Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

tripod dot com
by Dhawal Doshy 08 Nov '05

08 Nov '05

Hi, tripod dot com is now the new geo-cities, any plans to list it (yup, i know about the surbl no fps policy but no harm in asking)? i currently don't see it whitelisted (unless i'm wrong). We are getting quite a few spams from there. e.g. labedbreashi dot tripod dot com which redirects to filiaprom dot com thanks, - dhawal

5 11

Re: [SURBL-Discuss] tripod dot com
by List Mail User 08 Nov '05

08 Nov '05

>... >On Tuesday, November 8, 2005, 5:12:52 AM, List User wrote: >> So, Jeff, can the tripod.com domain just be treated as if it >> were a two-level TLD for SURBL? Another pair are ianampolkcho tripod.com >> and armonmafinneywilco tripod.com (Yes, they have been reported). > >For those keeping score, the systems are not currently set up to >work that way, both on the data side and probably also on the >application side. I'm not sure how smart we are to let the >spammers know this. :-( > >> BTW. He's also using the CNET redirector again (clearly CNET's >> policy of blacklisting instead of whitelisting doesn't work). > >Perhaps you mean whitelisting instead of blacklisting? > >Jeff C. >-- >Don't harm innocent bystanders. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Unfortunately I meant it the way I wrote it; CNET blacklists sites *after* complaints - They should whitelist sites that have paid or contracted with them instead of blacklisting sites people complain about. You assumed that they were acting rationally, which should be a good assumption, but isn't in this case. However I did mean to use redirectors (plural, not singular - they have many in their various domains). Paul Shupak track(a)plectere.com

2 1

Re: [SURBL-Discuss] tripod dot com
by List Mail User 08 Nov '05

08 Nov '05

These are the latest versions of Leo Kuvayev's pill spam which does still come from many XX.geocities domains (recent ones from de and sg). An interesting twist to the newest stuff - the spam domains are at bookmyname and Namebay, but the name servers are at RGNames and YesNIC; Of particular interest is the ones at YesNIC have no name servers, just hosts in the root cache (e.g. filiaprom dot com, uses stomauset dot com and areshooti dot com), and YesNIC's standard procedure for "suspending" a domain is to remove its name servers - so this technique allows the domains to continue to be used long after they have been suspended (look up the various Spamhaus listings for the CP name server set in the domain serverbackup64 dot com - which was "suspended" Sept. 29, but is still getting new SBL listing mentions - e.g. SBL34264). A similar trick is used for the RGNames domains, where he buys a domain package including DNS from them, but never allows the RGNames' servers (i.e. pf[12].rgpack.com) to receive or serve and data for the domains. The most common case seems to be the spamvertised domain at bookmyname or Namebay with two name servers, one each at RGNames and YesNIC, with identical contact data, except for different email addresses (i.e. same name for the registrant and contacts, partial address at YesNIC and full address at RGNames). The actual spam is the identical vertical pill stuff (not currently using HTML tables) and the various ED drug spams. So, Jeff, can the tripod.com domain just be treated as if it were a two-level TLD for SURBL? Another pair are ianampolkcho tripod.com and armonmafinneywilco tripod.com (Yes, they have been reported). BTW. He's also using the CNET redirector again (clearly CNET's policy of blacklisting instead of whitelisting doesn't work). Paul Shupak track(a)plectere.com

2 1

Please remove SC2 rules or references
by Jeff Chan 04 Nov '05

04 Nov '05

Anyone using custom rules for sc2.surbl.org, please take them out now, since sc.surbl.org is using that data. Jeff C. -- Don't harm innocent bystanders.

1 0

okay to talk about sorbs here?
by George Georgalis 02 Nov '05

02 Nov '05

Before I started using spam.dnsbl.sorbs.net I tested a corpus of spam and ham and determined the best way to implement. But in the past 48 hours, mail relays from road runner, and cablevision have been added. http://www.us.sorbs.net/using.shtml spam.dnsbl.sorbs.net - List of hosts that have been noted as sending spam/UCE/UBE to the admins of SORBS. This zone also contains netblocks of spam supporting service providers, including those who provide websites, DNS or drop boxes for a spammer. Spam supporters are added on a 'third strike and you are out' basis, where the third spam will cause the supporter to be added to the list. While I appreciate sending the message to lame ISPs about controlling their users, adding these relays to the blacklist causes a lot of false positives. Has sorbs been reasonable in their judgment to add them, how often does it take 30 million (or whatever) random subscribers to produce 3 spams, and what is reasonable for an ISP to do about it? I have filled out their (sorbs) complex web support forms before, on behalf of a 3rd party, and never got a response. Now, since I'm complaining about relays being added that aren't mine, I cannot even get through the questions to a dialog I can enter my observation (when I properly answer the questions). Unfortunately for me this is 2 strikes and you're out, sorbs. Is there a good alternative for spam.dnsbl.sorbs.net? // George -- George Georgalis, systems architect, administrator <IXOYE>< http://galis.org/ cell:646-331-2027 mailto:george@galis.org

4 6

Re: RFC: multi.surbl.org testpoint A record value
by Frank Ellermann 02 Nov '05

02 Nov '05

Jeff Chan wrote: > Does anyone have any comments or preferences for either > style? Why set bit 7 if there is no 7th set at the moment ? It would be nice in my test output. OTOH I added support for bits 8..15 a year ago because that's what you wanted, and for that you could also use 127.0.255.126. === test output today (truncated) === 127.0.0.2 (------1-): .ix.dnsbl.manitu.net 127.0.0.2 (------10): .combined.njabl.org 127.0.0.2 (---43210): .opm.blitzed.org 127.0.0.2 (------1-): .multi.surbl.org 127.0.0.2 (-----21-): .sbl-xbl.spamhaus.org === demo output for 127.0.0.126 === 127.0.0.2 (------1-): .ix.dnsbl.manitu.net 127.0.0.2 (------10): .combined.njabl.org 127.0.0.2 (---43210): .opm.blitzed.org 127.0.0.2 (7654321-): .multi.surbl.org 127.0.0.2 (-----21-): .sbl-xbl.spamhaus.org === demo output for 127.0.255.126 === 127.0.0.2 (------1-): .ix.dnsbl.manitu.net 127.0.0.2 (------10): .combined.njabl.org 127.0.0.2 (---43210): .opm.blitzed.org 127.0.0.2 (FEDBCA987654321-): .multi.surbl.org 127.0.0.2 (-----21-): .sbl-xbl.spamhaus.org These "aesthetical considerations" are just for fun, if there are no more serious arguments at all. Bye

2 2

RFC: multi.surbl.org testpoint A record value
by Jeff Chan 02 Nov '05

02 Nov '05

Previously, each SURBL zone file, including the bitmask combined list multi.surbl.org, had testpoitns with A records resolving to 127.0.0.2. That was a design decision, and it was also convenient to the way the zone files were generated before. But Justin Mason or one of the other SpamAssassin developers argued that multi should have testpoints corresponding to all ones in each bitmask position. So one of the changes with the new SURBL engine now running is that the multi testpionts do have all the bits set for an A record value of 127.0.0.126 instead of 127.0.0.2 . This may work better with applications that decode the bits properly into individual list results, but it is a change from before and it may break other applications' use of the testpoints. Does anyone have any comments or preferences for either style? Jeff C. -- Don't harm innocent bystanders.

1 0

New engine, sc2 ready
by Jeff Chan 29 Oct '05

29 Oct '05

After everyone's help testing the revised SC2 data and my writing some code, the new SURBL engine and SC2 data are ready to roll out. SC2 will become the production SC SpamCop-based list. It will catch significantly more spam than the older version. New new engine also features a faster cycle time, more uniform handling of all the data, etc. Unless there are objections, I think I'll probably just start rolling it out and announcing the change when it's done. The process should be seamless and invisible to end users and DNS admins, aside from a higher SC detection rate and some minor improvements elsewhere. Questions? Comments? Jeff C. -- Don't harm innocent bystanders.

1 0

domain "domain" blacklisted
by Jose Marcio Martins da Cruz 28 Oct '05

28 Oct '05

Hi, The domain "domain" 8-) is listed at jp and generated a false positive (at one of our users). Can you whitelist it please ? domain :127.0.0.64:Blocked, domain on lists [jp], See: http://www.surbl.org/lists.html Regards, Jose-Marcio -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

2 2

uk DOT geocities DOT com
by Frank Ellermann 13 Oct '05

13 Oct '05

Hi, please remove uk. geocities .com from all white lists and/or add it manually to local URIBLs, it's a black hat. Bye, Frank <news://news.spamcop.net/43456728.12D5@xyzzy.claranet.de>

10 32

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss