Discuss

discuss@lists.surbl.org

1862 discussions

[SURBL-Discuss] Please beta test ms.surbl.org - data from MailSecurity
by Jeff Chan 04 Aug '04

04 Aug '04

David Hooton has made available to us MailSecurity's spamvertised site data for public use. I have turned that data into a SURBL list for testing: ms.surbl.org This is the same company that has provided the phishing data currently in multi.surbl.org. Please do corpus checks, etc. but don't use it on high volume mail servers yet since it's only hosted on my mail server right now. Please let us know what spam detection rates you get and particularly about false positive rates. At this point we don't know if the data will stay a separate list, be added to multi only, get folded into ws, etc. The results you report will help us decide that. Jeff C.

9 23

ANNOUNCE: Mail::SpamAssassin::SpamCopURI 0.20
by Eric Kolve 04 Aug '04

04 Aug '04

Just released SpamCopURI 0.20. Biggest change is support for multi.surbl.org. Let me know if you see anything strange. See the change notes below for what you need to do for your config. 0.20 Sat Jul 31 22:02:20 PDT 2004 - adding max url config param to limit number of URLs checked in an email. Usage (place into .cf file): spamcop_uri_limit 50 Default is unlimited. - adding support for multi.surbl.org / bitmasked results. query results are cached on a per msg basis to prevent additional lookups. Modify your configuration to look like the following for sc.surbl.org: uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/2') describe SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org tflags SPAMCOP_URI_RBL net ws.surbl.org would look like this: uri WS_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/4') describe WS_URI_RBL URI's domain appears in ws database at ws.surbl.org tflags WS_URI_RBL net - Removed configuration params: spamcop_uri_src and spamcop_uri_path since these should never be used anymore. - added cleanup for hosts that come in with a dot in front of of the host (e.g. http://.spammy-site.org) http://sourceforge.net/projects/spamcopuri/ --eric

9 25

multi.surbl.org
by Cami 04 Aug '04

04 Aug '04

Hi All, Is multi.surbl.org SA 3.0 specific? Cami

3 2

RE: [SURBL-Discuss] Please beta test ms.surbl.org - data from Mai lSecurity
by Chris Santerre 04 Aug '04

04 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, August 02, 2004 4:27 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Please beta test ms.surbl.org - data from >Mai lSecurity > > >On Monday, August 2, 2004, 8:09:49 AM, David Hooton wrote: >> On Fri, 30 Jul 2004 11:14:45 -0400, Chris Santerre >> <csanterre(a)merchantsoverseas.com> wrote: >>> >>> >>> >-----Original Message----- >>> >From: Jeff Chan [mailto:jeffc@surbl.org] >>> >Sent: Friday, July 30, 2004 3:32 AM >>> >To: SURBL Discussion list >>> >Subject: Re: [SURBL-Discuss] Please beta test ms.surbl.org >- data from >>> >MailSecurity >>> > >>> 3) When will we have an SURBL contributors BBQ? Soon I >hope, I'm hungry! > >> Come to Sydney Australia - I'm sure MailSecurity would be happy to >> throw a shrimp on the barbie! Sorry Chris - no Ice Hockey here >> though!! > >Make it some prawns, and I'm there. ;-) > I'll eat just about anything :) We can play rugby, or any other sport in which people try to hurt me! Is "Sheila" wrestling a sport down there? ;) --Chris

3 2

TTL/turnaround times for SURBL
by Rob McEwen 03 Aug '04

03 Aug '04

RE: TTL/turnaround times for SURBL This discussion seems to have gotten drowned out by other recent discussions. I'd like to see where this stands at this point. In particular, Jeff noted that Outblaze updates their data very fast in response to fast analysis of their spam-trap data. But the OutBlaze feed at SURBL get updated every six hours? Doesn't that defeat the purpose. Would it be possible to speed up the ob.surbl.org refresh so that we can reap more benefits from their quick responsiveness? Also, it was mentioned that the sc.surbl.org data updates every ten minutes? Is there really substantial new or different data in this feed to justify this? (in other words, is there a system where very, very new data causes quick updates to sc.surbl.org) Finally, has any progress been made speeding up the refresh times for multi.surbl.org? Rob McEwen

3 3

Please Whitelist ebooks dot com
by Bitz 03 Aug '04

03 Aug '04

This is a legit site -- X-Spam-Status: No, hits=5.0 required=10.0 tests=WS_URI_RBL=5 www . ebooks . com Thanks, -B.

2 1

[SURBL-Discuss] Selectively looking up the IPs to which uri's resolve
by Rich Graves 03 Aug '04

03 Aug '04

As postmaster, I see a lot of double-bounces for a user who forwards their mail to a server that implements the policy: 550 5.7.1 mail containing 8aa.tXokG4N.fagonyenomy.org rejected - sbl; see http://www.spamhaus.org/query/bl?ip=201.3.240.234 They appear to be using the milter mentioned in http://www.surbl.org/faq.html#numbered Sure, fagonyenomy.org is in sc.surbl.org now, but these cretins register new domains pointing at the same IPs on a (at least) daily basis, and there is a time lag. The site they were spamming about this morning, thebest-search.com.sc.surbl.org, exists only on ob.surbl.or, not sc or ws. For the reasons mentioned in the FAQ, I do not agree with uri-to-ip-based blacklisting as a blanket policy, but it does seem very effective in dealing with these rapidly morphing porn spammers. I would like to give such a rule a SA score of 4 or so. In order to implement this nicely, I see a need for a *per surbl* switch in SpamCopURI telling it whether to look up the domain, or the domain as resolved to an IP. Configured something like uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2') uri SPAMHAUS_URI eval:check_spamcop_uri_rbl('sbl.spamhaus.org','127.0.0.2','ip') Obviously there is no point in looking up fagonyenomy.org in spamhaus, nor do I want to look up all resolved IPs in all surbls needlessly. I could write completely separate code to do this, but I'd like to reuse the url and redirector parsing infrastructure. Unfortunately I don't see a clean way to do this without changing the internal hash structure. Ideas? Should I just wait for (or start experimenting with now) SA3's uridnsbl and urirhsbl, which were designed for this? Yeah, that's what I was afraid of... I think I just answered my own question, but I'm curious what others think and how others are dealing with this spam gang. I can't wait for a big ISP to hit them with the big clue stick. -- Rich Graves <rcgraves(a)brandeis.edu> UNet Systems Administrator

4 7

FW: False Positive: WLS_URI_OPT_683
by Chris Santerre 03 Aug '04

03 Aug '04

I don't have this in my files. Anyone else add urbanet.ch?? --Chris >-----Original Message----- >From: Alex Broens [mailto:alexb@midway.ch] >Sent: Tuesday, August 03, 2004 2:07 PM >To: csanterre(a)MerchantsOverseas.com >Subject: False Positive: WLS_URI_OPT_683 > > >describe WLS_URI_OPT_683 URI contains sites starting with u >uri WLS_URI_OPT_683 >m/\bu(?:rbanet\.ch|rbanfreebies\.com|rbanoffers\.com|rentdvds\. >com|rerotic\.com|rgentreplymail\.com|rgentvalue\.com|rhomeloans >ource\.com|rielsys\.com|rinalslut\.com|rlintl\.com|rlintl\.net| >rlsos\.com|rncage\.com|rpersonalservice\.biz|rthelast1in\.com|r >toyz\.biz|s-advertising\.biz|s-auto\.ru|s-bp-im-pt\.info|s-gree >ncard-register\.com|s-monitor-sales\.com|s-paypal\.com|s-site-m >aintenance\.com|s1bet6\.com|s1currency\.biz|sa-dental-care\.com >|sa-greencard\.org|sa-immigration-green-card-lottery\.com|sa99\ >.net|sabusiness1\.com|sabusinesscredit\.com|sacardservices\.us| >sacdt\.com|sacredit\.com|sadentalcare\.com|safreemerchantsource >\.com|sagreencard-register\.com|sagreencardcenter\.com|sagreeti >ngs\.com|sahealthcare\.com|saherbals\.com|sahomemortgageworld\. com|sahomemortgageworld\.net|sahomemortgageworld>\.org|sahomeworkers\.com|sa inkdepot\.com|sainsurancesource\.com >|salendingnetwork\.com|salinks\.net|saloanfinder\.com)\b/i >score WLS_URI_OPT_683 3.0 > > >This footer triggered the rule above: > >Dr Rainer W.BIELINSKI >Bossons 1b >CH-1018 LAUSANNE - SWITZERLAND >Tél. +41-21-6416111 >Fax +41-21-6471968 >Mob.+41-79-2104652 >E-mail: <mailto:rbielinski@urbanet.ch>rbielinski(a)urbanet.ch > >same with the @urbanet addr in the forwarded txt below > > >Meilleures salutations / Best regards >Delisle Pierre >mailto:pierre.delisle@bluewin.ch >tél : 021 635 20 60 > : 079 204 40 72 > > > >----- Original Message ----- >From: "Claudine Wyssa" <claudine(a)wyssa.ch> >To: "Pascal Petter" <pascal.petter(a)acs.ch>; "christianmaeder" ><christianmaeder(a)mydiax.ch>; "Pierre Delisle" ><pierre.delisle(a)bluewin.ch>; >"Bruno Lutz" <blutz(a)vtx.ch>; "Etienne Lasserre" <elasserre(a)urbanet.ch>; >"Pierre Wagnières" <pf.wagnieres(a)hispeed.ch>; "O. Ostertag" ><info(a)jouxtens-mezery.ch>; "JEan Daniel Graf" <v.j-d.graf(a)bluewin.ch> >Sent: Monday, August 02, 2004 1:58 PM >Subject: Police de l'Ouest lausannois > > > >urbanet.ch is a legit ISP. > >Thanks > >Alex > >

2 1

RE: [SURBL-Discuss] Hmmm....what if?
by Chris Santerre 03 Aug '04

03 Aug '04

>-----Original Message----- >From: Patrik Nilsson [mailto:patrik@patrik.com] >Sent: Tuesday, August 03, 2004 3:10 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Hmmm....what if? > > >At 17:47 2004-08-03 +0100, Karanbir Singh wrote: >>Chris Santerre wrote: >>>What if I placed an SURBL server in the beginning of my DNS >query list? Then >>>users would actually check SURBL for a domain in a web page. >If it is in >>>SURBL they will get a 127.0.0.x and get error. Which is good! >> >>Works! All you need to do is add the multi.surbl.org ( or >whatever list >>you want to use ) to the Host Search order. So that x.com is >looked up as >>x.org.multi.surbl.org > >This would only work for x.com, not www.x.com, etc. >The SURBL servers - correctly - return NXDOMAIN when queried >for subdomains >of listed domains, rather than treat the listed domains as wildcards. > >Also - this generates a lot of unnecessary dns queries for >non-listed domains. I hate to say it.....but... Patrik is right :) --Chris

3 2

Re: [SURBL-Discuss] Hmmm....what if?
by Patrik Nilsson 03 Aug '04

03 Aug '04

At 12:11 2004-08-03 -0400, Chris Santerre wrote: >What if I placed an SURBL server in the beginning of my DNS query list? Then >users would actually check SURBL for a domain in a web page. If it is in >SURBL they will get a 127.0.0.x and get error. Which is good! > >Am I missing something, or is it that easy? Your users would query for the RR host.domain.com, not the RR domain.com.multi/xx.surbl.org. Patrik

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss