Discuss

discuss@lists.surbl.org

1862 discussions

RE: [SURBL-Discuss] statcounter.com FP on WS.
by Chris Santerre 09 Aug '04

09 Aug '04

Then perhaps he should implement checking SURBL on future customers? --Chris >-----Original Message----- >From: Michele Neylon : Blacknight Solutions >[mailto:michele@blacknightsolutions.com] >Sent: Saturday, August 07, 2004 8:08 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] statcounter.com FP on WS. > > >On Sat, 2004-08-07 at 12:31, Patrik Nilsson wrote: >> statcounter.com is listed on WS. >> >> It's a service used for hit tracking, primarily for web stats. >> It also shows up in emails, sometimes in spam from >main-sleaze spammers. >> >> Having it listed means quite a lot of collateral damage though. >> Just do a search for statcounter.com on Google Groups and >check the recent >> ratio of legit postings vs. NANAS reports actually involving >potential >> abuse from statcounter.com: >> <http://groups.google.com/groups?q=statcounter.com&scoring=d> >> >I know the guy who runs that site and he is legit. If there are any >issues with spammers abusing the service I'm sure I could get him to >take action against their accounts. > >Michele >-- >Mr. Michele Neylon >Blacknight Internet Solutions Ltd >http://www.blacknight.ie/ >+353 59 913 7101 > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] Whitelisted: clickbank.net
by Chris Santerre 09 Aug '04

09 Aug '04

Perhaps they should use SURBL to check their customers then. I have only seen them in spams. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Sunday, August 08, 2004 5:08 PM >To: SURBL Discuss >Subject: [SURBL-Discuss] Whitelisted: clickbank.net > > >I've whitelisted clickbank.net . They were on BE and WS before. > >This appears to be a site with legitimate uses which occasionally >gets abused. They seem to shut down abusers. > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Whitelisted: clickbank.net
by Jeff Chan 08 Aug '04

08 Aug '04

I've whitelisted clickbank.net . They were on BE and WS before. This appears to be a site with legitimate uses which occasionally gets abused. They seem to shut down abusers. Jeff C.

1 0

PH list question
by Bill Landry 08 Aug '04

08 Aug '04

I have been running multi test since the release of SpamCopURI-0.20, however, in spite of the fact that I have seen several phishing e-mail from US Bank and E-Bay, and others, I have never gotten a hit on ph.surbl.org. Here are my test entries: ========== uri SC_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/2') describe SC_URI_RBL URI's domain appears in SC database at sc.surbl.org tflags SC_URI_RBL net score SC_URI_RBL 17.0 uri WS_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/4') describe WS_URI_RBL URI's domain appears in WS database at ws.surbl.org tflags WS_URI_RBL net score WS_URI_RBL 17.0 uri PH_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/8') describe PH_URI_RBL URI's domain appears in PH database at ph.surbl.org tflags PH_URI_RBL net score PH_URI_RBL 27.0 uri OB_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/16') describe OB_URI_RBL URI's domain appears in OB database at ob.surbl.org tflags OB_URI_RBL net score OB_URI_RBL 17.0 uri AB_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/32') describe AB_URI_RBL URI's domain appears in AB database at ab.surbl.org tflags AB_URI_RBL net score AB_URI_RBL 17.0 uri DS_URI_RBL eval:check_spamcop_uri_rbl('ds.surbl.org','127.0.0.2') describe DS_URI_RBL URI's domain appears in DS database at ds.surbl.org tflags DS_URI_RBL net score DS_URI_RBL 12.0 ========== I get lots of hits on all of the other test. Can someone post a munged URI that should hit on the PH list so I can test with it. Thanks, Bill

4 8

statcounter.com FP on WS.
by Patrik Nilsson 07 Aug '04

07 Aug '04

statcounter.com is listed on WS. It's a service used for hit tracking, primarily for web stats. It also shows up in emails, sometimes in spam from main-sleaze spammers. Having it listed means quite a lot of collateral damage though. Just do a search for statcounter.com on Google Groups and check the recent ratio of legit postings vs. NANAS reports actually involving potential abuse from statcounter.com: <http://groups.google.com/groups?q=statcounter.com&scoring=d> Patrik

3 2

bigfishgames.com FP on WS.
by Patrik Nilsson 07 Aug '04

07 Aug '04

bigfishgames.com is listed on WS. Apart from consistent reports from one single individual, there are very few NANAS reports, especially considering that they send out a news letter with a Senderbase monthly magnitude of 5.4. Their outgoing mail server, 63.251.10.170, is not listed on any major RBL. Patrik

1 0

Redirection service - rg3.net, listed in WS.
by Patrik Nilsson 07 Aug '04

07 Aug '04

Hi, rg3.net is listed in WS. It is a redirection service, redirecting third level domains like polimidia.rg3.net. They might have spammy third level domains, but they do have non-spammy ones as well. Not sure whitelisting the second level domains is the best way to handle these kind of redirection services though. If they are whitelisted, we can't blacklist third levels below those domains that are spammy, right? Wouldn't it be better if we could treat these kind of third level redirectors similarly to the way we treat subdelegated country domains - checking the third level domain rather than the second? Extending what is done in RegistrarBoundaries.pm for URIDNSBL would probably be easier than doing something similar in SpamCopURI though. Patrik

3 4

Errors with spamassassin --lint
by Mailing List 07 Aug '04

07 Aug '04

RHEL 3.0 + SpamAssassin 2.63 + SpamCopURI 0.20 or 0.21 Using the spamcop_uri.cf file from the package at http://www.fsl.com/support/index.html Here is the output: [root@mailgw spamassassin]# spamassassin --lint Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri snurl.com *.snurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri snipurl.com *.snipurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri tinyclick.com *.tinyclick.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri babyurl.com *.babyurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri lin.kz *.lin.kz Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri *.v3.net Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri shorl.com *.shorl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri tinyurl.com *.tinyurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri xurl.us Failed to compile URI SpamAssassin tests, skipping: (syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 1, near "eval:" syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule OB_URI_RBL, line 1, near "eval:" syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule OB_URI_RBL, line 6, near "} }" ) When I use the spamcop_uri.cf file that comes with the 0.21 distribution I get the following output: [root@mailgw spamassassin]# spamassassin --lint Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri snurl.com *.snurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri snipurl.com *.snipurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri tinyclick.com *.tinyclick.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri babyurl.com *.babyurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri lin.kz *.lin.kz Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri *.v3.net Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri shorl.com *.shorl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri tinyurl.com *.tinyurl.com Failed to parse line in SpamAssassin configuration, skipping: open_redirect_list_spamcop_uri xurl.us Failed to compile URI SpamAssassin tests, skipping: (syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 1, near "eval:" syntax error at /usr/share/spamassassin/20_uri_tests.cf, rule URI_OFFERS, line 215, near "; }" ) If I remove the spamcop_uri.cf file, spamassassin --lint goes well. I have fairly the same setup on other boxes and don't have the problem. Kindest regards, Guy

4 4

Re: quickinspirations.com
by Jeff Chan 07 Aug '04

07 Aug '04

On Friday, July 30, 2004, 5:17:43 PM, Bitz wrote: > quickinspirations.com I went ahead and whitelisted quickinspirations.com . The site has potential for spam since it allows anyone to send their messages to anyone else, but it also probably has some legitimate uses so it probably should be whitelisted. I am writing to them about it. Looks like it was on WS. They do not look like a big time spammer, so the WS data folks should check how it got on. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

rsync access
by Andy Dills 07 Aug '04

07 Aug '04

Let me start by thanking everybody for their efforts with surbl...we just recently added it in to our filtering, and it's improved spamassassin dramatically. I'm a bit skeptical of the long term value, because I already see an increase of one-run-only domains. Just another $10 they have to pay to send out their spam. But regardless, it's kicking some ass right now, and every tool helps. We get a good bit of mail though (2-3mm), and would like rsync access so we can serve the zones ourselves. I filled out a request, but no luck. Somebody on vacation or something? :) So, if somebody who can enable that could contact me offlist, it would be much appreciated. Thanks, Andy --- Andy Dills Xecunet, Inc. www.xecu.net 301-682-9972 ---

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss