.

2 1

Spam In Form Of Gif File
by Warren Robinson 31 Mar '06

31 Mar '06

Hello, Has anyone figured out how to pull this spam in. The only common factor in the GIF hex file is GIF87a ! Look forward to your comments Regards Warren Robinson

3 2

Fwd: Please pass on to SURBL lists...
by Jeff Chan 24 Mar '06

24 Mar '06

This is a forwarded message From: Catherine Hampton <ariel(a)spambouncer.org> To: Jeff Chan <jeffc(a)surbl.org> Date: Thursday, March 23, 2006, 12:37:24 PM Subject: Please pass on to SURBL lists... ===8<==============Original message text=============== I don't think I'm subscribed to the lists that should see this soonest. Thanks! =-=-=-=-=-=-=-=-=-= Today I've seen a massive spam run on some of my domains, older domains that have a lot of spamtraps. The spams are all sent via open proxies/forged headers/etc., have subject lines of something along the lines of "for investors", "best way to invest", "do you want to invest", etc. The message bodies are pure text, two lines long, and consist of URLs at legitimate domain registrars and other companies not involved in the spam. Here are a few sample message bodies: =-=-=-=-=-=-=-=-=-= We offer best way for investment. http://godaddy.com/investdot.com We offer best way for investment. http://enom.com/talkgold.com We offer best way for investment. http://1BLU.DE/SX-INVEST.COM Do you want to invest your money ? Ask me how http://www.moneymakergroup.com/ [Is this one legit? I don't know. But it's part of the same pattern.] Don't lose your chance to make really good investor carier! http://www.mailer.vascoinvestment.com [Not sure about this one either.] 400% profit per month is TRUE! Visit our site. http://everydns.net/privateopps.com Don't lose your chance to make really good investor carier! http://namecheap.com/talkgold.com =-=-=-=-=-=-=-=-=-= I noticed that vascoinvestment.com is already listed in URIBL, and moneymakergroup.com is in SURBL (William Stearns). Just in case people hadn't noticed, I wanted to point out that we need to be careful about listing domains from these emails. It's perfectly possible, of course, that some of them are spammy and the others are being used as camoflauge, to slow down the SURBL and URIBL volunteers, and to cause FPs and make those blocklists less effective. It's also possible that *all* of them are legitimate/innocent. In either case, I think blocklists, and particularly SURBL and URIBL, are the targets of this attack. So please be careful and don't let the idiots win! -- Catherine Hampton <ariel(a)spambouncer.org> The SpamBouncer * <http://www.spambouncer.org/> Personal Home Page * <http://www.devsite.org/> ===8<===========End of original message text=========== -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

6 8

Problem with rbldnsd on Linux
by David B Funk 24 Mar '06

24 Mar '06

I'm having issues running rbldnsd (rbldnsd-0.996) on Linux. Tried two different varients (SUSE 10.0 & RH 4 AS) and both lock up if I use the '-f' option, no problem with '-f' when running on HP-UX. The problem occurs during a zone data reload, the parent forks off a child to answer requests while it reloads (what the -f does) then when it's done and tries to reap the child it goes into a spin-loop. Anybody else seen this, know of a solution other than the workaround of not using the '-f' option? Dave -- Dave Funk University of Iowa <dbfunk (at) engineering.uiowa.edu> College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 #include <std_disclaimer.h> Better is not better, 'standard' is better. B{

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss