Discuss

discuss@lists.surbl.org

1862 discussions

Geocities
by Darrell (support＠invariantsystems.com) 13 Aug '05

13 Aug '05

I want to check on this before I add geocities as an exception (i.e. do not check against SURBL) - Is geocities one of the domains that would never end up on SURBL. I was doing an analysis this week against domains that always returned clean and number of times - and geocities was listed as #1. Darrell

5 4

Lookup of (phishing) URLs with an IP
by Dirk Bonengel 13 Aug '05

13 Aug '05

Hi, sorry for crossposting, but I think this concerns both SURBL and URIBL. Given: A (phishing-)mail containg a link to the IP 219.144.194.158 The lookup page on rulesemporium.com says it's listed on ws and ph in SURBL However, I find that the current SpamAssassin (3.0.4) does not appear to lookup IP-based URLs. Is that correct? Secondly, which form would be correct to lookup that IP via dig (or whatever), and how should SA handle it if it tried to lookup IP-based URIs? dig 219.144.194.158.multi.surbl.org gives no results back, but the reversed dotted decimal form does: dig 158.194.144.219.multi.surbl.org returns 127.0.0.12. Lastly: The URIBL-Lookup page says that the IP 219.144.194.158 is neither listed on SURBL nor URIBL but claims that 158.194.144.219 is listed both in SURBL (ws and ph) and URIBL (black). I take that to be simply wrong. Dirk

2 2

RE: [SURBL-Discuss] Geocities
by Rob McEwen 13 Aug '05

13 Aug '05

Oops... I meant, "it is on the master white list" NOT "it is no the master white list" --Rob McEwen

1 0

XS inclusion into multi
by Darrell (support＠invariantsystems.com) 11 Aug '05

11 Aug '05

Jeff, Any idea's when xs will be included into multi? Darrell

6 7

hotlog.ru?
by Jeff Chan 08 Aug '05

08 Aug '05

hotlog.ru and some subdomains appeared in the SURBL data yesterday, but the site is also ranked about 25k on Alexa so it seems to be a fairly popular site. A couple readers of Russian took a look at the site and determined it's some kind of web log analysis tool vendor, but could not easily say if it had legitimate uses. Is anyone here familiar with them? In particular might they have legitimate uses? It's been around since 2000: domain: HOTLOG.RU type: CORPORATE nserver: ank.ank.ru. nserver: ns.wplus.net. nserver: ns1.wplus.net. state: REGISTERED, DELEGATED person: ANDREW N KUZMIN phone: +7 812 5963532 fax-no: +7 812 5963532 e-mail: ank(a)ank.ru registrar: RUCENTER-REG-RIPN created: 2000.11.29 paid-till: 2005.11.30 source: TC-RIPN Jeff C. -- Don't harm innocent bystanders.

1 0

Re: [SURBL-Discuss] Re: SURBL: sc2 vs sc?
by Jeff Chan 06 Aug '05

06 Aug '05

On Thursday, August 4, 2005, 7:36:11 AM, Bil Cook wrote: > Have yet to hit a FP on SC2 and that is over almost three weeks now On Thursday, August 4, 2005, 5:29:00 AM, Rob McEwen wrote: > Last night, I ran SC2 against a corpus of 119,000 messages consisting of > about 97-99% ham. This was a corpus of mostly ham mail which had made it > past my filter over the past few months. (BTW, my percentages keep getting > better, so most of that small percentage of spam in this corpus was from a > few months ago). > SC2 caught about 150 messages from this corpus. ALL of these caught messages > were spam. It did NOT "block" a single ham. Thanks much for the feeback Bil, Rob and others earlier and off-list. If the SA folks don't have time to do a corpus check on SC2, then maybe we should go ahead and put SC2 into production. I'd still feel better with a large ham check from them before doing it though. Jeff C. -- Don't harm innocent bystanders.

3 5

Re: [SURBL-Discuss] Why you should check Phish IPs first :/
by List Mail User 06 Aug '05

06 Aug '05

>... >In today's spamtrap take, I got a phish targeting eBay that >contained a link to the following IP: > >66.135.192.124 > >The link was inside a JavaScript and looked, at first and second >glance, like a link to a phish site. As a habit, I do an rDNS >on all IPs, however, before listing them. That's fortunate, in >this case -- that IP resolves as hp-core.ebay.com. Yes, a genuine >eBay IP pointing to a genuine eBay server, one that has nothing >to do with the phish, of course. > >The actual phish link in this spam was: > >http://www.doje.de/bbs/eBayISAPI.dllhdsh6ds65bcgadhgd43as676bsda6gwcv7zfcag… > >It appeared well down the spam, after not one, but two, decoy >links to the eBay IP above. > >By the way, I'm not listing doje.de as a Phish Domain either. >It's a Chinese language web site (yes, at a German national >domain, probably something for expatriates), and the format >of the URL suggests that the phisher exploited an insecure >web BBS package. This is one where blocking on the URL is >the appropriate approach. <sigh> > >Posted because I'm seeing quite a few phishes with this sort >of decoy information/links lately. :/ Phishers are clearly >trying to poison the blocklisting process. We have to be >careful. > > >-- >Catherine Hampton <ariel(a)spambouncer.org> >The SpamBouncer * <http://www.spambouncer.org/> >Personal Home Page * <http://www.devsite.org/> >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > I think it is Korean, not Chinese. Paul Shupak track(a)plectere.com

1 0

SURBL: sc2 vs sc?
by Jeff Chan 04 Aug '05

04 Aug '05

It's sounding like the sc2 list is catching 10-15% more spam than the sc list, based on some early reports of SA users. Is anyone else getting some results? Are there differences in ham hits? Has anyone been able to run them through their test corpora? How about xs.surbl.org? Jeff C. -- Don't harm innocent bystanders.

5 7

Re: [SURBL-Discuss] RFC: Adding SpamBouncer phishing data to ph.surbl.org
by List Mail User 02 Aug '05

02 Aug '05

Steve, I'm not a procmail user and nearly all your expressions look good except a few. If you have any users into genealogy the next~of~kin pair may give you problems; I get mail like this from family members who are "into" that sort of thing. Also, my accountants will sometimes send me emails with urgent_response and/or urgent_reply in them. All the rest seem to match what I have seen in 419s only - a really good list overall. (BTW. Bayes is good at catching these too. How often does an American even see or hear the word "barrister"? Ouside of the Commonwealth or old Commonwealth countries, I doubt the work gets any use except on PBS; And who *really* wants to hear from a lawyer anyway:-)) Paul Shupak track(a)plectere.com

2 1

RFC: Adding SpamBouncer phishing data to ph.surbl.org
by Jeff Chan 02 Aug '05

02 Aug '05

Catherine Hampton of SpamBouncer (welcome to the SURBL Discuss list Catherine!) is kindly making available her carefully checked phishing domains and IPs for our inclusion in the SURBL phishing list. They're not currently added to ph.surbl.org, but the hooks are in place to make it live after some discussion here. Catherine's data come from antiphishing.org plus her own trapped phishes. All are hand checked about once a day. When I reviewed a recent snapshot of the data: http://www.spambouncer.org/dist/standalone/phishdata/current.txt I found that 124 of the 193 domains were already listed on various SURBLs. The other new 69 looked quite phishy and probably ok to list. For the IPs, we had 22 of the 74 listed, and I'll assume the others are probably zombies, etc. as Catherine suggested. Generally speaking there's little harm in listing IPs since most legitimate sites don't get referenced by IP, so there's good upside and little downside for listing them. Please take a look at the data for yourself and comment. Regarding expiring the data, Catherine told me: > I expire "Phish IP" listings every month. Phishers move around a > LOT, probably because most of the IPs are on compromised or trojaned > hosts and tend to get fixed within a couple of weeks. > > I don't expire Phish domains formally right now, although eventually > I plan to run them through regular "has this domain expired and not > been renewed" checks. Since I only list domains designed specifically > for phishing and used only by phishers as "Phish domains", they aren't > likely to be used for anything else. (Domains like paypalll.com > don't seem to have much legitimate use to me.) which sound like reasonable policies to me. Does anyone have comments on adding these to the PH list? Am I forgetting anything Catherine? :-) Jeff C. -- Don't harm innocent bystanders.

6 7

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss