Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

OB: whitelist required for frappr.com
by jm＠jmason.org 18 Nov '05

18 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Also listed on URIBL-black, too. (I don't have an email contact addr for those guys, so I'm hoping they read SURBL discuss ;) 0.0 T_URIBL_BLACK Contains an URL listed in the URIBL blacklist [URIs: frappr.com] 2.6 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist [URIs: frappr.com] They're entirely hammy, so would be good candidates for general whitelisting. I don't want to attach a sample mail if poss though, for privacy reasons.... - --j. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) Comment: Exmh CVS iD8DBQFDfOUCMJF5cimLx9ARAsx0AKCs/rZUHjHz7pXVBDLZOk0svrsB6QCePT3F Yl/TXxG/oCw1rSzQ9ebAl9k= =sjrT -----END PGP SIGNATURE-----

5 4

Re: [SURBL-Discuss] RFC: Add hosts like tripod.com to two-level-tld list?
by List Mail User 18 Nov '05

18 Nov '05

>... JeffC of SURBL asked: >It has been suggested that we could deal with the tripod.com >subdomains by adding tripod.com to our two-level-tld list >or some equivalent file. Currently the two-level-tld list is >hard coded into applications to indicate that domains like co.uk >should be checked at the third level, like checkmehere.co.uk. >This is somewhat of a kludge, but it works. > >How does anyone feel about extending that to tripod.com and >potentially other hosts that provide subdomain hosting? > >If so, should it be done in the same two-level-tld file or >maybe a different, separate file? (Currently the two-level-tld >file is mostly geographic domains, i.e. cctlds plus the local >country registrar top level domains.) Or should it be done with >another, separate DNSBL, etc. Both approaches have advantages and >disadvantages. The file is much simpler to maintain for us, but >a bit kludgey. > The hard-coding into applications is just plain wrong for a few reasons; Any list *should* be updatable. Some RHS BLs already support arbitrary subdomains (example: biz.mail.mud.yahoo.com has many more problems than yahoo.com or most yahoo.com subdomains). For DSN, RCVD and other header rules, the "top" domain, (e.g. "ca.us") may not have, or even be required to have an abuse and/or postmaster account (just one possible type of example), but the subdomains either do have them or would trigger tests or rules for them (a domain with no 'A' or 'MX' records may not need to provide any mail services, though its subdomains should and do - your losangeles.ca.us vs. "ca.us" example). Also note that some MTAs (eg. Postfix) already check *all* of the subdomains in a hostname against RHS RBLs. One problem with this is the syntax for DNS "wildcards" transcends subdomain levels, so I believe the files/domains should be kept separate from the "true" two-level TLDs, because unfortunately a check for '*.domain.tld' should really be performed also (e.g. '*.domain.tld' in a DNS zone file will match 'l5.l4.l3.domain.tld' as well as the simple 'l3.domain.tld') and this leads to increased overhead for DNS based net tests (without the check, the containing domain cannot be determined by heuristics alone). One set of candidates that would also fall into this group include ESPs like cheetah/chtah (discussed a few months ago), where most all (or at least many) of the subdomains are well behaved, but some are definitely "mainsleaze-like" or just plain spammy (not meant to reflect on cheetah specifically here). Similarly, some poorly behaved companies are kind enough to segregate their marketing "spew" into a subdomain, allowing just that to be listed *and* tested for (think of more than just the SURBL lists - but anything SA or other apps may want to check). >Conceivably the file or RBL could be used for any arbitrary >number of levels, for example if subdomains like >spammerz.losangeles.ca.us (unlikely example, but you get the idea) >or something similar started appearing in spams. > The use of most geographic domains in the body of spam is still rare, but I know that you have seen examples of them used for both dropboxes and domain contacts (and some geographic domains, at least in the ".us" TLD have been suspended for just this cause - directly or indirectly). >If we make the change, we'd need to let the SURBL application >authors know to update their tld file, etc., and we'd also need >to update our data-side processing to allow subdomains to be >listed. > >Comments? > The data processing changes needed for applications are the hardest ones to get done. And the concept of keeping the two sets of domains both separate (because they have different though overlapping uses) and *outside* of application code (so that they may be updated without updating the applications themselves) are both appealing . >Jeff C. >-- >Don't harm innocent bystanders. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Paul Shupak track(a)plectere.com P.S. There was a citation, I believe on NANOG, a couple of weeks ago of another maintained list of multi-level TLDs for IANA listed registries - I'll try to dig it up and send it to you off-list (maybe you can compare it to the current SURBL list).

2 1

RFC: Add hosts like tripod.com to two-level-tld list?
by Jeff Chan 17 Nov '05

17 Nov '05

It has been suggested that we could deal with the tripod.com subdomains by adding tripod.com to our two-level-tld list or some equivalent file. Currently the two-level-tld list is hard coded into applications to indicate that domains like co.uk should be checked at the third level, like checkmehere.co.uk. This is somewhat of a kludge, but it works. How does anyone feel about extending that to tripod.com and potentially other hosts that provide subdomain hosting? If so, should it be done in the same two-level-tld file or maybe a different, separate file? (Currently the two-level-tld file is mostly geographic domains, i.e. cctlds plus the local country registrar top level domains.) Or should it be done with another, separate DNSBL, etc. Both approaches have advantages and disadvantages. The file is much simpler to maintain for us, but a bit kludgey. Conceivably the file or RBL could be used for any arbitrary number of levels, for example if subdomains like spammerz.losangeles.ca.us (unlikely example, but you get the idea) or something similar started appearing in spams. If we make the change, we'd need to let the SURBL application authors know to update their tld file, etc., and we'd also need to update our data-side processing to allow subdomains to be listed. Comments? Jeff C. -- Don't harm innocent bystanders.

3 2

sc2 issue (?)
by Frank Ellermann 14 Nov '05

14 Nov '05

Hi, I've manually "spamcopped" ten of these 60 minutes ago: Submitted: Sun Nov 13 00:26:03 2005 GMT : ***SPAM*** KXndigung - Mahnung 1554220718 ( http://www.wunsch-pen??.com ) To: gatekeeper(a)eastgate.net.my 1554220710 ( http://www.wunsch-pen??.com ) To: m_ghaza(a)tm.net.my (for "??" insert "is"). So far that doesn't show up in multi, is there a problem with SURBL's link to SC, or are 10 reports simply not enough ? Bye, Frank

2 2

SpamAssassin rules for Tripod
by Jeff Chan 11 Nov '05

11 Nov '05

Regarding the tripod spams, Raymond posted some SpamAssassin rules on the Users list there: body PROLO_LEO1 /85\,45|1\,21/ body PROLO_LEO2 /69\,95|3\,33/ body PROLO_LEO3 /99\,95|3\,75/ uri PROLO_LEO4 /http:\/\/.*\.tripod\.com/ meta PROLO_LEO_M1 (PROLO_LEO1 && PROLO_LEO2 && PROLO_LEO3 && PROLO_LEO4) score PROLO_LEO1 0.1 score PROLO_LEO2 0.1 score PROLO_LEO3 0.1 score PROLO_LEO4 0.1 score PROLO_LEO_M1 8 describe PROLO_LEO1 Meta Catches all Leo drug variations so far describe PROLO_LEO2 Meta Catches all Leo drug variations so far describe PROLO_LEO3 Meta Catches all Leo drug variations so far describe PROLO_LEO4 Meta to catch Leo now using Tripod describe PROLO_LEO_M1 Catches all Leo drug variations so far and he mentioned that the SARE rules would be updating to catch these also. Jeff C. -- Don't harm innocent bystanders.

1 0

Re: [SURBL-Discuss] Re: tripod dot com
by List Mail User 10 Nov '05

10 Nov '05

>... >On Tuesday, November 8, 2005, 11:55:36 AM, Dhawal Doshy wrote: >> Catherine Hampton writes: > >>>> Thanks Jeff, i'll continue doing the spamcop reporting. If only there >>>> was some way for mass submission (i have a list of 177 sub-domains if >>>> anyone is interested). >>> >>> <raising hand> >>> >>> Please email the list to updates(a)spambouncer.org and I'll list them >>> in the Spam Haven URLs list. Thanks! > >> http://mx2.netmagicians.com/tripod.txt, just mailed them to the support team >> at lycos.com as well who will remove the offending accounts. > >Please do report them to lycos. Getting the sites shut down is >arguably more important than blacklisting, IMO. > >Jeff C. >-- >Don't harm innocent bystanders. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Reporting the tripod sites to Lycos and shutting them is indeed more important than blacklisting the tripod sites - Agreed. But a quick extract of the HTML pages shows that the 179 tripod pages seem to only redirect to a total of 8 sites currently - those should get blacklisted. The current set is (not the same as the ones I saw earlier): Site Registrar Contact email -------------------------------------------------------------------------------- http://www.aneigpie.com-MUNG - NameBay caturedin(a)yahoo.com http://www.arecurel.com-MUNG - NameBay livoutsid(a)yahoo.com http://www.baniclu.com-MUNG - NameBay caturedin(a)yahoo.com http://www.cherdon.info-MUNG - Directi tospecie(a)yahoo.com http://www.cherit.info-MUNG - Directi tospecie(a)yahoo.com http://www.chersky.info-MUNG - Directi tospecie(a)yahoo.com http://www.offmantate.com-MUNG - YesNIC greatestemal(a)yahoo.com http://www.onlialowus.com-MUNG - YesNIC greatestemal(a)yahoo.com All currently have a 5 minute TTL and are at IP 211.233.16.84, which is listed at Spamhaus under SBL31414, a general dirty block at KIDC, though the example domains in the SBL include Kurayev's name servers registered by the ex-Joker (now Nicline) ROKSO domain reseller "Alex Blood"/"Ryan Kelly". All use the same name servers: ns0.areshooti.com-MUNG - YesNIC revisitinger(a)yahoo.com ns0.stomauset.com-MUNG - YesNIC omeceral(a)yahoo.com Of course the YesNIC name servers, have no name servers themselves. Paul Shupak track(a)plectere.com

5 4

Re: [SURBL-Discuss] Re: tripod dot com
by List Mail User 09 Nov '05

09 Nov '05

>... >On Tuesday, November 8, 2005, 10:08:46 PM, List User wrote: >> a quick >> extract of the HTML pages shows that the 179 tripod pages seem to only >> redirect to a total of 8 sites currently - those should get blacklisted. >> The current set is (not the same as the ones I saw earlier): > >> Site Registrar Contact email >> -------------------------------------------------------------------------------- >> http://www.aneigpie.com-MUNG - NameBay caturedin(a)yahoo.com >> http://www.arecurel.com-MUNG - NameBay livoutsid(a)yahoo.com >> http://www.baniclu.com-MUNG - NameBay caturedin(a)yahoo.com >> http://www.cherdon.info-MUNG - Directi tospecie(a)yahoo.com >> http://www.cherit.info-MUNG - Directi tospecie(a)yahoo.com >> http://www.chersky.info-MUNG - Directi tospecie(a)yahoo.com >> http://www.offmantate.com-MUNG - YesNIC greatestemal(a)yahoo.com >> http://www.onlialowus.com-MUNG - YesNIC greatestemal(a)yahoo.com > >> All currently have a 5 minute TTL and are at IP 211.233.16.84, which is >> listed at Spamhaus under SBL31414, a general dirty block at KIDC, though >> the example domains in the SBL include Kurayev's name servers registered >> by the ex-Joker (now Nicline) ROKSO domain reseller "Alex Blood"/"Ryan Kelly". > >Hi Paul, >Thanks I've blacklisted those, but TBH it may not help too much >since they don't seem to be appearing in spams themselves. > >Keep on getting those domains shut down. :-) > >Jeff C. >-- >Don't harm innocent bystanders. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > I didn't even notice, but the tripod subdomains got their own SBL yesterday - SBL34478 for dafhicksha.tripod.com-MUNG redirecting to arecurel.com-MUNG, but at a different IP, 222.122.72.120 (at KORNET instead of KIDC - same country, different spam haven). Chances are that the IPs 211.233.16.107 and 221.143.42.212 were either earlier sites, or soon to be used sites (there are 4 'A' records for the each of the name servers - with 5 minute TTLs its is hard to tell which direction things are moving, to or from, without staying on top on them and checking). Similar SBLs include SBL34456/SBL34454 for 211.233.16.78 and 211.233.16.107 respectively - though those show the domain conumese.com of SBL34454, which was spam'd directly (i.e. not tripod'd) and a batch of other directly spam'd domains at the same IP 211.233.16.107. There, at least the domain doubelev.com-MUNG was using ascii and multi-character HTML table formated spam: -------------------------------------------------------------------------------- [headers - snipped] Content-Transfer-Encoding: quoted-printable Ho overpayi or your Meddi isit our Pharm ress Sho wdy, Quit ng f cations - v aExp p. AmCIXaVALeVI bienALISnaxLIUMvitraAGRA 3.70 1.20 3.30 Want to know more? - http://hardselleex.doubelev.com-MUNG ------=_NextPart_000_004A_01C5E293.A074B480 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable [HMTL - snipped] -------------------------------------------------------------------------------- So there are many parallel drug spams hosted and advertising the same site(s) at once (my copy of the spam is from Sunday early morning). The one above is using the more common three-registrar system; Spam domain at Namebay, name server rosettarkin.com-MUNG at RGNames and nearly identical name server indivualre.com-MUNG at YesNIC (the name servers use the same contact data, except the email, at both registrars). Paul Shupak track(a)plectere.com

1 0

tripod dot com
by Dhawal Doshy 08 Nov '05

08 Nov '05

Hi, tripod dot com is now the new geo-cities, any plans to list it (yup, i know about the surbl no fps policy but no harm in asking)? i currently don't see it whitelisted (unless i'm wrong). We are getting quite a few spams from there. e.g. labedbreashi dot tripod dot com which redirects to filiaprom dot com thanks, - dhawal

5 11

Re: [SURBL-Discuss] tripod dot com
by List Mail User 08 Nov '05

08 Nov '05

>... >On Tuesday, November 8, 2005, 5:12:52 AM, List User wrote: >> So, Jeff, can the tripod.com domain just be treated as if it >> were a two-level TLD for SURBL? Another pair are ianampolkcho tripod.com >> and armonmafinneywilco tripod.com (Yes, they have been reported). > >For those keeping score, the systems are not currently set up to >work that way, both on the data side and probably also on the >application side. I'm not sure how smart we are to let the >spammers know this. :-( > >> BTW. He's also using the CNET redirector again (clearly CNET's >> policy of blacklisting instead of whitelisting doesn't work). > >Perhaps you mean whitelisting instead of blacklisting? > >Jeff C. >-- >Don't harm innocent bystanders. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Unfortunately I meant it the way I wrote it; CNET blacklists sites *after* complaints - They should whitelist sites that have paid or contracted with them instead of blacklisting sites people complain about. You assumed that they were acting rationally, which should be a good assumption, but isn't in this case. However I did mean to use redirectors (plural, not singular - they have many in their various domains). Paul Shupak track(a)plectere.com

2 1

Re: [SURBL-Discuss] tripod dot com
by List Mail User 08 Nov '05

08 Nov '05

These are the latest versions of Leo Kuvayev's pill spam which does still come from many XX.geocities domains (recent ones from de and sg). An interesting twist to the newest stuff - the spam domains are at bookmyname and Namebay, but the name servers are at RGNames and YesNIC; Of particular interest is the ones at YesNIC have no name servers, just hosts in the root cache (e.g. filiaprom dot com, uses stomauset dot com and areshooti dot com), and YesNIC's standard procedure for "suspending" a domain is to remove its name servers - so this technique allows the domains to continue to be used long after they have been suspended (look up the various Spamhaus listings for the CP name server set in the domain serverbackup64 dot com - which was "suspended" Sept. 29, but is still getting new SBL listing mentions - e.g. SBL34264). A similar trick is used for the RGNames domains, where he buys a domain package including DNS from them, but never allows the RGNames' servers (i.e. pf[12].rgpack.com) to receive or serve and data for the domains. The most common case seems to be the spamvertised domain at bookmyname or Namebay with two name servers, one each at RGNames and YesNIC, with identical contact data, except for different email addresses (i.e. same name for the registrant and contacts, partial address at YesNIC and full address at RGNames). The actual spam is the identical vertical pill stuff (not currently using HTML tables) and the various ED drug spams. So, Jeff, can the tripod.com domain just be treated as if it were a two-level TLD for SURBL? Another pair are ianampolkcho tripod.com and armonmafinneywilco tripod.com (Yes, they have been reported). BTW. He's also using the CNET redirector again (clearly CNET's policy of blacklisting instead of whitelisting doesn't work). Paul Shupak track(a)plectere.com

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss