Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

Start a nNew thread

Please Whitelist ebooks dot com
by Bitz 04 Aug '04

04 Aug '04

This is a legit site -- X-Spam-Status: No, hits=5.0 required=10.0 tests=WS_URI_RBL=5 www . ebooks . com Thanks, -B.

2 1

[SURBL-Discuss] Selectively looking up the IPs to which uri's resolve
by Rich Graves 04 Aug '04

04 Aug '04

As postmaster, I see a lot of double-bounces for a user who forwards their mail to a server that implements the policy: 550 5.7.1 mail containing 8aa.tXokG4N.fagonyenomy.org rejected - sbl; see http://www.spamhaus.org/query/bl?ip=201.3.240.234 They appear to be using the milter mentioned in http://www.surbl.org/faq.html#numbered Sure, fagonyenomy.org is in sc.surbl.org now, but these cretins register new domains pointing at the same IPs on a (at least) daily basis, and there is a time lag. The site they were spamming about this morning, thebest-search.com.sc.surbl.org, exists only on ob.surbl.or, not sc or ws. For the reasons mentioned in the FAQ, I do not agree with uri-to-ip-based blacklisting as a blanket policy, but it does seem very effective in dealing with these rapidly morphing porn spammers. I would like to give such a rule a SA score of 4 or so. In order to implement this nicely, I see a need for a *per surbl* switch in SpamCopURI telling it whether to look up the domain, or the domain as resolved to an IP. Configured something like uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2') uri SPAMHAUS_URI eval:check_spamcop_uri_rbl('sbl.spamhaus.org','127.0.0.2','ip') Obviously there is no point in looking up fagonyenomy.org in spamhaus, nor do I want to look up all resolved IPs in all surbls needlessly. I could write completely separate code to do this, but I'd like to reuse the url and redirector parsing infrastructure. Unfortunately I don't see a clean way to do this without changing the internal hash structure. Ideas? Should I just wait for (or start experimenting with now) SA3's uridnsbl and urirhsbl, which were designed for this? Yeah, that's what I was afraid of... I think I just answered my own question, but I'm curious what others think and how others are dealing with this spam gang. I can't wait for a big ISP to hit them with the big clue stick. -- Rich Graves <rcgraves(a)brandeis.edu> UNet Systems Administrator

4 7

FW: False Positive: WLS_URI_OPT_683
by Chris Santerre 04 Aug '04

04 Aug '04

I don't have this in my files. Anyone else add urbanet.ch?? --Chris >-----Original Message----- >From: Alex Broens [mailto:alexb@midway.ch] >Sent: Tuesday, August 03, 2004 2:07 PM >To: csanterre(a)MerchantsOverseas.com >Subject: False Positive: WLS_URI_OPT_683 > > >describe WLS_URI_OPT_683 URI contains sites starting with u >uri WLS_URI_OPT_683 >m/\bu(?:rbanet\.ch|rbanfreebies\.com|rbanoffers\.com|rentdvds\. >com|rerotic\.com|rgentreplymail\.com|rgentvalue\.com|rhomeloans >ource\.com|rielsys\.com|rinalslut\.com|rlintl\.com|rlintl\.net| >rlsos\.com|rncage\.com|rpersonalservice\.biz|rthelast1in\.com|r >toyz\.biz|s-advertising\.biz|s-auto\.ru|s-bp-im-pt\.info|s-gree >ncard-register\.com|s-monitor-sales\.com|s-paypal\.com|s-site-m >aintenance\.com|s1bet6\.com|s1currency\.biz|sa-dental-care\.com >|sa-greencard\.org|sa-immigration-green-card-lottery\.com|sa99\ >.net|sabusiness1\.com|sabusinesscredit\.com|sacardservices\.us| >sacdt\.com|sacredit\.com|sadentalcare\.com|safreemerchantsource >\.com|sagreencard-register\.com|sagreencardcenter\.com|sagreeti >ngs\.com|sahealthcare\.com|saherbals\.com|sahomemortgageworld\. com|sahomemortgageworld\.net|sahomemortgageworld>\.org|sahomeworkers\.com|sa inkdepot\.com|sainsurancesource\.com >|salendingnetwork\.com|salinks\.net|saloanfinder\.com)\b/i >score WLS_URI_OPT_683 3.0 > > >This footer triggered the rule above: > >Dr Rainer W.BIELINSKI >Bossons 1b >CH-1018 LAUSANNE - SWITZERLAND >Tél. +41-21-6416111 >Fax +41-21-6471968 >Mob.+41-79-2104652 >E-mail: <mailto:rbielinski@urbanet.ch>rbielinski(a)urbanet.ch > >same with the @urbanet addr in the forwarded txt below > > >Meilleures salutations / Best regards >Delisle Pierre >mailto:pierre.delisle@bluewin.ch >tél : 021 635 20 60 > : 079 204 40 72 > > > >----- Original Message ----- >From: "Claudine Wyssa" <claudine(a)wyssa.ch> >To: "Pascal Petter" <pascal.petter(a)acs.ch>; "christianmaeder" ><christianmaeder(a)mydiax.ch>; "Pierre Delisle" ><pierre.delisle(a)bluewin.ch>; >"Bruno Lutz" <blutz(a)vtx.ch>; "Etienne Lasserre" <elasserre(a)urbanet.ch>; >"Pierre Wagnières" <pf.wagnieres(a)hispeed.ch>; "O. Ostertag" ><info(a)jouxtens-mezery.ch>; "JEan Daniel Graf" <v.j-d.graf(a)bluewin.ch> >Sent: Monday, August 02, 2004 1:58 PM >Subject: Police de l'Ouest lausannois > > > >urbanet.ch is a legit ISP. > >Thanks > >Alex > >

2 1

RE: [SURBL-Discuss] Hmmm....what if?
by Chris Santerre 04 Aug '04

04 Aug '04

>-----Original Message----- >From: Patrik Nilsson [mailto:patrik@patrik.com] >Sent: Tuesday, August 03, 2004 3:10 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Hmmm....what if? > > >At 17:47 2004-08-03 +0100, Karanbir Singh wrote: >>Chris Santerre wrote: >>>What if I placed an SURBL server in the beginning of my DNS >query list? Then >>>users would actually check SURBL for a domain in a web page. >If it is in >>>SURBL they will get a 127.0.0.x and get error. Which is good! >> >>Works! All you need to do is add the multi.surbl.org ( or >whatever list >>you want to use ) to the Host Search order. So that x.com is >looked up as >>x.org.multi.surbl.org > >This would only work for x.com, not www.x.com, etc. >The SURBL servers - correctly - return NXDOMAIN when queried >for subdomains >of listed domains, rather than treat the listed domains as wildcards. > >Also - this generates a lot of unnecessary dns queries for >non-listed domains. I hate to say it.....but... Patrik is right :) --Chris

3 2

Re: [SURBL-Discuss] Hmmm....what if?
by Patrik Nilsson 04 Aug '04

04 Aug '04

At 12:11 2004-08-03 -0400, Chris Santerre wrote: >What if I placed an SURBL server in the beginning of my DNS query list? Then >users would actually check SURBL for a domain in a web page. If it is in >SURBL they will get a 127.0.0.x and get error. Which is good! > >Am I missing something, or is it that easy? Your users would query for the RR host.domain.com, not the RR domain.com.multi/xx.surbl.org. Patrik

3 2

Hmmm....what if?
by Chris Santerre 03 Aug '04

03 Aug '04

What if I placed an SURBL server in the beginning of my DNS query list? Then users would actually check SURBL for a domain in a web page. If it is in SURBL they will get a 127.0.0.x and get error. Which is good! Am I missing something, or is it that easy? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 2

RE: [SURBL-Discuss] Hmmm....what if?
by Chris Santerre 03 Aug '04

03 Aug '04

>-----Original Message----- >From: Karanbir Singh [mailto:mail-lists@karan.org] >Sent: Tuesday, August 03, 2004 12:48 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Hmmm....what if? > > >hey, > >Chris Santerre wrote: >> What if I placed an SURBL server in the beginning of my DNS >query list? Then >> users would actually check SURBL for a domain in a web page. >If it is in >> SURBL they will get a 127.0.0.x and get error. Which is good! > >Works! All you need to do is add the multi.surbl.org ( or >whatever list >you want to use ) to the Host Search order. So that x.com is looked up >as x.org.multi.surbl.org > >Whatever DNS servers you are using at the time, should keep working + >Caching. > >I run this at a few places. Works well across a squid proxy, specially >since u can then have a real page on the 127.0.0.x interface ( = the >gateway machine's ) telling your users what happened. > >Is this what you had in mind ? > VERY COOL! Thanks! Now if only I could get Win98 to actually listen to the search order! :) --Chris

1 0

Possible FP in WS - imagestation.com
by Patrik Nilsson 03 Aug '04

03 Aug '04

imagestation.com is listed in WS. It's a Sony domain. Searching NANAS, I can't find any recent reports mentioning imagestation.com. Outgoing imagestation.com mail servers, such as zms0.imagestation.com, are listed in AUDNSBL and SORBS - as servers sending to spamtraps. But they are not listed in SBL or Spews. So... it's ambiguous. I assume that there are quite a few willing subscribers to the imagestation news letters though, so there is probably a high level of collateral damage if it's listed. Patrik

2 1

RE: [SURBL-Discuss] FP's in ws.surbl.org
by Chris Santerre 03 Aug '04

03 Aug '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Monday, August 02, 2004 4:48 PM >To: Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] FP's in ws.surbl.org > > >Hi! > >> > OUCH I'm farther behind then I thought!! I have 2 lists, >one 416 domains, >> > the other 347 domains. All to be checked. And that's not >all!!!! So if two >> > people would each take a list, I could work on the other 500+. > >> Looks like we need a clearinghouse so multiple people can help >> check these. It needn't be the fancy one Paul proposed; just >> some way to distribute them. >> >> Does anyone have a trouble ticket system already running that >> we could use and feed these into? > >We allready worked away the backlog, so pump in some new ones. >Chris is >bored :) heh. > >Ohw, btw, we just passed the 40k domains on WS. > Yeah if I get swamped again I just might send up the red flag here for some people to help like yesterday. Was a big help! I have more to add today ;) --Chris

1 0

Please whitelist ebooks.com
by Bitz 03 Aug '04

03 Aug '04

This is a legit site -- X-Spam-Status: No, hits=5.0 required=10.0 tests=WS_URI_RBL=5 http://www.ebooks.com Thanks, -B.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss