Discuss

discuss@lists.surbl.org

1867 discussions

Watchit :)
by Alex Broens 17 Sep '04

17 Sep '04

Jeff, FYI: a spam with a link to http://www.cabdriver.kjcjvjv.com.com/ just showed up. Obviously dumbo spammy goofed up... as we obviosuly won't want to SURBLize com.com (cnet) and this may be reported by some spamtrapping system it may be a good idea to check if com.com is whitelisted. thanks Alex

2 1

intercompras.com.gt
by Jeff Chan 17 Sep '04

17 Sep '04

Is anyone familiar with intercompras.com.gt? It's in Guatemala, and appeared recently in the SC data. Can't tell if it's an ISP or something like that. Jeff C.

3 4

RE: [SURBL-Discuss] [OT] FUN: Something to send your family membe rs!
by Chris Santerre 16 Sep '04

16 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, September 15, 2004 5:12 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] [OT] FUN: Something to send your family >members! > > >On Wednesday, September 15, 2004, 11:51:55 AM, Raymond >Dijkxhoorn wrote: >>>> So for anyone who knows what I'm talking about on this >page, feel free to >>>> spam it to all your friends and family! ;) > >>> Wouldn't it be added to SURBL then? :) > >> Some sites have the luck to be whitelisted, this is one of them ;) > >It's all random, you know. ;-) We use a the Monte Carlo method >with an old dartboard full of domain names to decide what to >whitelist. ;-) Crap!! We really need to standardize. I've been throwing chicken bones and reading tea to whitelist! --Chris

1 0

Re: [SURBL-Discuss] [OT] FUN: Something to send your family members!
by SM 16 Sep '04

16 Sep '04

Hi Chris, At 09:14 15-09-2004, Chris Santerre wrote: >So for anyone who knows what I'm talking about on this page, feel free to >spam it to all your friends and family! ;) Wouldn't it be added to SURBL then? :) Regards, -sm

4 4

RE: [SURBL-Discuss] important reduce wrise renkles & skin spots ( fwd)
by Chris Santerre 15 Sep '04

15 Sep '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Friday, September 10, 2004 8:48 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] important reduce wrise renkles & skin spots >(fwd) > > >Hi! > >Our favorite pill spammers also try to get around SURBL now. > >I dont want to end up making SA rulesets for this, any suggestions ? > >ns3.airmaramba.biz >ns3.avk29.biz > >The same crap... But, with less SA hits now, since its not touched by >SURBL. Bah. > >---------- Forwarded message ---------- >Date: Sat, 11 Sep 2004 01:50:29 +0100 >From: kenneth clakley <auroraschorn(a)rfc.every1.net> >To: wilfredo moote <reyes(a)prolocation.net> >Subject: important reduce wrise renkles & skin spots > >suc-oneonta sony-steo lettery > > >>From inside to outside, from w^eig_ht l`o^ss to skin care. From mental >relief to physical relief, from antidepressant to muscle >relaxant. The care >inside out. > >you can copy > >wjq.s.adjuster6370pinn.com/56/ > >to your browser > Not all of these are listed in SURBL: (Yes one day I hope to make this info availible to you.) * 1: abrasions6681tabs.biz * 2: absentia4304drug.biz * 3: abstention2386tads.us * 4: accordance3414drugs.biz * 5: addable8060biz.com * 6: adorer457dryg.com * 7: agronomy9603dryg.com * 8: aground8965drugs.biz * 9: agues346rneds.us * 10: aider8333tads.com * 11: alighted2110tads.us * 12: alitalia9689pi11.us * 13: amateurish8859rx.us * 14: anaerobe9918tabs.us * 15: annularity789drugs.biz * 16: antioch8386drygs.us * 17: apercus9591dryg.us * 18: aperiodic1001pill.biz * 19: appetite352tads.us * 20: arc4679biz.biz * 21: armenian5748drug.biz * 22: armenian8291drygs.com * 23: arteriole1448drygs.us * 24: articular9420tabs.biz * 25: aspirated8343pi11.us * 26: assemblies7268biz.us * 27: assumpsit9521drygs.us * 28: astf2571pills.us * 29: attendee9327tads.us * 30: authorise5969rneds.us * 31: avk29.biz * 32: axing5875pi11s.us * 33: aye3054biz.us * 34: bedtime7591rx.us * 35: benzene4347drug.us * 36: benzine6086dryg.com * 37: bier3709pi11.biz * 38: bleach2839drugs.us * 39: breakup9732pi11.us * 40: bream1462rneds.us * 41: bridegroom6963rx.us * 42: brimming6028pill.biz * 43: bumble2318pills.biz * 44: burnie5422pinn.com * 45: caraway307biz.us * 46: carp6499pi11s.us * 47: caw5709biz.us * 48: cctv6483tabs.biz * 49: centralism3766rx.us * 50: charlatan9181rneds.us * 51: chopsticks4847tabs.biz * 52: cleat7228pirrs.com * 53: closed6129tads.us * 54: cobra133pirrs.com * 55: cog5687tads.us * 56: collocutor9120dryg.com * 57: comparable6635tads.com * 58: concinnity6196pi11s.us * 59: congener1455rneds.com * 60: copenhagen1026tabs.us * 61: crane7149biz.biz * 62: crucify8156pi11.us * 63: cyrconium8981biz.us * 64: dale1949pi11.us * 65: dayak3409tabs.biz * 66: decatur9854rx.us * 67: dehydrated8623meds.us * 68: destitute6182drygs.com * 69: dewlap752drygs.com * 70: dhl7809tads.com * 71: digestion5594rneds.us * 72: digital9420rx.biz * 73: directory1403rx.biz * 74: disjoint5156drygs.com * 75: docket9430pi11.us * 76: duodenum1797nx.com * 77: duodenum6414biz.us * 78: earwax8995rneds.com * 79: embody6740tabs.biz * 80: emerge2198dryg.com * 81: enactment859drygs.us * 82: enriched3735pi11.us * 83: entail2096drygs.us * 84: epitheory4065dryg.com * 85: ergo2905drygs.us * 86: fabricate2671rneds.us * 87: faire4813rneds.com * 88: farcical3545rneds.us * 89: fatality5443drugs.com * 90: fateful3948pill.us * 91: feminine2966biz.us * 92: ferryboat4957meds.biz * 93: fie9819meds.biz * 94: fitful1499tads.us * 95: flank4240biz.us * 96: flatfoot8255tabs.us * 97: flew7838tads.com * 98: flimsiness4164dryg.us * 99: fortress221drug.biz * 100: fox621dryg.us * 101: frankly8033pi11s.us * 102: fraudulent4567pill.us * 103: glassy5030nx.com * 104: gratuitous4973meds.us * 105: griffith4438biz.us * 106: grin7749pi11.us * 107: guano7904pills.us * 108: gui7176biz.com * 109: haphazard8933tads.us * 110: hard8589meds.us * 111: harmonious682pi11s.us * 112: healing7489biz.com * 113: heartbreak7918rneds.biz * 114: hits359pills.biz * 115: hopefully3701rneds.us * 116: humpback726pirrs.com * 117: hyaena988drygs.us * 118: identifier618pi11.us * 119: imbed3506pinn.com * 120: impede276tads.us * 121: indenting1562pill.com * 122: indoor954pill.biz * 123: inequality2661pi11s.us * 124: infinitive6385biz.us * 125: inflect5194drygs.us * 126: insure3484biz.us * 127: integrated7310tads.us * 128: involute6538drygs.us * 129: issued5633drug.biz * 130: jell8297drugs.us * 131: joliet5195biz.com * 132: kathy8786pi11.us * 133: katzner3273biz.us * 134: kick6502pi11.us * 135: killing8335biz.us * 136: knowingly606meds.us * 137: lawful7322dryg.us * 138: laxative5682dryg.us * 139: laziness6976dryg.com * 140: leaden9828biz.us * 141: lessee7050tabs.biz * 142: lettish3429pill.us * 143: liaison6083tabs.biz * 144: limped6950pill.us * 145: lotus9106rneds.com * 146: luxuriate7999tads.us * 147: madder8828biz.us * 148: magenta4358rx.us * 149: med12now.com * 150: mediate3804rx.us * 151: medic7.com * 152: medspro7.com * 153: microcode3252meds.biz * 154: milan1517biz.com * 155: mirroring5831dryg.us * 156: mis6163pi11s.us * 157: misogynist2527dryg.biz * 158: moisten982rx.us * 159: monitor8072pill.biz * 160: narrowly1946biz.us * 161: narrowly9558pi11.us * 162: negater6398tads.com * 163: nevermore8513pi11.us * 164: newmedsgo.com * 165: nude7755pi11s.us * 166: obscuring7328drygs.biz * 167: odometer3845meds.us * 168: oleaginous9337meds.us * 169: onyx810dryg.us * 170: optimize5129drug.com * 171: oscillator9247biz.com * 172: osprey9824drug.us * 173: outgoing9256pi11s.us * 174: outweigh9214pills.us * 175: overhand1383biz.us * 176: packaged2320rneds.biz * 177: paperwork970tads.com * 178: paramour5839biz.biz * 179: parfaits6405drygs.us * 180: passivism3981tads.com * 181: payout4174pills.us * 182: pelves963tads.com * 183: penney5099rx.us * 184: phantasia6277biz.us * 185: phoneme6858biz.com * 186: phosphite1908tads.com * 187: plasticize6988drygs.com * 188: pleader7286pi11.us * 189: plus2766rx.biz * 190: pollacks6901biz.us * 191: pompadour8149meds.us * 192: poncho4491dryg.us * 193: pottage6834pirrs.us * 194: prairie4725biz.com * 195: pressman1177nx.com * 196: pretzel3736pills.com * 197: primness6560nx.us * 198: probity7464tads.com * 199: procuress4029pinn.com * 200: project2089biz.com * 201: propylene3479pi11s.us * 202: qts7851drygs.us * 203: quits8304drygs.com * 204: quoter7237tabs.biz * 205: race874pi11s.us * 206: racetrack2853pirrs.com * 207: radial1212rx.biz * 208: rainproof4172tads.com * 209: ram7888dryg.com * 210: randomness3999pi11.us * 211: rata2536tads.com * 212: rating1857rneds.us * 213: rationale9722dryg.us * 214: receive5709tads.us * 215: recruited2055rneds.com * 216: replenish4787nx.com * 217: reproduced2714tads.us * 218: resist9528rneds.com * 219: rework5964drugs.us * 220: rhubarb454rneds.us * 221: richmond8106dryg.com * 222: ringlet6664biz.us * 223: rustic9925rneds.com * 224: safflower170dryg.com * 225: sahib5037biz.com * 226: salesman8694tabs.biz * 227: sanguine882rneds.com * 228: sanita77.biz * 229: satrapy8385tads.com * 230: sauntering5306biz.biz * 231: scarfs7993pi11s.us * 232: scatters8393rneds.com * 233: sceptical5237tabs.us * 234: schlepp5206biz.com * 235: science6119dryg.us * 236: scratchpad4718tads.us * 237: scuttle5567pills.us * 238: searim7571tads.us * 239: seascape9247dryg.us * 240: seconds9619pills.biz * 241: seduction6895drygs.us * 242: sergeancy8489pinn.com * 243: servile9023tads.us * 244: sewerage5665pills.us * 245: sextette9640drug.us * 246: shadowy9804pinn.com * 247: shaves4465drugs.biz * 248: shied5615rneds.us * 249: shingle6722dryg.us * 250: shipshape6075pi11.us * 251: shirts7008drygs.us * 252: showplace1294pirrs.com * 253: showroom3161drygs.us * 254: shrieking3773pi11s.us * 255: shrinks489pinn.com * 256: shudder4751dryg.us * 257: shudder6654meds.biz * 258: sideband9064dryg.us * 259: silenced221pills.us * 260: silvers2867biz.us * 261: simpleness128pill.us * 262: siphonage8358pi11.us * 263: skills4744rneds.us * 264: skunk2642drugs.us * 265: sky5490pirrs.com * 266: skydives9635pi11s.us * 267: slates8323rx.biz * 268: slays1093drugs.biz * 269: sleety6351pills.biz * 270: slide6037drygs.us * 271: smeltery7284pills.us * 272: smithies7780biz.us * 273: smock928pill.us * 274: smoldering3120drugs.biz * 275: snivels460biz.biz * 276: snoozed2548rneds.com * 277: soaker1916tads.com * 278: societies7375tads.us * 279: sociologic3084biz.us * 280: sods4562rx.us * 281: soluble7830pinn.com * 282: souped9129pill.biz * 283: sparring2432pi11s.us * 284: spidery4421biz.com * 285: spiritous5262dryg.us * 286: spoilt7777rneds.com * 287: squelched807rx.us * 288: stack7167biz.us * 289: statutory1625pi11s.us * 290: stein3843dryg.us * 291: stereo661drugs.us * 292: stiffed5912tads.com * 293: stillness4372pills.us * 294: stillwater7481drug.us * 295: stockinet9618nx.com * 296: stolidly8964biz.us * 297: stony4921rneds.com * 298: stoppage9046drugs.us * 299: subcell5587drugs.us * 300: summit4716drygs.com * 301: sundae8155pi11.us * 302: sundance4111pills.biz * 303: swaged5905biz.com * 304: tachometer4191rx.us * 305: tangential3858pill.us * 306: tentative8691pinn.com * 307: terminable3646drygs.com * 308: textiles528tads.us * 309: them1275pinn.com * 310: thickly6764drugs.us * 311: threadbare2938rneds.us * 312: throughput9067pi11.us * 313: thumbscan6966tads.us * 314: thumper4635pi11s.us * 315: tidings7196rx.biz * 316: tiled2118rneds.com * 317: timeworn642tads.us * 318: tingle3751drygs.com * 319: tipped2161pills.us * 320: tiptoe1538rx.us * 321: toaster7461drygs.com * 322: towing613pill.biz * 323: transient3126drygs.com * 324: transitive7329pi11.us * 325: treatable4145pill.biz * 326: trinity7698pi11s.us * 327: tunny1567rx.us * 328: ugh5315biz.biz * 329: unawares6248pinn.com * 330: unburdened2613pills.us * 331: uncocked5801tabs.biz * 332: undefended7133pinn.com * 333: underload9603pirrs.com * 334: unhewn2916drug.us * 335: unordered6621rx.us * 336: unpainted4643pills.us * 337: valencia9167pill.biz * 338: vcr1047pinn.com * 339: vermouth9192drugs.biz * 340: very9221rx.us * 341: voodoo5623rx.biz * 342: wanton5925pill.biz * 343: waterside9155dryg.us * 344: weak2133drug.us * 345: weaponless8185biz.com * 346: weeper9194nx.com * 347: wimbledon743pill.us * 348: winney6568drugs.biz * 349: winning7272tads.com * 350: wolfhound8782biz.us * 351: workman3166tabs.us * 352: worrisome5163pill.us * 353: wrasse8984pi11.us * 354: yachtsmen1959pi11s.us * 355: yip3909tads.com --Chris

6 17

whitelist senderbase top domains?
by Jeff Chan 15 Sep '04

15 Sep '04

Looks like senderbase.org has a database of the domains and IPs used to send the most mail. Normally that would not be too interesting to us since we care about message body URIs, i.e. content, and not senders or their ISP addresses, but I'm thinking about whitelisting all the legitimate NSPs, ISPs and telcos in their top domains list: http://www.senderbase.org/search?page=domains we would exclude the few that appear to be spammers according to spamhaus: imgmailer.com TAM Network stocksntalk.com iMedia Networks Inc. havagreatday.com But I'd like to whitelist all the rest which are obviously large ISPs, etc. In essence we're just using it as a list of some of the top ISPs in the world. Does anyone have any comments on this? Note that this won't have a major effect on bad guys since spammers would not have much incentive to advertise their ISPs, and we don't "whiten" spams for mentioning non-spam domains anyway. It also does not mean that we're whitelisting the ISP address space, senders, or anything like that, just mail that mentions these large ISP URIs. Jeff C.

6 24

Re: [SURBL-Discuss] important reduce wrise renkles & skin spots ( fwd)
by Jeff Chan 15 Sep '04

15 Sep '04

On Wednesday, September 15, 2004, 5:36:51 AM, Anti-Spam Anti-Spam wrote: > From: "Jeff Chan" <jeffc(a)surbl.org> >> On Wednesday, September 15, 2004, 12:46:00 AM, Alex Broens wrote: >> > Jeff Chan wrote: >> >> What is your expiration algorithm? >> >> > None so far. As its all very new, I'm still "collecting". >> > On my local IP RBL I have 30 days, dunno yet what to use on URIs, I >> > assume that using 6 months at least would be safe. >> >> 6 months sounds reasonable to me. 3 months could work also. >> >> The way the sc data works is that it's refreshed by new reports >> or the records fall off the list after some number of days. In >> other words it's report-driven. > which makes sense when autromatically listing IPs as a zombie may be fixed > real fast. Not sure how that's relevant since we're doing URI domains, not zombie IPs. IOW we're doing destination URIs, not source IPs. To me they're not too connected. The hosting of the URI and the sending of spam are relatively de-coupled (not connected). > my thought is that as domains are usually paid for a year or more, their > owners have to get their ROI together, so keep them in there for at least as > long as the dom is paid for...:) Most hard core spammers use a domain for a couple days then abandon it. These spammers don't use their domains a year; they treat them as disposable. Jeff C.

1 0

RE: Start an IP list to block?
by Chris Santerre 15 Sep '04

15 Sep '04

>-----Original Message----- >From: jm(a)jmason.org [mailto:jm@jmason.org] >Sent: Friday, September 10, 2004 1:05 PM >To: Jeff Chan >Cc: SURBL Discussion list (E-mail); Spamassassin-Talk (E-mail) >Subject: Re: Start an IP list to block? > > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >Jeff Chan writes: >> On Friday, September 10, 2004, 7:27:06 AM, Chris Santerre wrote: >> > WOW! I think this would hit more FPs then listing the IP! >Am I wrong there! >> > I would never list the name server, as they may be hosting >for much more >> > then just a spammer. That number is sure to be greater >then a virtual hosts >> > number for an IP. Maybe I'm missing something key? >> >> SBL lists some spammer name server (and web server) IPs. >> Hopefully they're careful about it, since you're right listing >> name servers could affect a lot more than just the virtual hosts >> on a web server IP. > >SBL is also *very* manually-driven, and has a high level of certainty >required before anything is listed. There's some serious human vetting >going on for every IP that gets added, and they (generally) >spot the cases >where ns1.bigisp.com would be listed, and don't list them ;) > >- --j. 1) Sounds familiar...the vetting that is ;) 2) HOw the hell do you keep up on your email? I'm convinced JM is actually a machine of some sort. Possibly an old PDP11 in a university basement someone left on and forgot. It somehow became self aware. --Chris

2 1

[OT] FUN: Something to send your family members!
by Chris Santerre 15 Sep '04

15 Sep '04

I lost my freakin mind last night. I was about to drive to someone's house and stick the phone someplace they didn't want it ;) Rather then just rant about it, I figured I would take my anger and put it towards something constructive. So for anyone who knows what I'm talking about on this page, feel free to spam it to all your friends and family! ;) http://www.rulesemporium.com/rant.html Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

RE: [SURBL-Discuss] important reduce wrise renkles & skin spots ( fwd)
by Chris Santerre 14 Sep '04

14 Sep '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Tuesday, September 14, 2004 3:16 PM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] important reduce wrise renkles & >skin spots >( fwd) > > >on Tue, Sep 14, 2004 at 02:40:32PM -0400, Chris Santerre wrote: >> Not all of these are listed in SURBL: > >Neither are these: > >92sell3323serve.biz >ball5552drugs.biz >cheapest5145tabs.biz >cheapestt216655tabs.biz >extra3535pills.biz >global2000hosting.net >hide5056tabs.biz >myprog3205pillys.biz >odevide2003drugs.biz >optin9987free.net >serenajones2000netscape.net >stored78778pillllls.biz >vgeorge7098drugs.biz >your1511pills.biz >your2512pills.biz > >FYI. > Actually I did another search and came up with over 650+ WOW! --Chris

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss