Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

RFC: Lowering TTLs
by Jeff Chan 10 Aug '04

10 Aug '04

We would like to drop the TTL on the SURBL zone files that had 6 and 8 hour TTLs down to 1 hour in order to get new entries active sooner. We have not tested this to see what effect it would have on name server traffic. Does anyone have any comments or concerns about this? One hour would still be longer than the default 35 minute TTL that rbldnsd uses. (We would still like to separately experiment with range of different TTLs to see where lowering them causes traffic to increase a lot. We would then pick values longer than that. That optimization can probably be done independently.) Comments? Jeff C.

1 0

SA 2.64 and SURBL issues...
by Robert Leonard 10 Aug '04

10 Aug '04

Since upgrading my spamcopuri to version .22 I haven't seen any spam's getting tagged by it.. SA 2.63 lints fine... But when I try to 'upgrade' to 2.64 I get the following, which makes me think something isn't right, either with SA or with spamcopuri.. -------Here is what I get.. And I get it many times... Syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule WS_URI_RBL, line 6, near ") )") t/rule_tests.....ok 44/62Failed to com;ile URI SpamAssassin tests, skipping:(syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule OB_URI_RBL, line 1, near "eval:" -------------- and so on.. Any idea what might be causing this? I've tried re-install spamcopuri and restarting SA.. I still see nothing getting caught by the URI tests.. And everytime I try to install/upgrade SA 2.64 I get the above errros during the installation... Thanks!!!!!!1 -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Monday, August 09, 2004 1:42 PM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] your-tradetool dot com On Monday, August 9, 2004, 1:16:47 PM, Lindsay Snider wrote: > Looking into it further, I found this link on google > http://216.239.39.104/search?q=cache:EzOFwrN5SrYJ:www.wholesale411.com > /bbs/search.php%3Fsearch_author%3DFeye+your-tradetool&hl=en > The domains listed have the same bogus yahoo information. Unless I > hear otherwise, I'll blacklist them in ws for now. Multiple domains with the same fake yahoo or hotmail address or frequently occurring fake postal address can be a good indicator of fraudsters/spammers. However the best evidence of spamming is a spam. Has anyone gotten one with these domains? Jeff C. > On Monday 09 August 2004 03:57 pm, Lindsay Snider wrote: >> We received what looks to be a phishing scam involving your-tradetool >> dot com. Their site is newly registered and various things don't match up. >> Although their domain is so new, they claim to have been in business >> since 1997-2004. The whois records show what looks to be fake yahoo information. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

your-tradetool dot com
by Lindsay Snider 09 Aug '04

09 Aug '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We received what looks to be a phishing scam involving your-tradetool dot com. Their site is newly registered and various things don't match up. Although their domain is so new, they claim to have been in business since 1997-2004. The whois records show what looks to be fake yahoo information. Any thoughts on this one? - -lindsay -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBF9cVNWvCHVPDSuERAoKYAJ0aFIsHGLWKYQ02SR9NTLrUVlvuXQCeIblr Ls/mca02E28MOIoU6ew5HLI= =eUJ7 -----END PGP SIGNATURE-----

3 3

Will this get added right?
by Chris Santerre 09 Aug '04

09 Aug '04

wam.co.za I want to add that to the list, but I'm not sure it will be added correctly? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

RE: [SURBL-Discuss] Re: quickinspirations.com
by Chris Santerre 09 Aug '04

09 Aug '04

Wasn't in my stuff. But I have seen this and bigfishgamer both submitted to me. It was in the older 6dos data files. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, August 06, 2004 6:55 PM >To: SURBL Discuss >Subject: [SURBL-Discuss] Re: quickinspirations.com > > >On Friday, July 30, 2004, 5:17:43 PM, Bitz wrote: >> quickinspirations.com > >I went ahead and whitelisted quickinspirations.com . > >The site has potential for spam since it allows anyone >to send their messages to anyone else, but it also >probably has some legitimate uses so it probably should >be whitelisted. I am writing to them about it. > >Looks like it was on WS. > >They do not look like a big time spammer, so the WS data >folks should check how it got on. > >Jeff C. >-- >Jeff Chan >mailto:jeffc@surbl.org >http://www.surbl.org/ > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] statcounter.com FP on WS.
by Chris Santerre 09 Aug '04

09 Aug '04

Then perhaps he should implement checking SURBL on future customers? --Chris >-----Original Message----- >From: Michele Neylon : Blacknight Solutions >[mailto:michele@blacknightsolutions.com] >Sent: Saturday, August 07, 2004 8:08 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] statcounter.com FP on WS. > > >On Sat, 2004-08-07 at 12:31, Patrik Nilsson wrote: >> statcounter.com is listed on WS. >> >> It's a service used for hit tracking, primarily for web stats. >> It also shows up in emails, sometimes in spam from >main-sleaze spammers. >> >> Having it listed means quite a lot of collateral damage though. >> Just do a search for statcounter.com on Google Groups and >check the recent >> ratio of legit postings vs. NANAS reports actually involving >potential >> abuse from statcounter.com: >> <http://groups.google.com/groups?q=statcounter.com&scoring=d> >> >I know the guy who runs that site and he is legit. If there are any >issues with spammers abusing the service I'm sure I could get him to >take action against their accounts. > >Michele >-- >Mr. Michele Neylon >Blacknight Internet Solutions Ltd >http://www.blacknight.ie/ >+353 59 913 7101 > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] Whitelisted: clickbank.net
by Chris Santerre 09 Aug '04

09 Aug '04

Perhaps they should use SURBL to check their customers then. I have only seen them in spams. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Sunday, August 08, 2004 5:08 PM >To: SURBL Discuss >Subject: [SURBL-Discuss] Whitelisted: clickbank.net > > >I've whitelisted clickbank.net . They were on BE and WS before. > >This appears to be a site with legitimate uses which occasionally >gets abused. They seem to shut down abusers. > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Whitelisted: clickbank.net
by Jeff Chan 08 Aug '04

08 Aug '04

I've whitelisted clickbank.net . They were on BE and WS before. This appears to be a site with legitimate uses which occasionally gets abused. They seem to shut down abusers. Jeff C.

1 0

PH list question
by Bill Landry 08 Aug '04

08 Aug '04

I have been running multi test since the release of SpamCopURI-0.20, however, in spite of the fact that I have seen several phishing e-mail from US Bank and E-Bay, and others, I have never gotten a hit on ph.surbl.org. Here are my test entries: ========== uri SC_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/2') describe SC_URI_RBL URI's domain appears in SC database at sc.surbl.org tflags SC_URI_RBL net score SC_URI_RBL 17.0 uri WS_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/4') describe WS_URI_RBL URI's domain appears in WS database at ws.surbl.org tflags WS_URI_RBL net score WS_URI_RBL 17.0 uri PH_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/8') describe PH_URI_RBL URI's domain appears in PH database at ph.surbl.org tflags PH_URI_RBL net score PH_URI_RBL 27.0 uri OB_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/16') describe OB_URI_RBL URI's domain appears in OB database at ob.surbl.org tflags OB_URI_RBL net score OB_URI_RBL 17.0 uri AB_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/32') describe AB_URI_RBL URI's domain appears in AB database at ab.surbl.org tflags AB_URI_RBL net score AB_URI_RBL 17.0 uri DS_URI_RBL eval:check_spamcop_uri_rbl('ds.surbl.org','127.0.0.2') describe DS_URI_RBL URI's domain appears in DS database at ds.surbl.org tflags DS_URI_RBL net score DS_URI_RBL 12.0 ========== I get lots of hits on all of the other test. Can someone post a munged URI that should hit on the PH list so I can test with it. Thanks, Bill

4 8

statcounter.com FP on WS.
by Patrik Nilsson 07 Aug '04

07 Aug '04

statcounter.com is listed on WS. It's a service used for hit tracking, primarily for web stats. It also shows up in emails, sometimes in spam from main-sleaze spammers. Having it listed means quite a lot of collateral damage though. Just do a search for statcounter.com on Google Groups and check the recent ratio of legit postings vs. NANAS reports actually involving potential abuse from statcounter.com: <http://groups.google.com/groups?q=statcounter.com&scoring=d> Patrik

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss