Discuss

discuss@lists.surbl.org

1876 discussions

Powerdns: high performance dns recursor
by Yusuf Goolamabbas 29 Sep '06

29 Sep '06

I haven't put this through its paces yet. The recursor can forward zones to a nameserver (I still prefer dnscache's syntax) so this can be used as a caching nameserver in front of rbldnsd http://doc.powerdns.com/built-in-recursor.html http://wiki.powerdns.com/projects/trac/ The author of PowerDNS Bert Hubert is well-known in Linux circles for his work in explaining the esoteric commands of iproute via LARTC (Linux Advanced Routing and Traffic Control) http://lartc.org/ Hope this helps, Regards, Yusuf -- Yusuf Goolamabbas yusufg(a)outblaze.com

1 0

New User Needs Help
by Robert Temple 29 Sep '06

29 Sep '06

Hello; I wanted to replace Spamassassin on my server, so I've set up SURBL using instructions from a forum on my server companies site (here: http:/ /forums.ev1servers.net/showthread.php?t=57896) The installation seemed to go well, but I haven't noticed any reduction in spam, and when I SSL into the server and grep "Message contains blacklisted domain" /var/log/exim_mainlog I don't see any entries. Is there a way to check to see if SURBL is working? Thanks for any suggestions. - Robert

2 1

Re: [SPAM-TAG] [SURBL-Discuss] Lots of new questionable URL, redirectors
by opencomputing＠gmail.com 28 Sep '06

28 Sep '06

>Some of these may be minor redirection sites being abused. > >One operator of such a site contacted us bemoaning the abuse and >also contemplating shutting it down due to it. > > If only these URL redirectors checked the target URL in URIBL/SURBL the first time it gets submitted and also during the runtime, every time it gets accessed, it should reduce the problem immensely. I guess plain laziness to combat spam ain't going to work ;) cheers, skar. -- OpenProtect - The email virus/spam filter http://openprotect.com

2 5

Re: [SURBL-Discuss] Lots of new questionable URL redirectors
by List Mail User 28 Sep '06

28 Sep '06

>... >Good evening, all, > I'm seeing a _lot_ of URL redirection sites I've never seen >before: > >shorten.in, registered Aug 20, 2006 (http://shorten.in/194 -> prosperityautomatedsystem.com) >simurl.com (http://simurl.com/ss-nn-uu -> julesent4.info -> prosperityautomatedsystem.com) >qdeo.com (http://qdeo.com/53 -> julesent4.info -> prosperityautomatedsystem.com) >kuturl.com (http://kuturl.com/x.php?za -> 404) > > This last one now shows: > >Because of the actions of a SPAMMER - we have withdrawn this service. >So, apologies to all of you who genuinely used our free service. >You can blame the scum who ruined it for everyone else. >We try hard to help others, while some are determined to prove themselves as lower than amoeba crap. > > Many of the URLs redirect to www.prosperityautomatedsystem.com. > > Try submitting a URL to these; you'll see the number returned is >very low, indicating these are either fake redirectors or rarely used. > > Thoughts? Opinions? Strawberry-banana smoothies? ;-) > Cheers, > - Bill > >--------------------------------------------------------------------------- >I are sigfile disease!! >All your quote are belong to us. >Copy us every "sig"! >(Courtesy of Charlie Stross, on an lwn.net letter) >-------------------------------------------------------------------------- >William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, >rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org >... Well, at least part of the path is well known and recognizable: See Spamhaus' ROK3985, ROK4460, ROK4682, ROK6181, ROK6713 and ROK6937 for the address in shdns.info) Paul Shupak track(a)plectere.com ... ;; ANSWER SECTION: julesent4.info. 86400 IN NS ns2.shdns.info. julesent4.info. 86400 IN NS ns1.shdns.info. ;; ADDITIONAL SECTION: ns2.shdns.info. 86400 IN A 211.144.69.237 ns1.shdns.info. 86400 IN A 220.164.140.232 ;; Query time: 20 msec ;; SERVER: 199.7.66.33#53(199.7.66.33) ;; WHEN: Wed Sep 27 03:36:13 2006 ;; MSG SIZE rcvd: 106 % jwhois shdns.info [Querying whois.afilias.info] [whois.afilias.info] Access to INFO WHOIS information is provided to assist persons in determining the contents of a domain name registration record in the Afilias registry database. The data in this record is provided by Afilias Limited for informational purposes only, and Afilias does not guarantee its accuracy. This service is intended only for query-based access. You agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to: (a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient's own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of Registry Operator, a Registrar, or Afilias except as reasonably necessary to register domain names or modify existing registrations. All rights reserved. Afilias reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy. Domain ID:D13029584-LRMS Domain Name:SHDNS.INFO Created On:10-Apr-2006 19:59:26 UTC Last Updated On:09-Jun-2006 21:01:15 UTC Expiration Date:10-Apr-2007 19:59:26 UTC Sponsoring Registrar:eNom, Inc. (R126-LRMS) Status:OK Registrant ID:9902F5AE7419E685 Registrant Name:bill lai Registrant Organization:newtech co. Registrant Street1:211 yangzi road Registrant Street2:211 yangzi road widf Registrant Street3: Registrant City:widf Registrant State/Province:SD Registrant Postal Code:23423424 Registrant Country:US Registrant Phone:+91.343282334 Registrant Phone Ext.: Registrant FAX: Registrant FAX Ext.: Registrant Email:daniel@sv-luka.org Admin ID:9902F5AE7419E685 Admin Name:bill lai Admin Organization:newtech co. Admin Street1:211 yangzi road Admin Street2:211 yangzi road widf Admin Street3: Admin City:widf Admin State/Province:SD Admin Postal Code:23423424 Admin Country:US Admin Phone:+91.343282334 Admin Phone Ext.: Admin FAX: Admin FAX Ext.: Admin Email:daniel@sv-luka.org Billing ID:9902F5AE7419E685 Billing Name:bill lai Billing Organization:newtech co. Billing Street1:211 yangzi road Billing Street2:211 yangzi road widf Billing Street3: Billing City:widf Billing State/Province:SD Billing Postal Code:23423424 Billing Country:US Billing Phone:+91.343282334 Billing Phone Ext.: Billing FAX: Billing FAX Ext.: Billing Email:daniel@sv-luka.org Tech ID:9902F5AE7419E685 Tech Name:bill lai Tech Organization:newtech co. Tech Street1:211 yangzi road Tech Street2:211 yangzi road widf Tech Street3: Tech City:widf Tech State/Province:SD Tech Postal Code:23423424 Tech Country:US Tech Phone:+91.343282334 Tech Phone Ext.: Tech FAX: Tech FAX Ext.: Tech Email:daniel@sv-luka.org Name Server:DNS1.NAME-SERVICES.COM Name Server:DNS2.NAME-SERVICES.COM Name Server:DNS3.NAME-SERVICES.COM Name Server:DNS4.NAME-SERVICES.COM Name Server:DNS5.NAME-SERVICES.COM Name Server: Name Server: Name Server: Name Server: Name Server: Name Server: Name Server: Name Server:

2 1

Lots of new questionable URL redirectors
by William Stearns 27 Sep '06

27 Sep '06

Good evening, all, I'm seeing a _lot_ of URL redirection sites I've never seen before: shorten.in, registered Aug 20, 2006 (http://shorten.in/194 -> prosperityautomatedsystem.com) simurl.com (http://simurl.com/ss-nn-uu -> julesent4.info -> prosperityautomatedsystem.com) qdeo.com (http://qdeo.com/53 -> julesent4.info -> prosperityautomatedsystem.com) kuturl.com (http://kuturl.com/x.php?za -> 404) This last one now shows: Because of the actions of a SPAMMER - we have withdrawn this service. So, apologies to all of you who genuinely used our free service. You can blame the scum who ruined it for everyone else. We try hard to help others, while some are determined to prove themselves as lower than amoeba crap. Many of the URLs redirect to www.prosperityautomatedsystem.com. Try submitting a URL to these; you'll see the number returned is very low, indicating these are either fake redirectors or rarely used. Thoughts? Opinions? Strawberry-banana smoothies? ;-) Cheers, - Bill --------------------------------------------------------------------------- I are sigfile disease!! All your quote are belong to us. Copy us every "sig"! (Courtesy of Charlie Stross, on an lwn.net letter) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

3 2

Re: Redirection URLs
by opencomputing＠gmail.com 24 Sep '06

24 Sep '06

>Date: Sun, 24 Sep 2006 02:07:25 -0400 >From: Eric Montr?al <erv(a)mailpeers.net> >Subject: Re: [SURBL-Discuss] Redirection URLs >To: SURBL Discussion list <discuss(a)lists.surbl.org> >Message-ID: <4516209D.6000500(a)mailpeers.net> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > >A year ago, when the Geocities problem was much bigger, I made a simple >analysis tool. > >I don't maintain it anymore, and data is partial, however, it shows that >the javascript >encoding used is nearly always very basic and easy to decode: > >http://nospam.mailpeers.net/alive_spammy2.txt > > Did you check every geocities et al link in your spam mails and add them to this list? You must've been angry to blast the spammers outta the earth!!! I just love that spirit. Thanks for the links. >Most of the listed sites appeared in spams long time ago and were not >removed by >Geocities. > >The original site http://nospam.mailpeers.net/ contains .cf rules, but >except for the generic >ones it's not useful anymore, mostly since Yahoo / Geocities finally >decided to do the right >thing and block the new spam sites and I don't actively search geocities >spamvertized links >anymore. > > Are the rules listed like subevil, alive_spammy(2), rip_spammy, alive_spammy_malware all kept updated? Even if not, I guess they shouldn't give FPs? cheers, skar. -- OpenProtect - The email virus/spam filter http://openprotect.com

1 0

Redirection URLs
by opencomputing＠gmail.com 24 Sep '06

24 Sep '06

Hi, I'm receiving lots of spam with URLs like the one below: http://geocities.com/wihim2968 The above URL in fact redirects a blacklisted domain j99k.com. Is there a plan to add the redirected original URL also to the blacklists? Or blacklist URL redirection services(at least in a different list like AG-aggressive) which don't check the target URL in blacklists? Or should I look up the real target of the URL and look it up too? But this would lead to latencies of around 10-20 seconds depending on a 3rd party web server like geocities in the above example :( cheers, skar. -- OpenProtect - The email virus/spam filter http://openprotect.com

3 2

RE: [SURBL-Discuss] Possible FP interweave...
by Chris Santerre 20 Sep '06

20 Sep '06

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Wednesday, September 20, 2006 11:27 AM > To: Chris Santerre > Cc: SURBL Discussion List (E-mail) > Subject: Re: [SURBL-Discuss] Possible FP interweave... > > > On Wednesday, September 20, 2006, 8:02:05 AM, Chris Santerre wrote: > > 2.0 URIBL_WS_SURBL Contains an URL listed in the > WS SURBL blocklist > > [URIs: interweave.com] > > 3.9 URIBL_SC_SURBL Contains an URL listed in the > SC SURBL blocklist > > [URIs: interweave.com] > > > *might* be an FP. We do business with them. I can't find > much in NANAS. And > > the IP 63.79.28.36 comes up clean. > > I'm not seeing it blacklisted. Is someone running an old version > of SpamAssassin with the DNS bug? SpamAssassin version 3.0.0 --Chris

2 1

Possible FP interweave...
by Chris Santerre 20 Sep '06

20 Sep '06

2.0 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: interweave.com] 3.9 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist [URIs: interweave.com] *might* be an FP. We do business with them. I can't find much in NANAS. And the IP 63.79.28.36 comes up clean. Thanks, Chris Santerre SysAdmin and Spamfighter www.rulesemporium.com www.uribl.com

2 1

[ob] FP?? worklifereward.com-M
by List Mail User 20 Sep '06

20 Sep '06

Hi, This looks like an FP - worklifereward.com-M is owned by Office Depot and is in several URLs in this week's email "flyer". Of course, they have also switched ESPs to postfuture.com-M (Yes, the same) and are mailing from an IP in multiple BLs (64.5.35.226 is currently listed at BLARS, FIVETEN, PSBL, SpamCop and on SPEWS Level 2; Both the PSBL and SpamCop have "reasonable" delisting requirements, so there is trouble). Paul Shupak track(a)plectere.com

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss