Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

RE: [SURBL-Discuss] What are the chances of FP on Newsletters and Order Confs.
by Chris Santerre 03 Dec '04

03 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 12:19 AM >To: Paul Schwarz >Cc: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] What are the chances of FP on Newsletters >and Order Confs. > *snip* > >In a nutshell our false positive rate is very low. Our policies >help that, and you can help by reporting any false positives >you may find to us. Our rate of false positive reports is very >low, probably less than one per day. A comment on this. This FP rate is arguable in my eyes. Anyone on the SURBL list knows Jeff and I have a difference of opinion as to what an FP is :-) (Much love for Jeff!) If a legit newsletter sends to a spamtrap, then is that truely an FP? Think about that, let it simmer, eat something, think about it some more, then answer it. (You don't have to answer that one Jeff, I know....) But we follow the SURBL contributor rules whether we like them or not. WWJD= What would Jeff do? ;) I have to admit, it bothers me that Theo's stats show the WS list in second lowest place for FPs. Damit it! We want to be the lowest FP rate of them all!!! Call it a freindly competition. We are close, so close. --Chris

1 0

RE: [SURBL-Discuss] Spammers Workaround
by Chris Santerre 03 Dec '04

03 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, December 03, 2004 2:45 AM >To: RD >Cc: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Spammers Workaround > > >On Thursday, December 2, 2004, 11:02:26 PM, RD RD wrote: >> I just thought that an additional feature for SpamcopURI to scan the >> message for a non-clickable links/domains that is present it >SURBL would >> be a nice add-on. > >SpamAssassin probably already does quite a bit of deobfuscation >to detect URIs and domains in them. I think it may look for >www.domain.com already, but I don't know about www . domain . com >You could look at the source code or ask them.... > Actually I see a nice pattern to look for. I will right an SA rule for this and post it later today for testing. But if people are stupid enough to fall for spams, then they are too stupid to remove the spaces, and these links are useless. :) --Chris (I'm a toys-r-us kid!)

1 0

Spammers Workaround
by RD 03 Dec '04

03 Dec '04

Hello List, Somehow spammers are using below's method to get around SURBL. I can create a simple body rule but might end-up having a huge list like the bigevil list. Any suggestions how to beat this type of spam? Subject: Rx Meds to go From: "zasrybf" <zasrybf(a)yahoo.com> Date: Wed, 01 Dec 2004 19:15:43 -0700 To: <Undisclosed Recipients> Total confidentiality with hundreds of different drug products in stock. Your very best prescription medications online. www. rxandyou. com (Copy and Paste this address to your browser) Thanks in advance. -RD

3 6

What are the chances of FP on Newsletters and Order Confs.
by Paul Schwarz 03 Dec '04

03 Dec '04

Hi Guys, just wondered if using SURBL will block IT Dept, HR Dept and such newsletters that people get. We get a lot of those in our depts. Also what are the chances of blocking a confirmation emails for something someone orders, etc And also Airlines Just feeling a little leery of using SURBL for a risk of false positives. Seems like a lot of newsletters outsource to companies that could look like spammers. I know it won't block and person to person email but can you help me feel more comfortable about SURBL ? Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100 www.starktruss.com

5 5

Lycos Screensaver that attacks Spammers
by Kevin A. McGrail 03 Dec '04

03 Dec '04

Below is an interesting article from The Washington Post where it details a new screensaver from Lycos. The screensaver visits websites while your computer is idle that are referenced in SPAM and make it to a bad spammers list. This is done in an attempt to limit the website ability to server traffic efficiently by causing extra traffic. While I question the 100% legality of such a tactic, it DOES make sense that we could make a SURBL site-still-online-verification-list that would cause an LWP request to URLs per incoming email. This could be used to verify that websites are still online which is valid and is done in response only to email received at your server. Perhaps this information wouldn't be used Real-time to prevent mail server delays but simply collected in the background and reported to a central service. If it has the added benefit of costing spammers extra money or slowing down their site, they should throttle their improper email outbound having a direct 1:1 correlation. Thoughts? KAM http://www.washingtonpost.com/ac2/wp-dyn/A22311-2004Nov30?language=printer Lycos Offers Program to Attack Spammers By Daniel Woolls The Associated Press Tuesday, November 30, 2004; 9:50 PM MADRID, Spain -- At the risk of breaching Internet civility, a European Web portal is offering its visitors a weapon against spam: a screensaver program that tries to choke spam servers by flooding them with junk traffic. As of Tuesday, about 65,000 people have signed up for the controversial tool from the German-based Lycos Europe, whose sites get 20 million users monthly. The company insists the technique is legal - it says the culprit servers are simply choked a bit, not completely asphyxiated - and dismissed concerns that its "Make Love not Spam" offensive can further clog the world's digital pipeline. Still, computer experts are worried. "You don't stop a bad thing by being bad yourself," said David Farber, former chief technologist at the U.S. Federal Communications Commission. "The idea of somebody coming and hitting you and you hitting back, you both end up very hurt. It just aggrevates an already serious problem." When a computer with the free Lycos screensaver is idle, the program sends junk commands to Web sites identified by Lycos as selling products pitched in spam. When done in masse, this eats up precious bandwidth, causing the sites to overload and slow down. The goal, said Lycos Europe spokesman Kay Oberbeck, is to "show the owners of such spam Web sites that there is massive interest of thousands of users who are not willing to just give up against more and more spam each day." The targets generally are not the servers used to do the actual mailings; these days, those servers are most often legitimate ones co-opted into spamming by viruses and worms. Lycos chooses its targets by reviewing lists of suspect sites identified by independent spam monitors such as SpamCop. The company said it checks each manually to make sure it genuinely carries products promoted by spam, though Oberbeck acknowledged the risk of going after a legitimate site that has been hijacked by a spam-spewing site. He said Lycos takes care not to crash spam servers altogether, ensuring that they will never go below 5 percent bandwidth. Thus, he said, the offensive isn't the same as denial-of-service attacks commonly used by hackers to incapacitate Web sites. Cyberspace activism - such as virtual sit-ins in which computer users gang together and use automated tools to flood a Web site - is not entirely new, said Dorothy Denning, a professor of defense analysis at the Navy Postgraduate School in Monterey, Calif. But in this case a for-profit company is the driving force. "The interesting question is whether or not that company might be liable under some law, and would probably be liable, certainly, at least under a lawsuit by the spammers," she said. Denning believes any impact on spamming will be minor at best. Though spam sites have to pay for bandwidth required for the extra traffic, she said, "the cost off adding extra bandwidth may be worth the reward that comes from spamming." © 2004 The Associated Press

4 5

Nullsoft .com FP?
by Chris_Barton＠McAfee.com 03 Dec '04

03 Dec '04

Hi, I just noticed nullsoft .com was listed in the sc list. They are the people behind WinAmp Etc & Now owned by AOL. Could one of you review it please? Registered in 1997 and not updated for almost a year. I have a sample showing it was used as link fodder in a cheap s/w spam. Chris.

2 1

Discuss: WAS: SURBL+ Checker Submission
by Chris Santerre 03 Dec '04

03 Dec '04

I stripped the header for this discussion. Is this a spam domain or an attempt to poison SURBL. It is obviously a spam, but is domain bogus? >-----Original Message----- >Subject: SURBL+ Checker Submission > > >Date: Fri Nov 26 02:45:48 2004 > >Applicable List: URIBL:ws.surbl.org >Reported URI/IP: com.info >Rating: Black - 100% spam > >Email Source: >---------------------------------------- > *SNIP* > by ra093.prone.absorptive.skeptic.yahoo.com > (InterMail vB.5.%RNDDIGIT2.%RNDDIGIT2.%RNDDIGIT2 >369-%RNDDIGIT15-9-%RNDDIGIT15-%RNDDIGIT15-%RNDDIGIT510) with ESMTP > id ><%RNDDIGIT515.%RNDUCCHAR355029.ny29-mail.nail.date.net.cable.ro >gers.com@autism> > for <export(a)blnotts.com>; Thu, 25 Nov 2004 20:24:06 -0500 >Message-ID: ><04710%RNDLCCHAR15%RNDDIGIT15%RNDLCCHAR15$%RNDDIGIT17535jf702$% >RNDDIGIT15ms53hme10@bask> >Reply-To: "privacy" <tvwghz(a)yahoo.com> >From: "privacy" <tvwghz(a)yahoo.com> >To: <export(a)blnotts.com> >Subject: cure for anxioty, for the pr1ce of a newspaper a day. >Date: Fri, 26 Nov 2004 05:24:06 +0400 >MIME-Version: 1.0 >Content-Type: multipart/alternative; > boundary="--65897551847182532" > >----65897551847182532 >Content-Type: text/html; >Content-Transfer-Encoding: quoted-printable > ><html> ><body text=3Dblack bgcolor=3Dwhite link=3Dblue alink=3Dblue >vlink=3Dblue> ><center> >Wanted to try Cialis but thought it was >way too expe= >nsive >for you? >You can do that now! Cialis at only $1.90 per dose. >Your best deals are <a >href=3D"http://hesatosser.com.info/?wid=3D100005">H= >ERE</a> > >You have enjoyed Viagra and wish for a >longer effect= >? >Cialis can make it happen. >UNBELIEVABLE! CIALIS AT ONLY $1.90 PER DOSE > >Say NO! to planning sex for hours in advance and your disappointment >after "a missed dose". You don't have to be content with a four hour >action of an regular pill. Get CIALIS now to ensure the whole day of >joyful sexual intimacy for you and your partner. > >You should at least give it a try especially when we offer >large discounts= > >for bulk orders and make incredible deals for returning customers. > > ><a href=3D"http://hesatosser.com.info/?wid=3D100005"> >Get it now > ></a> > > > size=3D"1"><a= > href=3D"http://http://hesatosser.com.com/nomore.html">Go >here</a> to stop= > this from being delivered ></body></html> > >----65897551847182532-- > > >---------------------------------------- >

3 2

RE: [SURBL-Discuss] Discuss: WAS: SURBL+ Checker Submission
by Chris Santerre 02 Dec '04

02 Dec '04

>-----Original Message----- >From: David B Funk [mailto:dbfunk@engineering.uiowa.edu] >Sent: Thursday, December 02, 2004 5:10 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Discuss: WAS: SURBL+ Checker Submission > > >On Thu, 2 Dec 2004, Chris Santerre wrote: > >> I stripped the header for this discussion. Is this a spam >domain or an >> attempt to poison SURBL. It is obviously a spam, but is domain bogus? >> >> >-----Original Message----- >> *SNIP* >> >[snip..] >> >href=3D"http://hesatosser.com.info/?wid=3D100005">H= >> >ERE</a> >[snip..] >> ><a href=3D"http://hesatosser.com.info/?wid=3D100005"> >> >Get it now >[snip..] >> > href=3D"http://http://hesatosser.com.com/nomore.html">Go >> >here</a> to stop= > >Neither, it's broken spam-ware. The actual pill-spam-site >is "hesatosser .com" (which is listed in SURBL ;). > >"*.com.com" is a valid domain name, belongs to CNet, clearly >not spam. "*.com.info" isn't even a valid domain at all. > Thanks dave, that is what I thought. Helped to hear it from someone else :) --Chris

1 0

RE: What is up with surbl.org?
by Chris Santerre 02 Dec '04

02 Dec '04

>-----Original Message----- >From: Mark [mailto:admin@asarian-host.net] >Sent: Thursday, December 02, 2004 3:43 PM >To: users(a)spamassassin.apache.org >Subject: What is up with surbl.org? > > >How come surbl.org has a "Bad" status at rating.cloudmark.com? (see >below). This is not good. > Jealousy? :) Maybe they are related to that fifth dentist? Perhaps Jeff should contact them with a "What up, dude?" email? --Chris (Why won't this javalin lock on target!!!!!) NOTE: I think we should make everyone who uses SURBL buy a copy of Joint Operations and play with us ;) Halo is for small thinking people!

2 1

MISC: Is this why google is looking to hire antispam people?
by Chris Santerre 02 Dec '04

02 Dec '04

Cnet article: http://tinyurl.com/3mgxd Perhaps google should look into using SURBL? Maybe just the phishing part of it? Anyone have a google contact? " Phishers lie in wait for Google searchers Traditionally, phishing scammers have lured their victims to fraudulent Web sites by sending official-looking e-mails that are ostensibly from well-known companies asking users to 'verify' their user names and passwords. Now many are setting up legitimate looking e-commerce sites that disguise links to malicious software as pictures of goods on sale, CyberGuard said Wednesday. Paul Henry, a senior vice president at CyberGuard, said that when Web shoppers search the Internet looking for products they want to buy, they could be directed to a plausible e-commerce site that instructs them to "Click here to download images" of the product. Henry said that instead of linking to pictures of the advertised product, the links point to a self-extracting ZIP file that installs a Trojan horse on the victim's computer. The program could then steal personal and financial information. ......... ... " Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss