Discuss

discuss@lists.surbl.org

1862 discussions

RE: [SURBL-Discuss] Re: Need help checking FP list from Theo
by Chris Santerre 09 Sep '04

09 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, September 07, 2004 9:38 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Re: Need help checking FP list from Theo > > >On Tuesday, September 7, 2004, 6:16:36 PM, Jeff Chan wrote: >> On Tuesday, September 7, 2004, 5:40:47 PM, Joe Wein wrote: >>> Chris Santerre wrote: >>>> Domain List matching contacts_email of hostmaster(a)1and1.com >>>> >>>> * 1: 1-asian-sex.com >>>> * 2: 1and1.com >>> ... >>>> * 48: uptimesoftware.com >>>> * 49: wonderfulldeals.com > >>> I think you're missing the point, Chris. The domain >1and1.com is unlikely to >>> be listed in spam, let alone *only* listed in spam. >Furthermore, of the >>> domains you list I had a hard time finding one that was >both active and >>> SURBL-listed. > >> I hope Chris was showing us some other domains with similar >> registration information. That said, *registrar* information >> isn't to useful except in the case of mostly blackhat registrars. > >I should add, this kind of data is only useful in proving a >blackhat registrar if we also know how many other domains >they have registered. > >If a registrar has 100 spam domains but 100,000 legitimate >ones they're probably not a blackhat registrar. If another >registrar has 100 spam domains but 20 legitimate ones, they're >likely a blackhat. Domains belonging to the second registrar >could be "scored" as more likely spammy by some yet to be >written (or revealed) software. However that only works if >you can see the other 100,000 and the 20, which normally you >can't. > >In other words not enough information may be visible to >draw reliable conclusions about the badness of a given >registrar. On the other hand some general information >about the number of domains some large registrar holds is >available at registration statistics sites like: > > http://www.whois.sc/internet-statistics/registrar-stats-2003.html > Jeff and Joe, This is exactly why I posted this info! For info purposes. I don't know a german web hoster from a hole in the wall! (Thats a crazy american saying for I don't know jack about them!) But I do have access to similar registrar info. And quite a lot more then what I posted. It is my hope that one day I can make it privately availible to SURBL guys. But right now I can't. Look at Jeff's comment: " > Domain List matching cluster of russ-effrig > * 1: 007inkjets.com > * 2: 00inkjets.com > * 3: 111inkjets.com > * 4: 123cartridges.com > * 5: 123inkjets.com [...] >That's interesting, but I think it misses the point:" NO it doesn't! The point was..... its interesting!! :) 123inkjets has been linked to a ton of other spam domains. The fact that they have customers makes it legit???? SO anyone who falls for these spams and buys something, makes it legit? Think about that. Where do you draw the line? All spams will have some suckers. All spams will therefore have customers. All spams will have SOMEONE report it is legit. This shall forever now be known as the Santerre Theory of Spam Legitamicy. :) I fully intend to be the Ying to Jeff's Yang. *giggle* SO we gather a few things from the info I posted, and added to by what you guys know. 1and1 is ok to whitelist. But 123inkjets is a more difficult domain. For me I say leave them listed. Sometimes legit companies spam. If they feel little pain, they will do it again. I hate FPs as much as Jeff. --Chris

2 1

RE: [SURBL-Discuss] Whitelist all Bonded Senders?
by Chris Santerre 09 Sep '04

09 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Saturday, September 04, 2004 5:04 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Whitelist all Bonded Senders? > > >On Saturday, September 4, 2004, 2:01:05 AM, Raymond Dijkxhoorn wrote: >>> >> How about www.senderbase.org ? > >>> > I would not go that way, people can test on >senderbase/bonded sender, and >>> > just like habaes this will be abused also. In my SA setup >the above scores >>> > are also taken, and will bias the score... > >>> Are any of them grey? Bonded sender claims they have paid out >>> only tiny amounts of bonds due to violations. >>> >>> Remember that not everyone uses SA. I'd like to have a list of >>> non-spammers to exclude from SURBLs. > >> I have requested rsync access on the zones, they have >responded to that >> and we will setup a feed, afterwards i can have a look on >the zones, and >> check a little better. More indepth... > >Sounds perfectly reasonable. We can check if any of their >customers hit our lists. > >Are there any other nominally whitehatting organizations >we could check into? Are there any real whitehat >certification groups? Anyone who mentions DMA will be introduced to my hockey stick! Just want to make sure we are all clear on that one ;) -note- DMA = Direct Marketers Assoc. = the evil empire --Chris

3 3

RE: [SURBL-Discuss] Need help checking FP list from Theo
by Chris Santerre 09 Sep '04

09 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, September 07, 2004 6:20 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Need help checking FP list from Theo > > >On Tuesday, September 7, 2004, 9:18:31 AM, Doc Schneider wrote: > >> I'm totally shocked that yale and seti could even be >considered "spammy" > >> And can I help with the flogging? <BOFH> > >Because they appeared in a ham does not mean they're spammy. >Sometimes it just means that some other URI in that message >got tagged. > >E.g., a message like: > > "I buy my pills from walgreens.com (a U.S. brick > and mortar pharmacy) not randompillspammer.com." > >could get tagged since it mentions a spammer. But it >doesn't mean walgreens.com is necessarily a spammer. > >Similarly seti and yale probably got mentioned along >with a listed record. > What the (#&@? So we got a list of ALL domains that were in FP reported emails. Instead of JUST the ones that actually caused the FP??????? *sigh* Well there's a few hours of my life I won't get back! --Chris

2 1

Savvis potentially shutting down 148 spammers on its network
by William Stearns 08 Sep '04

08 Sep '04

Good day, all, http://news.bbc.co.uk/1/hi/technology/3634572.stm , seen on slashdot. I don't know anything more than what's there, but it would be marvelous if their claim of shutting off their spamming customers within 10 days was true. Just in case it does turn out to be true, we ought to release SA 3.0 before they do, so we can take credit for the drastically reduced amount of spam. *grin* Just kidding. Cheers, - Bill --------------------------------------------------------------------------- "Knowledge is of two kinds. We know a subject ourselves, or we know where we can find information upon it." - Dr Samuel Johnson (1775) (Courtesy of David Cozzens, <dcozzens(a)ejhs.k12.vt.us>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

1 0

RE: [SURBL-Discuss] Whitelist Please
by Chris Santerre 08 Sep '04

08 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >In a gamer's analogy, we have the BFG9000 with quad damage >and friendly fire is on. Well now I get it! :-) --Chris

1 0

RE: [SURBL-Discuss] Numerous FPs
by Chris Santerre 08 Sep '04

08 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, September 07, 2004 6:29 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Numerous FPs > > >On Tuesday, September 7, 2004, 8:18:20 AM, Chris Santerre wrote: >> Some info: > >> Domain List matching contacts_email of can_craft(a)yahoo.com > >> * 1: a2zsol.com >> * 2: bannerscape.com >> * 3: db-hosting.com >> * 4: global-submit.com >> * 5: mardox.com <-- >> * 6: safe-mail.com >> * 7: safemaildeluxe.com > >> Domain List matching contacts_email of hostmaster(a)hotels.com > >> * 1: 180096hotel.com >> * 2: 8002hotels.com >> * 3: hoteldiscounts.com <-- >> * 4: hotelresnetwork.com >> * 5: vegashotel.com > >> Not sure if that helps to decide on those 2. But can't hurt >to have the info >> :) > >Are you saying we should whitelist them all or that some >are spammy? > >If you have research that shows one way or the other, >then please let us know. > >Jeff C. > Nope, not saying anything. It was just some info to look at. It didn't sway me either way. But not everyone has access to this info. Matter of fact I can count them on one hand ;) --Chris

1 0

Activating only SURBL and disabling other DNS/network tests in SA 3.0
by Yusuf Goolamabbas 08 Sep '04

08 Sep '04

Let's say that I want to enable only SURBL lookups in my SA 3.0 config. For now, I have to load the plugin and specifiy dns_available yes in my SA config. Since I don't want to do any RBL or other checks which may get activated as a side effect of specifying 'dns_available yes'. I also specify the following use_razor2 0 use_dcc 0 use_pyzor 0 skip_rbl_checks 1 score NO_DNS_FOR_FROM 0 score ROUND_THE_WORLD 0 Is there any other rules/settings I need to configure to prevent them from firing due to 'dns_available yes' Regards, Yusuf -- Yusuf Goolamabbas yusufg(a)outblaze.com

2 1

RE: [SURBL-Discuss] Re: Need help checking FP list from Theo
by Chris Santerre 08 Sep '04

08 Sep '04

OK, you asked for it ;) Some of this info will give you a 'feel' for who the hosts operate. >>Theo got us a list of 112 new false positives >from across all >>SURBLs. He showed me the source >messages which are almost >>all subscribed newsletters and mailing list >messages, so they >>seem quite hammy. > >>Given the type of source messages and some >spot checking, I'm >>inclined to whitelist them all, but I'd like to >ask for some help >>checking them first. Can anyone help check >these? > >123inkjets.com Oh, these guys are on my personal poop list! http://groups.google.com/groups?q=123inkjets.com+abuse&hl=en&lr=&ie=UTF-8&sa =G&scoring=d Domain List matching cluster of russ-effrig * 1: 007inkjets.com * 2: 00inkjets.com * 3: 111inkjets.com * 4: 123cartridges.com * 5: 123inkjets.com * 6: 123lasertoner.com * 7: 411inkjets.com * 8: 911inkjets.com * 9: amazingofferings.com * 10: communicationadvisor.com * 11: customoffers.com * 12: customoffersmail.com * 13: ebabyloninc.com * 14: etoll.net * 15: freecartridges.com * 16: imagerocket.com * 17: inkjetorder.com * 18: itsimazing.com * 19: mosaicdatasolutions.com * 20: niftyoffer.com * 21: proinkjets.com * 22: rocketmouse.net * 23: yourmailsource.com * 24: zbeta.com * @SPAM/spamsource: 553 SPEWS [1] zaconta, see http://spews.org/ask.cgi?S1467; SPEWS [1] tonerbuys, see http://spews.org/ask.cgi?S1506; 207.178.170/24: 553 SPAM,PINK 207.178.128.0/17 iswest.net AS5033 dedicated spam network - S1467,S2747,S2705,S2657,S786,S1467,SBL9192 2003-07 * SPEWS/spews.org: 553 SPEWS2 [1] zaconta, see http://spews.org/ask.cgi?S1467; SPEWS2 [1] tonerbuys, see http://spews.org/ask.cgi?S1506; 207.178.170/24: 553 SPEWS2 [2] zaconta, see http://spews.org/ask.cgi?S1467 >1and1.com http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&scoring=d&q=1and1.com+abu se&btnG=Search Domain List matching contacts_email of hostmaster(a)1and1.com * 1: 1-asian-sex.com * 2: 1and1.com * 3: ansonline.com * 4: attachs.com * 5: autoperl.com * 6: basix.com * 7: bb4f.info * 8: bloated.org * 9: bonzil.com * 10: clickforhosting.com * 11: college-nudes.net * 12: colomb.org * 13: cyber-cd.com * 14: discreetdvd.com * 15: diveadventurers.com * 16: domymarketing.com * 17: dynawebdesigns.com * 18: e-hostonline.net * 19: e-mazingdeals.com * 20: equestriantherapy.org * 21: equotesonline.com * 22: extremmovies.com * 23: ffa-usa.com * 24: freepussypass.com * 25: ghostbiz.com * 26: globaladvt.com * 27: gun-sales.com * 28: ivee.org * 29: ladygodivanetwork.com * 30: linethai.com * 31: marketingconceptsgroup.com * 32: medicalwebservices.net * 33: metreward.com * 34: micacy.com * 35: michigan-business.com * 36: myhouselist.com * 37: myproemail.com * 38: nastiest-teens.com * 39: njmovietime.com * 40: onlinehome-server.com * 41: onlinehome.us * 42: propappr-alachua-fl.org * 43: softwarepark-goa.org * 44: something-else.org * 45: speedyvalues.com * 46: systechintegration.com * 47: theinfoman.com * 48: uptimesoftware.com * 49: wonderfulldeals.com > >Gotomypc.com sells a remote access product >Yale.edu is the domain for Yale University http://spews.org/html/S2611.html Domain List matching spews of S2611 * 1: ca.us * 2: expertcity.com * 3: gotomypc.com * 4: internap.com * 5: pcmag-direct.com * 6: pnap.net * 7: spamlaws.com * 8: twtelecom.net * 9: wd10.com * 10: wd12.com * 11: whew.com * 12: worldatamail.com Results: Positive=5, Negative=25 (2004-09-07 15:44:25 UTC) * @ISP/blackholes.us: 66.151/16: 553 ISP INTERNAP - http://hatcheck.org/google?internap; http://hatcheck.org/sbl?internap [Blockparade] * @SPAM/spamsource: 66.151.158/24: 553 SPEWS [1] expertcity/gotomypc, see http://spews.org/ask.cgi?S2611; 66.151/16: 553 SPAM,PINK,BLOCK 66.150/16 66.151/16 66.151 66.151.44.151 joe4257769(a)mailgeorgebush.net INTERNAP 2003-04 * DRBL/drbl.all: 66.151/16: 553 DRBL weight: 0.6; vote.drbl.vimas.kiev.ua(a)ns.vimas.kiev.ua/0.6 * SPEWS/spews.org: 66.151.158/24: 553 SPEWS2 [1] expertcity/gotomypc, see http://spews.org/ask.cgi?S2611 * FIVETEN/internap.com.spam-support: added 2002-07-07; spam support - hosting sendoutmail.com and jdrmedia.com; added 2003-07-22; spam support - hosting e-i1.com spamming from NET-63-251-54-64-1; added 2003-07-02; spam support - hosting http://www.adaniexports.com on 63.251.163.110; added 2004-03-08; spam support - see http://www.spamhaus.org/SBL/sbl.lasso?query=SBL14734; added 2004-07-31; spam support - see http://www.spamhaus.org/SBL/sbl.lasso?query=SBL10031; added 2004-07-31; spam support - transit for AS30038 whose entire 69.63.160.0/20 is on the SBL; added 2003-01-15; spam support - see http://www.spamhaus.org/sbl/listings.lasso?isp=internap.com; added 2003-05-20; spam support - hosting http://www.pr0debtc0nsu1tants.com on 64.74.96.230, was on 63.251.163.110, was on verio; added 2002-01-22; on sprint.net; added 2002-10-07; spam support - hosting netflip.com; added 2003-02-04; spam support - transit for AS18633; added 2003-04-13; spam support - transit for wholesalebandwidth; added 2002-12-07; spam support - dns service for columbiahouse.com; added 2002-09-17; spam support - see http://spews.org/html/S373.html; added 2002-09-10; spam support - hosting randbad.com on 209.191.175.226; added 2002-07-22; spam support - hosting internetseer.com and roving.com I would love a copy of all the reported FPs. Perhaps they should be moved to the IC list? --Chris

3 5

Need help checking FP list from Theo
by Jeff Chan 08 Sep '04

08 Sep '04

Theo got us a list of 112 new false positives from across all SURBLs. He showed me the source messages which are almost all subscribed newsletters and mailing list messages, so they seem quite hammy. Given the type of source messages and some spot checking, I'm inclined to whitelist them all, but I'd like to ask for some help checking them first. Can anyone help check these? 123inkjets.com 1and1.com 1sound.com 4d.com 65.17.207.40 69.50.139.61 8k.com aaronsw.com achtungachtung.com activatormail.com addictivetechnologies.net aec.at agnitum.com aladdinsys.com amnesty-volunteer.org ampcast.com apple.ru atstake.com barebones.com bbspot.com bis1bp.com bridgingthegapforhealthcare.org classesusa.com clearcredit.com commonwealthclub.org conceptdraw.com crime-research.org ctsg.com default-homepage-network.com design-tools.com dontspyon.us drbott.com drivesavers.com drorshalev.com duckland.org ecsirt.net faithfulamerica.org fetchsoftworks.com fipr.org firearmsandliberty.com firepaige.org firewiredirect.com flingstone.com forest.net geoffmetcalf.com globat.com gotomypc.com guninski.com hasbrouck.org hiramoto.org hnc3k.com imgfarm.com imrsvcs.com inderjeetsodhi.com joegratz.net karelia.com lacie.com lacipeterson.com m-w.com macsales.com mail15.com maliasoft.com moveon.org mutemail.com mysurvey.com navi.cx news-miner.com ourfuture.org oxsemi.com passthison.com pcpitstop.com pivx.com pivxlabs.com popmoney.net port5.com postarmor.com prosoftengineering.com qwik-fix.net ravantivirus.com redhawk.org redlers.com reunion.com safecenter.net salary.com saturnevents.com secnetops.biz secnetops.com seti.org smalldog.com snopes.com soundclick.com spywareinfo.com tex-edit.com the-livingstons.org tidbits.com tu-cottbus.de ukclimbing.com umbrella.name uophx.edu uoregon.edu userfriendly.org vechtwijk.nl virtual.net virusall.com westdam.com wiebetech.com wireless-starter-kit.com wlug.org worldwidemart.com wpi.edu wsacorp.com yale.edu Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

7 25

Numerous FPs
by Ryan Thompson 08 Sep '04

08 Sep '04

Reposting, for those not following the original thread. I found the following FPs in WS in a large recent ham corpus. I suggest whitelisting all of these. buckeye-express.com -- Used in a personal email address, looks legit; 7 examples nm.ru -- Used in a personal email address, looks legit advanstar.com -- Legit uses; found in a well-known dental newsletter; also personal email address of one of the editors; 3 messages 00fun.com -- Confirmed, more than one user on our system sent or received eCards from them northstarconferences.com -- Legit conference host site subscribed to by two users; 9 messages in this corpus mardox.com -- Search engine; registered 1875 days ago, and *looks* like the user did actually submit their site to them. postsnet.com -- Registered exactly one year ago, 51 NANAS, blank home page, ehh... but I have 4 different legit newsletters with links to them. webspawner.com -- Created in 1996; free host/email npdor.com -- Surveys; been around since 1999. 103 NANAS, but they've been advertised by some reputable "word of the day" mailers (dictionary.com) Maybe a good candidate for UC. :-) 2 examples imninc.com -- Domain is 507 days old; they do newsletters. At least one of them is legit. :-) worldhealth.net -- It's 3468 days old today (1995). One of our users attended a conference of theirs, and signed up for a newsletter. hoteldiscounts.com -- 2459 days old (1997), found in actual room booking confirmations for Comfort Inn. - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

5 6

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss