Discuss

discuss@lists.surbl.org

1870 discussions

You guys are fast!
by Chris Santerre 21 Oct '04

21 Oct '04

I get submission marked as spam because someone has already added them to SURBL! (I scan submission on purpose for this very reason.) Some of you guys are mad fast at adding these ;) --Chris

2 1

RE: [SURBL-Discuss] Recently whitelisted
by Chris Santerre 21 Oct '04

21 Oct '04

> >The remaining three which got whitelisted from your list are: > >coolestmail.com >emailcorner.net >messagingengine.com > >Thanks! > >Jeff C. LOL see, and you thought I was a hardline blacklister! I swing both ways......uh ...no, ......you know what I mean ;) --Chris (RED SOXXXXXXXXXXXXXXXXXXXXX!!!!!!!!!!!!!!!!!!!!!! Yeah!)

1 0

RE: [SURBL-Discuss] Recently whitelisted
by Chris Santerre 21 Oct '04

21 Oct '04

I was doing some research on kiddie pron. A bunch of whois email contact info came up similar. veryfast.biz So using our favorite set of utilities ;) , I found others linked to it. Thinking they might have something to do with the huge whirling dirvish of kiddie pron domains. It didn't appear that way. They appeared legit, but I had a small doubt I could have been duped. Those kiddie pron guys are pretty sly. But turns out they are whitehat, so I figured we should do a pre-emptive white listing on them. I don't think any of them were listed in an SURBL. --Chris (!esruc eht esreveR) >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, October 20, 2004 3:27 PM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] Recently whitelisted > > >On Wednesday, October 20, 2004, 12:05:43 PM, Chris Santerre wrote: >> In WS I have whitelisted the following thanks to responses >from Steve C, and >> Suresh. Jeff do you want to globally WL these? > >> 123mail.org >> 150mail.com >> 150ml.com >[...] > >Thanks much! > >Yes, if they are good enough to whitelist out of the individual >lists then we should whitelist them over all lists. I've added >them to the master whitelist. > >I also added fastmail.fm; hope that's correct. > >Can you describe where these came from? Are they >all from WS or also from OB; due to DMOZ hits or other? > >Jeff C. >-- >"If it appears in hams, then don't list it." >

2 1

Recently whitelisted
by Chris Santerre 21 Oct '04

21 Oct '04

In WS I have whitelisted the following thanks to responses from Steve C, and Suresh. Jeff do you want to globally WL these? 123mail.org 150mail.com 150ml.com 16mail.com 2-mail.com 4email.net 50mail.com bestmail.us cluemail.com coolestmail.com elitemail.org emailcorner.net emailgroups.net emailplus.org emailuser.net fast-email.com fast-mail.org fastemail.us fastemailer.com fastmail.cn fastmail.us fastmailbox.net fastmessaging.com fmailbox.com fmgirl.com fmguy.com hailmail.net imap-mail.com imapmail.org internet-e-mail.com internet-mail.org internetemails.net internetmailing.net jetemail.net letterboxes.org mail-central.com mail-page.com mailas.com mailbolt.com mailc.net mailhaven.com mailingaddress.org mailite.com mailmight.com mailnew.com mailsent.net mailworks.org messagingengine.com myfastmail.com nospammail.net ownmail.net postinbox.com proinbox.com promessage.com reallyfast.biz reallyfast.info rushpost.com speedpost.net speedymail.org ssl-mail.com swift-mail.com the-fastest.net the-quickest.com theinternetemail.com veryfast.biz warpmail.net xsmail.com yepmail.net your-mail.com Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

4 12

RE: [SURBL-Discuss] Recently whitelisted
by Chris Santerre 20 Oct '04

20 Oct '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Wednesday, October 20, 2004 4:07 PM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] Recently whitelisted > > >on Wed, Oct 20, 2004 at 03:46:53PM -0400, Rob McEwen wrote: >> Also, in case my terminology is not quite technically >accurate... this is >> what I meant: >> >> subdomains = subdomain.thatdomain.com > >This is one of those idiot-proof Web hosting naming conventions that I >wish would just die. 'subdomain.thatdomain.com' is a >/hostname/. It's not Agree on the hostname. > >> subwebs = thatdomain.com/subweb > >Why not just call them URL paths? We used to refer to these as >"subsites" back in the day, but technically they're just URL paths in >this context as there's no sense of their being components >with multiple >pages under them or anything. subsite works for me, even though it is just a path. Path or URL path just sounds goofy :) I still want to be able to list hosts in UC. But we just haven't gotten far enough with UC to try any of this yet. I'm hoping to find time to rewrite bigevil to find spammy things in URL paths. Like: www.xdomain.com/lolitateens/ scoring off the 'lolita'. But those closer to me know I got some HUGE stuff coming up in my life, so I may not be able to get to this soon. Possibly around thankgiving. --Chris

1 0

RE: [SURBL-Discuss] Possible new redir FP
by Chris Santerre 20 Oct '04

20 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, October 19, 2004 9:26 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Possible new redir FP > > >On Tuesday, October 19, 2004, 5:17:20 PM, Joe Wein wrote: >>> get2.us > >> I saw that in our spam feed to but skipped blacklisting >after checking the >> site, as it looks like a redirector. > >> Instead I sent them email reporting the abuse and pointed >out our open >> letter to redirector sites. > >> Joe > >Excellent! Thanks Joe. > >I checked them out a little more and their site and name servers >seem clean in terms of SBL, etc., including the parent domain >ScriptWiz.com. The apparent owner of the sites seems to have >several different sites, all pretty enterprising and apparently >legitimate. > >I'm going to go ahead and whitelist all the redirection sites >mentioned at: > > http://www.get2.us/start.php > >caught.us >get2.us >getto.us >hasballs.com >hated.us >ismyidol.com >spotted.us >went2.us >wentto.us > >None were whitelisted before, and only get2.us was listed in a >SURBL. > >Feedback, good or bad, on any of these is still welcomed! OK, hasballs.com is pretty funny ;) --Chris

4 4

Possible new redir FP
by Chris Santerre 20 Oct '04

20 Oct '04

get2.us listed in SC. Looks like a redir. Could be spam friendly. Great candidate for UC, but I'm suggesting Whitelisting for the rest. Thoughts? DOn't ask me if it appears in ham. Because I don't know. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 3

Fwd: Re: mailpolice point of contact
by Jeff Chan 19 Oct '04

19 Oct '04

Since Chris asked the question here too, here's what Bill found. Jeff C. __ This is a forwarded message From: Bill Landry <billl(a)pointshare.com> To: "Chris" <cpollock(a)earthlink.net>, users(a)spamassassin.apache.org Date: Monday, October 18, 2004, 9:01:43 PM Subject: mailpolice point of contact ===8<==============Original message text=============== ----- Original Message ----- From: "Chris" <cpollock(a)earthlink.net> > > > Does anyone know of a POC to report phishing msgs that the > > > mailpolice rbl misses? > > > > I sent an e-mail to a contact at MP to see who these could be sent to. > > You can also forward them to postmaster(a)corp.mailsecurity.net.au, which > > will get them listed on the SURBL phishing list. > > Thanks Bill, I'll give that a try, can't seem to get the > http//:rhs.mailpolice.com page to load, I'll run their ip through > whois and see if I have any luck. I already report all phishing to > postmaster(a)corp.mailsecurity.net.au, > reportphishing(a)antiphishing.org but seems like the mailpolice > list is lacking quit a bit in tagging phishing msgs. Chris, I heard back from MP, and was advised to go ahead and send these to spam(a)mailpolice.com. Bill ===8<===========End of original message text===========

1 0

Re: [SURBL-Discuss] Took top percentiles of DMOZ and wikipedia domains, some results
by Jeff Chan 19 Oct '04

19 Oct '04

On Saturday, October 16, 2004, 7:08:01 PM, David Funk wrote: > On Sat, 16 Oct 2004, Jeff Chan wrote: >> Thanks Dave, >> www.xiloo comes up for me but efriend.xiloo does not. >> Perhaps they took down a spammer's site? If so that >> could be good. >> >> But mainly I can't tell what the main site is since I >> can't read Chinese. It looks like a portal, but it's >> just a guess. And given that they seem to host multiple >> customer sites, perhaps we can assume they do hosting >> also. > Actually I don't read Chinese either. I use our local Chinese > grad student population for translation assistance in these > cases. I'm on the road for the next 4 days, I can get you > a 'read' on the main site when I get back. > Dave FWIW Spamhaus thinks xiloo.com is a spammer: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL14687 > Ref: SBL14687 > > 219.235.232.0/24 is listed on the Spamhaus Block List (SBL) > > 02-Jun-2004 06:05 GMT | SR02 > > dns6.xilu.com Spamhaus does not have the same inclusion criteria we do, but it can be a useful data point. Jeff C. -- "If it appears in hams, then don't list it."

1 0

RE: [SURBL-Discuss] Theory about FPs for sites with open subscrip tions
by Chris Santerre 18 Oct '04

18 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Saturday, October 16, 2004 10:31 AM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] Theory about FPs for sites with open >subscriptions > > >On Saturday, October 16, 2004, 6:57:56 AM, Rob McEwen wrote: >> Recently, a high-profile news web site (ranked about 1,500 >on alexa.com) had >> the IP address of the server sending their newsletters blocked by >> bl.spamcop.net > >> I contacted someone from SpamCop and they mentioned that, upon >> investigation, this site had an "open loop" newsletter subscription. > >> Recognizing that open loop subscriptions is a bad policy... >this is one of >> the reasons that, IMHO, SpamCop's RBL is much too aggressive >to use for >> all-or-none, "yes/no" blocking. (Though I do use it for auditing.) > >> More importantly, I hope that this kind of stuff does NOT >**automatically** >> get propagated from SpamCop to SURBL? (Though I'm largely >unfamiliar with >> this process.) > >The SpamCop RBL and our use of SpamCop's Spmavertised site data >are totally unconnected, aside from using some of the same >reports as input data. Their BL policies have no effect on >our sc.surbl.org policies. > >The problem with these open subscriptions getting onto SURBLs >is happening on OB, the Outblaze spamtrap SURBL, and WS, the >manual and some spamtrap SURBL. That, plus some looking at >the NANAS reports leads me to think some spamtraps may be >getting poisoned with these open subscription domains. The >poisoning may be deliberate or unintentional, with good >intentions or bad, but either way most of these open >subscription sites should not be getting onto our lists since >many have otherwise legitimate uses. > >Obviously open subscriptions are an extremely poor practice >and open for abuse, but that alone should not be a reason >to get listed in a SURBL, especially for otherwise legitimate >industrial/engineering/child protection sites, etc. > Perhaps it may be time for WS to have its own spamtraps? Most of you might already have them. I don't use any. Only what comes into my company. However a few "one time" aliases that were made for business reasons, I haven't deleted and they are starting to get spam. I just think we might be able to get some nice clean data with some nice new spamtraps for WS. Thoughts? --Chris

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss