Discuss

discuss@lists.surbl.org

1862 discussions

Google toolbar's whitelist
by jm＠jmason.org 10 Oct '06

10 Oct '06

I'm sure someone will find this useful: http://sb.google.com/safebrowsing/update?version=goog-white-domain:1:-1 found via http://blog.outer-court.com/forum/67024.html , --j.

1 0

Re: [SURBL-Discuss] Logo competition
by Jeff Chan 04 Oct '06

04 Oct '06

On Thursday, August 17, 2006, 9:12:51 PM, Steve Sobol wrote: > Jeff Chan wrote: >>> http://stevesobol.com/content/surbllogo.jpg >> >>> This is just a preliminary, I-did-this-in-five-minutes concept. >> >> It's good. (Red circle and slash = "no" and url://) >> >> Can you make one with spam:// ? > Absolutely not, but see > http://stevesobol.com/content/surbllogo2.jpg > (Ok, I was just kidding, of course I can do it!) > If that looks OK to you, I'll take that concept and come up > with a final product. Hi Steve, Looks great; thanks much! If I could request a modification, it would be for bolder type and thicker lines if possible. Also I'd probably make the text black, as in blackhat. Cheers, Jeff C. -- Don't harm innocent bystanders.

2 1

Yahoo redirector?
by Joseph Brennan 03 Oct '06

03 Oct '06

What's going on here? Numerous examples of porn spam sent Sunday have all different hostnames that resolve to the same few IP addresses, apparently by round robin: $ host takinoivanober.com takinoivanober.com has address 68.142.212.127 takinoivanober.com has address 68.142.212.128 takinoivanober.com has address 68.142.212.129 takinoivanober.com has address 68.142.212.130 takinoivanober.com has address 68.142.212.135 takinoivanober.com has address 68.142.212.126 $ host zascehjukalsderr.com zascehjukalsderr.com has address 68.142.212.130 zascehjukalsderr.com has address 68.142.212.135 zascehjukalsderr.com has address 68.142.212.126 zascehjukalsderr.com has address 68.142.212.127 zascehjukalsderr.com has address 68.142.212.128 zascehjukalsderr.com has address 68.142.212.129 $ host sex368yzx.com sex368yzx.com has address 68.142.212.129 sex368yzx.com has address 68.142.212.130 sex368yzx.com has address 68.142.212.135 sex368yzx.com has address 68.142.212.136 sex368yzx.com has address 68.142.212.137 sex368yzx.com has address 68.142.212.128 Reverse DNS resolves to Yahoo, only: $ host 68.142.212.130 130.212.142.68.in-addr.arpa domain name pointer p10w14.geo.mud.yahoo.com. $ host 68.142.212.127 127.212.142.68.in-addr.arpa domain name pointer p10w11.geo.mud.yahoo.com. $ host 68.142.212.128 128.212.142.68.in-addr.arpa domain name pointer p10w12.geo.mud.yahoo.com. The range 68.142.192 through 68.142.255 is all Inktomi, contact address network-abuse(a)cc.yahoo-inc.com, so it really is Yahoo. The interesting bit is that connecting by IP address or yahoo hostname gets a "Error 400 - Bad Request", but connecting by the spammer hostname gets a web page. I'd be especially interested in a generalized way of catching this. Joseph Brennan Columbia University Information Technology

4 5

Re: [SURBL-Discuss] Exim / SURBL
by Robert Temple 30 Sep '06

30 Sep '06

> > On 29/09/06, Jeff Chan <jeffc(a)surbl.org> wrote: > > On Friday, September 29, 2006, 8:18:33 AM, Peter Bowyer wrote: > > > On 29/09/06, Robert Temple <rtscruiser(a)gmail.com> wrote: > > >> Sorry for the newbie quesiton. I did more research on the SURBL site > and > > >> found out you can't use it as a stand alone app. Re-enabled > Spamassassin :( > > >> and now it is working perfectly. > > > > > Robert > > > > > I believe you mentioned you were using Exim - there is a method of > > > directly integrating URIBL/SURBL - which is (actively) maintained by > > > Erik Mugele. > > > > > http://www.teuton.org/~ejm/exim_surbl/ > > > > > Peter > > > > Hi Peter, > > The site Robert mentioned: > > > > http://forums.ev1servers.net/showthread.php?t=57896 > > > > is about using Erik Mugele's perl program (with Exim?) in the ev1 > > Ah, sorry - came in part-way through. Erik's method is a very > effective way of integration with Exim, I hope Robert might give it > another try. The exim-users list will support him if he needs it. > > Peter > > -- > Peter Bowyer > Email: peter(a)bowyer.org So it IS possible to use SURBL without Spamassassin? That would be awesome. I'll check out the exim site for their users discussion list. Thanks!

1 0

Re: [SURBL-Discuss] Exim / SURBL (Was: Re: Discuss Digest, Vol 30, Issue 12)
by Peter Bowyer 29 Sep '06

29 Sep '06

On 29/09/06, Robert Temple <rtscruiser(a)gmail.com> wrote: > Sorry for the newbie quesiton. I did more research on the SURBL site and > found out you can't use it as a stand alone app. Re-enabled Spamassassin :( > and now it is working perfectly. Robert I believe you mentioned you were using Exim - there is a method of directly integrating URIBL/SURBL - which is (actively) maintained by Erik Mugele. http://www.teuton.org/~ejm/exim_surbl/ Peter -- Peter Bowyer Email: peter(a)bowyer.org

2 2

Re: Discuss Digest, Vol 30, Issue 12
by Robert Temple 29 Sep '06

29 Sep '06

Sorry for the newbie quesiton. I did more research on the SURBL site and found out you can't use it as a stand alone app. Re-enabled Spamassassin :( and now it is working perfectly. > > > Hello; > > > > I wanted to replace Spamassassin on my server, so I've set up SURBL > using > > instructions from a forum on my server companies site (here: http:/ > > /forums.ev1servers.net/showthread.php?t=57896) > > > > The installation seemed to go well, but I haven't noticed any reduction > in > > spam, and when I SSL into the server and > > > > grep "Message contains blacklisted domain" /var/log/exim_mainlog > > > > I don't see any entries. > > > > Is there a way to check to see if SURBL is working? > > > > What's in your exim config? > > >

1 0

Powerdns: high performance dns recursor
by Yusuf Goolamabbas 29 Sep '06

29 Sep '06

I haven't put this through its paces yet. The recursor can forward zones to a nameserver (I still prefer dnscache's syntax) so this can be used as a caching nameserver in front of rbldnsd http://doc.powerdns.com/built-in-recursor.html http://wiki.powerdns.com/projects/trac/ The author of PowerDNS Bert Hubert is well-known in Linux circles for his work in explaining the esoteric commands of iproute via LARTC (Linux Advanced Routing and Traffic Control) http://lartc.org/ Hope this helps, Regards, Yusuf -- Yusuf Goolamabbas yusufg(a)outblaze.com

1 0

New User Needs Help
by Robert Temple 29 Sep '06

29 Sep '06

Hello; I wanted to replace Spamassassin on my server, so I've set up SURBL using instructions from a forum on my server companies site (here: http:/ /forums.ev1servers.net/showthread.php?t=57896) The installation seemed to go well, but I haven't noticed any reduction in spam, and when I SSL into the server and grep "Message contains blacklisted domain" /var/log/exim_mainlog I don't see any entries. Is there a way to check to see if SURBL is working? Thanks for any suggestions. - Robert

2 1

Re: [SPAM-TAG] [SURBL-Discuss] Lots of new questionable URL, redirectors
by opencomputing＠gmail.com 28 Sep '06

28 Sep '06

>Some of these may be minor redirection sites being abused. > >One operator of such a site contacted us bemoaning the abuse and >also contemplating shutting it down due to it. > > If only these URL redirectors checked the target URL in URIBL/SURBL the first time it gets submitted and also during the runtime, every time it gets accessed, it should reduce the problem immensely. I guess plain laziness to combat spam ain't going to work ;) cheers, skar. -- OpenProtect - The email virus/spam filter http://openprotect.com

2 5

Re: [SURBL-Discuss] Lots of new questionable URL redirectors
by List Mail User 28 Sep '06

28 Sep '06

>... >Good evening, all, > I'm seeing a _lot_ of URL redirection sites I've never seen >before: > >shorten.in, registered Aug 20, 2006 (http://shorten.in/194 -> prosperityautomatedsystem.com) >simurl.com (http://simurl.com/ss-nn-uu -> julesent4.info -> prosperityautomatedsystem.com) >qdeo.com (http://qdeo.com/53 -> julesent4.info -> prosperityautomatedsystem.com) >kuturl.com (http://kuturl.com/x.php?za -> 404) > > This last one now shows: > >Because of the actions of a SPAMMER - we have withdrawn this service. >So, apologies to all of you who genuinely used our free service. >You can blame the scum who ruined it for everyone else. >We try hard to help others, while some are determined to prove themselves as lower than amoeba crap. > > Many of the URLs redirect to www.prosperityautomatedsystem.com. > > Try submitting a URL to these; you'll see the number returned is >very low, indicating these are either fake redirectors or rarely used. > > Thoughts? Opinions? Strawberry-banana smoothies? ;-) > Cheers, > - Bill > >--------------------------------------------------------------------------- >I are sigfile disease!! >All your quote are belong to us. >Copy us every "sig"! >(Courtesy of Charlie Stross, on an lwn.net letter) >-------------------------------------------------------------------------- >William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, >rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org >... Well, at least part of the path is well known and recognizable: See Spamhaus' ROK3985, ROK4460, ROK4682, ROK6181, ROK6713 and ROK6937 for the address in shdns.info) Paul Shupak track(a)plectere.com ... ;; ANSWER SECTION: julesent4.info. 86400 IN NS ns2.shdns.info. julesent4.info. 86400 IN NS ns1.shdns.info. ;; ADDITIONAL SECTION: ns2.shdns.info. 86400 IN A 211.144.69.237 ns1.shdns.info. 86400 IN A 220.164.140.232 ;; Query time: 20 msec ;; SERVER: 199.7.66.33#53(199.7.66.33) ;; WHEN: Wed Sep 27 03:36:13 2006 ;; MSG SIZE rcvd: 106 % jwhois shdns.info [Querying whois.afilias.info] [whois.afilias.info] Access to INFO WHOIS information is provided to assist persons in determining the contents of a domain name registration record in the Afilias registry database. The data in this record is provided by Afilias Limited for informational purposes only, and Afilias does not guarantee its accuracy. This service is intended only for query-based access. You agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to: (a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient's own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of Registry Operator, a Registrar, or Afilias except as reasonably necessary to register domain names or modify existing registrations. All rights reserved. Afilias reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy. Domain ID:D13029584-LRMS Domain Name:SHDNS.INFO Created On:10-Apr-2006 19:59:26 UTC Last Updated On:09-Jun-2006 21:01:15 UTC Expiration Date:10-Apr-2007 19:59:26 UTC Sponsoring Registrar:eNom, Inc. (R126-LRMS) Status:OK Registrant ID:9902F5AE7419E685 Registrant Name:bill lai Registrant Organization:newtech co. Registrant Street1:211 yangzi road Registrant Street2:211 yangzi road widf Registrant Street3: Registrant City:widf Registrant State/Province:SD Registrant Postal Code:23423424 Registrant Country:US Registrant Phone:+91.343282334 Registrant Phone Ext.: Registrant FAX: Registrant FAX Ext.: Registrant Email:daniel@sv-luka.org Admin ID:9902F5AE7419E685 Admin Name:bill lai Admin Organization:newtech co. Admin Street1:211 yangzi road Admin Street2:211 yangzi road widf Admin Street3: Admin City:widf Admin State/Province:SD Admin Postal Code:23423424 Admin Country:US Admin Phone:+91.343282334 Admin Phone Ext.: Admin FAX: Admin FAX Ext.: Admin Email:daniel@sv-luka.org Billing ID:9902F5AE7419E685 Billing Name:bill lai Billing Organization:newtech co. Billing Street1:211 yangzi road Billing Street2:211 yangzi road widf Billing Street3: Billing City:widf Billing State/Province:SD Billing Postal Code:23423424 Billing Country:US Billing Phone:+91.343282334 Billing Phone Ext.: Billing FAX: Billing FAX Ext.: Billing Email:daniel@sv-luka.org Tech ID:9902F5AE7419E685 Tech Name:bill lai Tech Organization:newtech co. Tech Street1:211 yangzi road Tech Street2:211 yangzi road widf Tech Street3: Tech City:widf Tech State/Province:SD Tech Postal Code:23423424 Tech Country:US Tech Phone:+91.343282334 Tech Phone Ext.: Tech FAX: Tech FAX Ext.: Tech Email:daniel@sv-luka.org Name Server:DNS1.NAME-SERVICES.COM Name Server:DNS2.NAME-SERVICES.COM Name Server:DNS3.NAME-SERVICES.COM Name Server:DNS4.NAME-SERVICES.COM Name Server:DNS5.NAME-SERVICES.COM Name Server: Name Server: Name Server: Name Server: Name Server: Name Server: Name Server: Name Server:

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss