Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

RE: [SURBL-Discuss] WS FP? yourdomain-MUNGED.com
by Chris Santerre 20 Jul '04

20 Jul '04

>-----Original Message----- >From: Ryan Thompson [mailto:surbl@sasknow.com] >Sent: Tuesday, July 20, 2004 11:49 AM >To: SURBL Discussion list >Subject: [SURBL-Discuss] WS FP? yourdomain-MUNGED.com > > > >So, I'm a filthy spammer, I guess. I just sent out a mass >email like so: > >> 2. At the opening page, enter either your email address (for >> example, info(a)yourdomain-MUNGED.com), or your username (for >> example, yd-info). > >I was a little surprised to see yourdomain.com come back with hits on >WS. Maybe I'll have to start using >"info(a)yourdomainthatnobodywilleverlistinsurbl.org", but that's a bugger >to word-wrap. :-) > >Seriously, what's the deal? Is yourdomain.com really a spamvertized >site, or is it just an innocent victim? A quick grep of >~10,000s/10,000h >had this hit on 0s/6h. (And only one of them was me :-) > >- Ryan > Quite curious. These show up in the 6dos misc.c file: yourdomain.biz yourdomain.com But no tmuch other then munged listings in NANAS. I think these should be whitelisted!!!! --Chris

2 1

RE: [SURBL-Discuss] exacttarget-MUNGED.com
by Chris Santerre 20 Jul '04

20 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, July 19, 2004 5:15 PM >To: Chris Santerre >Cc: 'SURBL Discussion list'; rob(a)pvsys.com >Subject: Re: [SURBL-Discuss] exacttarget-MUNGED.com > > >On Monday, July 19, 2004, 9:42:29 AM, Chris Santerre wrote: >>>On Mon, 19 Jul 2004, Rob McEwen wrote: > >>>> The offending domain found in this newsletter is the following: >>>> >>>> exacttarget-MUNGED.com > >> These guys apear to be shammers (Spam and ham). NANAS has a >bunch of posts. >> I believe they were added due to a Home Depot spam run to a bunch of >> harvested addresses. They are NOT white. > >Somewhat in their defense, they appear to be a commercial mailing >company with quasi-reasonable (not 100% confirmed opt-in?) >anti-spam policies: > > http://website.exacttarget.com/exacttarget_company_antispam.asp > > http://website.exacttarget.com/exacttarget_bestpractices_permission.asp >Perhaps Home Depot was an isolated incident with a bad data source. Agreed. They may have hired a shady marketer that did the run without them knowing. However if any of you have a Keep-An-Eye-On file, I would put these guys in it. --Chris

1 0

[SURBL-Discuss] RE: sex.surbl.org (was: Re: include IP lookups in SURBL lists)
by Chris Santerre 20 Jul '04

20 Jul '04

*snip* >At nearly 500k record we'd definitely want to do this >with rbldnsd. BIND is already getting pretty slow with lists >approaching 100k records. For comparison, sbl.spamhaus.org >has about 5k records, xbl has about 1.7 million records, >list.dsbl.org has nearly 4 million records. multi.surbl.org, >our largest production list has about 45k records. It keeps growning fast! > >How does anyone else feel about turning this list of sex sites >into a SURBL? > >Jeff C. +1 for me. Keeping it a seperate list is a great idea. Gives admins the choice. Especially ISPs who may only wish to tag spam, but allow customers to look at the occasional naughty boom boom kissy kissy :) --Chris

4 3

lindowsinc.com FP in OB.
by Patrik Nilsson 20 Jul '04

20 Jul '04

lindowsinc.com is currently listed in OB. Can't see any reason why it should be listed. Not mentioned in any NANAS reports. Patrik

2 1

WS FP? yourdomain-MUNGED.com
by Ryan Thompson 20 Jul '04

20 Jul '04

So, I'm a filthy spammer, I guess. I just sent out a mass email like so: > 2. At the opening page, enter either your email address (for > example, info(a)yourdomain-MUNGED.com), or your username (for > example, yd-info). I was a little surprised to see yourdomain.com come back with hits on WS. Maybe I'll have to start using "info(a)yourdomainthatnobodywilleverlistinsurbl.org", but that's a bugger to word-wrap. :-) Seriously, what's the deal? Is yourdomain.com really a spamvertized site, or is it just an innocent victim? A quick grep of ~10,000s/10,000h had this hit on 0s/6h. (And only one of them was me :-) - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

1 0

RE: RFC: sex site domain SURBL
by Chris Santerre 20 Jul '04

20 Jul '04

Now that I've seen the data and I've thought about it longer, maybe it isn't right for us to use. If they haven't spam'd, then why should we block it. IF a company wants to block these sites, they should use a proxy. And if someone gets a UCE/UBE from them, we will list. Otherwise they have subscribed and that would be the individual companies policy problem. So I would like to change my vote to a -1. With a clearer view of the picture, it doesn't seem right. --Chris

1 0

RE: [SURBL-Discuss] RE: 6dos data into ds.surbl.org
by Joseph Burford 20 Jul '04

20 Jul '04

Jeff, > I'd like to hear what anyone else has to say before we pull > the plug on ds though. For every 1000 spam hits on SC/WS/OB.surbl.org DS only gets 100. I haven't yet seen a real world spam hit in DS that wasn't in one of the other lists. Over the last few weeks I have had it in our systems it's running between 4 and 5 percent FP. Personally I'm inclined to think it is a waste of resources. The dynamic data on SC, and the ability to submit to WS make those lists a lot more attractive and worthwhile. Regards, Joseph

4 3

New slogan
by Ryan Thompson 20 Jul '04

20 Jul '04

Save a parse tree. Get SURBL. ;-) - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

2 1

Heads up, Bill out next week
by William Stearns 20 Jul '04

20 Jul '04

Good day, all, I'll be away teaching Perimeter Security all next week (Sun 7/25 - Sun 8/1, possibly another day). If you have any requests for spamgate or my end of ws.surbl.org, please let me know beforehand. I'll do my best to check in evenings for email and IM. Cheers, - Bill --------------------------------------------------------------------------- "After 3 weeks of intense cryptanalysis, the Naval codebreakers were still baffled by the messages. They called the Navajo language a 'wierd succession of gutteral, nasal, tongue-twisting sounds... we couldn't even transcribe it, much less crack it.'" - The Code Book, Simon Singh. -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

1 0

RE: 6dos data into ds.surbl.org
by Chris Santerre 20 Jul '04

20 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Sunday, July 18, 2004 5:07 PM >To: SURBL Discuss; SpamAssassin Users >Subject: 6dos data into ds.surbl.org > > >Chris Santerre asked on the spamassassin-users list whether >ds.surbl.org was being updated with the 6dos data. The answer is >no, it's static now based on that snapshot Chris gave me a couple >weeks ago. To be honest, the 6dos data seems too over-inclusive >to me for production use, but perhaps Chris or Rich could help me >figure out something closer to a live feed as we beta test it. > >Jeff C. LOL, I don't remember half the stuff I ask :) Actually the initial data that was used wasn't even the freshest from the source. This data is used in a much different way and is quite large! Well beyond a simple list of domains. I'm actually thinking it should not be used. It does contain a vast amount of info. I'm hoping instead, that this data source could be used for SURBL research in the future. When and if we get a nicer interface to it. So my official recomendation is for ds.surbl.org to go away. --Chris

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss