Discuss

discuss@lists.surbl.org

1864 discussions

RE: [SURBL-Discuss] More spams with Zdnet redirector
by List Mail User 06 Apr '05

06 Apr '05

>... > >I thought they fixed this????? > >--Chris > >>-----Original Message----- >>From: Rakesh [mailto:rakesh@netcore.co.in] >>Sent: Tuesday, April 05, 2005 9:19 AM >>To: SURBL Discussion list >>Subject: [SURBL-Discuss] More spams with Zdnet redirector >> >> >>Guys >> >>Seems Zdnet doesn't bothers about its open redirectors as yet. >>This is a >>spam that I trapped just 5 mins back. Spammers are … [View More]

2 1

RE: [SURBL-Discuss] More spams with Zdnet redirector
by Chris Santerre 05 Apr '05

05 Apr '05

I thought they fixed this????? --Chris >-----Original Message----- >From: Rakesh [mailto:rakesh@netcore.co.in] >Sent: Tuesday, April 05, 2005 9:19 AM >To: SURBL Discussion list >Subject: [SURBL-Discuss] More spams with Zdnet redirector > > >Guys > >Seems Zdnet doesn't bothers about its open redirectors as yet. >This is a >spam that I trapped just 5 mins back. Spammers are enjoying >using these >openredirectors. > >Can any one send a reminder … [View More]

2 1

Yet another redirector
by Alex Broens 29 Mar '05

29 Mar '05

Good Morning! New redir? ------ For more information or to have a broker contact you please visit: http://g.msn.com/0MNBUS00/1?http://ok-ref-now.com No future contact: http://g.msn.com/0MNBUS00/1?http://ok-ref-now.com/gone.asp -- Does anybody know soemone @msn? mailing abuse is like... forget it thanks Alex // Pls bare my mood - I'm wearing a Nicotin patch //

3 3

use of caching proxy's data
by Alain 26 Mar '05

26 Mar '05

Hi Have you thought about using the logdata from caching proxy's to check against this data and the other SURBL lists? The caching proxy's logfiles contain a very good view on which domains are used while surfing. While not all domains that are used are legit, I would be surprised if active spam domains were frequently visited over a period in the past. Those frequently surfed to domains shouldn't be whitelisted by default, but it could be a trigger to have a closer look before placing … [View More]

2 1

Re: [SURBL-Discuss] Re: New redirector: www.nate.com
by List Mail User 25 Mar '05

25 Mar '05

>... >To: discuss(a)lists.surbl.org >From: Frank Ellermann <nobody(a)xyzzy.claranet.de> >Date: Fri, 25 Mar 2005 11:51:55 +0100 >... > >List Mail User wrote: > >> gabia.com-munged >> http://www.rfc-ignorant.org/tools/lookup.php?domain=gabia.com > >ACK, that's also the first time that I heard about any "ICANN >10 years limit" for the expiration of com-domains. And here >it's apparently the reason for a whois-RFCI-entry, which RfC >could … [View More]

1 0

Re: [SURBL-Discuss] Re: New redirector: www.nate.com
by List Mail User 25 Mar '05

25 Mar '05

>... >To: discuss(a)lists.surbl.org >From: Frank Ellermann <nobody(a)xyzzy.claranet.de> >Date: Wed, 23 Mar 2005 07:41:13 +0100 >... >Subject: [SURBL-Discuss] Re: New redirector: www.nate.com >... > >List Mail User wrote: > >> The rfci whois listing for gambia.com-munged is one of my >> favorites, because it is the only time I have seem that >> particular violation. > >What are you talking about ? `rxwhois -a gambia.com` says: > … [View More]

2 1

RFC: New SURBL based on exploited senders?
by Jeff Chan 25 Mar '05

25 Mar '05

We've been in contact with the operators of a large trap which feeds lists of exploited hosts into RBLs, inquiring if they'd be able to provide URI domains from some of the spams they receive. The idea is to try to find URIs that are specifically sent through zombies and other exploited hosts on the concept that only the worst spammers use zombies and brute force to try to go around RBLs to deliver their spam. The trap operators are able to extract some URI hosts for us, but for now can't … [View More]afford much more CPU than to use a PERL script calling the Email::MIME module to grab URI domains from about 60k messages. (There's not enough spare CPU to use a program like SpamAssassin, which would likely have more success extracting URIs, but is much more resource intensive.) They may be able to process up to a hundred times as many of their messages for us (i.e. 6M a day) if this moves forward, though even that would be only a small fraction of their trap hits. At my request they are including a count of the number of appearances of each URI domain name or IP so that we can rank them in order of frequency of appearance on the theory that the bigger spammers may appear more often. Based on that test run and some tweaking of the scripts on their side and ours, we got the following table of percentiles of hits, resulting output record counts, hits against existing SURBLs, hits against the SURBL whitelist, and new records (i.e., in neither our black or white lists): 100th percentile, 1293 records, 732 blacklist hits, 112 whitelist hits, 449 novel 99th percentile, 844 records, 549 blacklist hits, 81 whitelist hits, 214 novel 98th percentile, 653 records, 461 blacklist hits, 67 whitelist hits, 125 novel 97th percentile, 548 records, 397 blacklist hits, 54 whitelist hits, 97 novel 96th percentile, 481 records, 352 blacklist hits, 48 whitelist hits, 81 novel 95th percentile, 433 records, 320 blacklist hits, 42 whitelist hits, 71 novel 94th percentile, 396 records, 298 blacklist hits, 40 whitelist hits, 58 novel 93th percentile, 362 records, 287 blacklist hits, 39 whitelist hits, 36 novel 92th percentile, 332 records, 263 blacklist hits, 38 whitelist hits, 31 novel 91th percentile, 307 records, 251 blacklist hits, 29 whitelist hits, 27 novel 90th percentile, 286 records, 231 blacklist hits, 29 whitelist hits, 26 novel 89th percentile, 267 records, 218 blacklist hits, 25 whitelist hits, 24 novel 88th percentile, 250 records, 202 blacklist hits, 25 whitelist hits, 23 novel 87th percentile, 235 records, 188 blacklist hits, 25 whitelist hits, 22 novel 86th percentile, 221 records, 177 blacklist hits, 23 whitelist hits, 21 novel 85th percentile, 209 records, 170 blacklist hits, 22 whitelist hits, 17 novel 84th percentile, 197 records, 161 blacklist hits, 20 whitelist hits, 16 novel 83th percentile, 186 records, 155 blacklist hits, 18 whitelist hits, 13 novel 82th percentile, 176 records, 148 blacklist hits, 16 whitelist hits, 12 novel 81th percentile, 167 records, 140 blacklist hits, 16 whitelist hits, 11 novel 80th percentile, 159 records, 135 blacklist hits, 14 whitelist hits, 10 novel 79th percentile, 152 records, 130 blacklist hits, 13 whitelist hits, 9 novel 78th percentile, 145 records, 124 blacklist hits, 13 whitelist hits, 8 novel 77th percentile, 139 records, 118 blacklist hits, 13 whitelist hits, 8 novel 76th percentile, 133 records, 112 blacklist hits, 13 whitelist hits, 8 novel 75th percentile, 127 records, 107 blacklist hits, 12 whitelist hits, 8 novel 74th percentile, 122 records, 102 blacklist hits, 12 whitelist hits, 8 novel 73th percentile, 116 records, 98 blacklist hits, 11 whitelist hits, 7 novel 72th percentile, 112 records, 95 blacklist hits, 11 whitelist hits, 6 novel 71th percentile, 107 records, 91 blacklist hits, 11 whitelist hits, 5 novel 70th percentile, 103 records, 88 blacklist hits, 10 whitelist hits, 5 novel For this sample, the 96th or 97th percentile appears to be an inflection point of expectedly Zipfian-looking data. (I.e. just a few URI hosts appear many times, and many URI hosts appear just a few times.) Even after whitelisting there are still a few legitimate-looking domains coming through, so one idea would be to list the records up to the 96th or 97th percentile, but for the remaining ones with fewer hits, only list those that also appeared in existing SURBLs, or resolved into sbl.spamhaus.org, or where the sending software was clearly spamware. Hopefully that would reduce FPs in these records with fewer hits, but still let us "pull some useable data out of the noise" and list some of the less frequently appearing records. Does anyone have any comments on this? IMO what makes these data somewhat unique is that it's an early look at the content which exploited hosts are sending into very large traps. The benefit is that it helps us potentially catch up to a few hundred otherwise unlisted domains sooner, and helps reduce the usefulness of those domains in future zombie usage, etc. In other words it potentially improves the detection rates of SURBLs and increases the usefulness of traps feeding traditional RBLs. Comments? Jeff C. -- "If it appears in hams, then don't list it." [View Less]

2 2

Re: [SURBL-Discuss] Zdnet redirector *still* open
by List Mail User 25 Mar '05

25 Mar '05

Sorry - followup to the last - meant xml-soft.info-munged. Paul Shupak track(a)plectere.com

2 1

Re: [SURBL-Discuss] Zdnet redirector *still* open
by List Mail User 24 Mar '05

24 Mar '05

>... >From: "Matthew Wilson" <matthew(a)boomer.com> >To: "SURBL Discussion list" <discuss(a)lists.surbl.org> >... >Subject: [SURBL-Discuss] Zdnet redirector *still* open > >C'mon, why can't they get it right? > >Just got a spam with this URL. > >http://chkpt.zdnetMUNGED.com/chkpt/lovealready/bhe%2eIB%72soF%74.C%6fm > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.… [View More]

1 0

Zdnet redirector *still* open
by Matthew Wilson 24 Mar '05

24 Mar '05

C'mon, why can't they get it right? Just got a spam with this URL. http://chkpt.zdnetMUNGED.com/chkpt/lovealready/bhe%2eIB%72soF%74.C%6fm

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss