Discuss

discuss@lists.surbl.org

1867 discussions

[ob] FP?? worklifereward.com-M
by List Mail User 20 Sep '06

20 Sep '06

Hi, This looks like an FP - worklifereward.com-M is owned by Office Depot and is in several URLs in this week's email "flyer". Of course, they have also switched ESPs to postfuture.com-M (Yes, the same) and are mailing from an IP in multiple BLs (64.5.35.226 is currently listed at BLARS, FIVETEN, PSBL, SpamCop and on SPEWS Level 2; Both the PSBL and SpamCop have "reasonable" delisting requirements, so there is trouble). Paul Shupak track(a)plectere.com

2 1

FP: minilien.com
by John Wilcock 15 Sep '06

15 Sep '06

Just spotted this one, on both black.uribl.com and ab.surbl.org - it's a very widely used French-language URL-shortening service. I'd say this is a definite FP. I can see people getting confused about whether minilien are really white hat, given that it now redirects to a page on the unfortunately-named digipills.com - but AFAICT this is also a genuine domain originally created by a medical student and offering free hosting for genuine medically-related content. John. -- -- Over 3000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr

4 10

Re: [SURBL-Discuss] hotlog.ru?
by List Mail User 14 Sep '06

14 Sep '06

I don't know about any "keystroke logger", but hit13.hotlog.ru-M and click.hotlog.ru-M are the pages used to count "hits" for send-safe.com - There is an open SBL for that alone. Definately "spam support" services. Paul Shupak track(a)plectere.com

1 0

RE: [SURBL-Discuss] FP: minilien.com
by Chris Santerre 14 Sep '06

14 Sep '06

I had delisted them until I saw this post. I like Christians train of thought. I know he has contacted them. Based on what they do, I'll either leave it listed or remove. --Chris > -----Original Message----- > From: Christian Stigen Larsen [mailto:csl@sublevel3.org] > Sent: Wednesday, September 13, 2006 9:32 AM > To: SURBL Discussion list > Cc: uribl-discuss(a)lists.maddoc.net > Subject: Re: [SURBL-Discuss] FP: minilien.com > > > > Den 13. sep. 2006 kl. 15.07 skrev John Wilcock: > > Just spotted this one, on both black.uribl.com and ab.surbl.org - > > it's a very widely used French-language URL-shortening service. > > > > I'd say this is a definite FP. > > But then again, if spam email uses minilien.com for > masquerading evil > redirects, then > it's the site owner's problem. There is an explicit coverage > on this > topic on the > SURBL.org site. > > Redirection services such as tinyurl.com and (my own) memurl.com > looks up if the > destination hosts are blocklisted, and so should minilien.com > > If we regard this one as a false positive, then it's free access for > spammail that > uses the minilien service. > > I suggest we notify the site owner and let him act accordingly. > > -- > Christian Stigen Larsen, http://csl.sublevel3.org > > > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss >

1 0

hotlog.ru?
by MRSCAPTGATOR＠aol.com 14 Sep '06

14 Sep '06

Hey Jeff, did you ever find out what that hotlog.ru was? I believe it may be like a worm were all keystrokes web pages ect. are logged. What do you think? I have reason to believe this! Cin [SURBL-Discuss] hotlog.ru? Jeff Chan _jeffc at surbl.org _ (mailto:discuss@lists.surbl.org?Subject=[SURBL-Discuss]%20hotlog.ru?&In-Reply-To=) Mon Aug 8 06:53:00 CEST 2005 * Previous message: _[SURBL-Discuss] Why you should check Phish IPs first :/ _ (http://lists.surbl.org/pipermail/discuss/2005-August/004973.html) * Next message: _[SURBL-Discuss] XS inclusion into multi _ (http://lists.surbl.org/pipermail/discuss/2005-August/004978.html) * Messages sorted by: _[ date ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/date.html#4977) _[ thread ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/thread.html#4977) _[ subject ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/subject.html#4977) _[ author ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/author.html#4977) ____________________________________ hotlog.ru and some subdomains appeared in the SURBL data yesterday, but the site is also ranked about 25k on Alexa so it seems to be a fairly popular site. A couple readers of Russian took a look at the site and determined it's some kind of web log analysis tool vendor, but could not easily say if it had legitimate uses. Is anyone here familiar with them? In particular might they have legitimate uses? It's been around since 2000: domain: HOTLOG.RU type: CORPORATE nserver: ank.ank.ru. nserver: ns.wplus.net. nserver: ns1.wplus.net. state: REGISTERED, DELEGATED person: ANDREW N KUZMIN phone: +7 812 5963532 fax-no: +7 812 5963532 e-mail: _ank at ank.ru_ (http://lists.surbl.org/mailman/listinfo/discuss) registrar: RUCENTER-REG-RIPN created: 2000.11.29 paid-till: 2005.11.30 source: TC-RIPN Jeff C. -- Don't harm innocent bystanders. ____________________________________ * Previous message: _[SURBL-Discuss] Why you should check Phish IPs first :/ _ (http://lists.surbl.org/pipermail/discuss/2005-August/004973.html) * Next message: _[SURBL-Discuss] XS inclusion into multi _ (http://lists.surbl.org/pipermail/discuss/2005-August/004978.html) * Messages sorted by: _[ date ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/date.html#4977) _[ thread ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/thread.html#4977) _[ subject ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/subject.html#4977) _[ author ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/author.html#4977) ____________________________________ _More information about the Discuss mailing list_ (http://lists.surbl.org/mailman/listinfo/discuss)

1 0

Re: [SURBL-Discuss] What to tell senders
by Jeff Chan 12 Sep '06

12 Sep '06

On Tuesday, September 12, 2006, 7:09:14 AM, Joseph Brennan wrote: > Regarding rejection, I realize I just popped up on this list without > intro. Columbia University's mail system refuses about 1 million > messages a day based on Spamhaus, NJABL, DNSBL, high Spamassassin > score, and rules written in Mimedefang. SURBL looks like a good > addition to our arsenal. Sounds reasonable. :-) > Logging in test yesterday and overnight suggests that SURBL will > catch 50,000 messages a day that are not already caught before > Spamassassin (which we run last). That's very worthwhile. Great! Sounds like it should help. BTW an excellent way for everyone to help the SURBL project is to send us actual FPs at our "whitelist at" address. It's ok to mention a domain you don't own, if we know you. Full info is not needed, but some general context such as opt-in status, reasons the domain is legitimate, etc., are very helpful and should be included if possible. Hopefully the FPs will be few and far between. Cheers, Jeff C. -- Don't harm innocent bystanders.

1 0

What to tell senders
by Joseph Brennan 12 Sep '06

12 Sep '06

When we reject a message because it contains a URI that is in SURBL, should our 550 message refer the sender to www.surbl.org? The surbl web pages seem to be addressed to mail system administrators rather than general email users. I'm asking partly so that we don't raise the support load on the surbl folks when we start rejecting. Of course there should be near zero instances of ordinary people ever seeing the reject message, making this a moot question. Is any other system directing senders to www.surbl.org? Joseph Brennan Columbia University Information Technology

3 3

Re: [SURBL-Discuss] What to tell senders
by Rob McEwen (PowerView Systems) 11 Sep '06

11 Sep '06

Joseph Brennan asked: > When we reject a message because it contains a URI that is in SURBL, > should our 550 message refer the sender to www.surbl.org? The surbl Joseph: I can't speak officially for SURBL, but I'd suggest stating something like the following in the SMTP return text: "blocked by XXX due to containing a URI listed at www.surbl.org" where "XXX" = your organization or your spam filter. The idea is that we WANT legit senders to give SURBL immediate feedback if/when SURBL makes a mistake (which is very rare). However, SURBL never blocks any mail and we don't want to give users the mistaken impression that SURBL blocked their message. Instead, it is the spam filter provider or mail hosting provider's decision to use SURBL and SURBL's lists comes without warranty or any type of guarantees (even those most deem SURBL to be very accurate and to have extremely few FPs). BTW - just a side suggestion... I find that the best spam filters employ a variety of spam-catching techniques and strive to NOT score any one particular tactic high enough to single-handedly block a message. Of course, we strive to make SURBL so reliable that most would consider it safe to block a message soley based on SURBL "hit"... but, if applied correctly, following this suggestion will provide the best case scenario in BOTH reducing FPs and boosting spam filtering percentages. Rob McEwen PowerView Systems rob(a)PowerViewSystems.com

1 0

RE: Inetesting new URI ploy
by Chris Santerre 11 Sep '06

11 Sep '06

> -----Original Message----- > From: Bill Landry [mailto:billl@pointshare.com] > Sent: Monday, September 11, 2006 2:55 PM > To: users(a)spamassassin.apache.org; discuss(a)lists.surbl.org > Subject: Inetesting new URI ploy > > > Just came across one of these in a spam message: > > bang Locals @ www.nowdatenow. com oopsy no space before com > > Oh what will they try next...? They will take a page from google... Please figure this out and type in your browser for sup3r l33t drgzzzz! http://haacked.com/images/googlebillboard.jpg --Chris

1 0

Inetesting new URI ploy
by Bill Landry 11 Sep '06

11 Sep '06

Just came across one of these in a spam message: bang Locals @ www.nowdatenow. com oopsy no space before com Oh what will they try next...? Bill

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss