Discuss

discuss@lists.surbl.org

2 participants
1876 discussions

Activating only SURBL and disabling other DNS/network tests in SA 3.0
by Yusuf Goolamabbas 08 Sep '04

08 Sep '04

Let's say that I want to enable only SURBL lookups in my SA 3.0 config. For now, I have to load the plugin and specifiy dns_available yes in my SA config. Since I don't want to do any RBL or other checks which may get activated as a side effect of specifying 'dns_available yes'. I also specify the following use_razor2 0 use_dcc 0 use_pyzor 0 skip_rbl_checks 1 score NO_DNS_FOR_FROM 0 score ROUND_THE_WORLD 0 Is there any other rules/settings I need to configure to prevent them from firing due to 'dns_available yes' Regards, Yusuf -- Yusuf Goolamabbas yusufg(a)outblaze.com

2 1

RE: [SURBL-Discuss] Re: Need help checking FP list from Theo
by Chris Santerre 08 Sep '04

08 Sep '04

OK, you asked for it ;) Some of this info will give you a 'feel' for who the hosts operate. >>Theo got us a list of 112 new false positives >from across all >>SURBLs. He showed me the source >messages which are almost >>all subscribed newsletters and mailing list >messages, so they >>seem quite hammy. > >>Given the type of source messages and some >spot checking, I'm >>inclined to whitelist them all, but I'd like to >ask for some help >>checking them first. Can anyone help check >these? > >123inkjets.com Oh, these guys are on my personal poop list! http://groups.google.com/groups?q=123inkjets.com+abuse&hl=en&lr=&ie=UTF-8&sa =G&scoring=d Domain List matching cluster of russ-effrig * 1: 007inkjets.com * 2: 00inkjets.com * 3: 111inkjets.com * 4: 123cartridges.com * 5: 123inkjets.com * 6: 123lasertoner.com * 7: 411inkjets.com * 8: 911inkjets.com * 9: amazingofferings.com * 10: communicationadvisor.com * 11: customoffers.com * 12: customoffersmail.com * 13: ebabyloninc.com * 14: etoll.net * 15: freecartridges.com * 16: imagerocket.com * 17: inkjetorder.com * 18: itsimazing.com * 19: mosaicdatasolutions.com * 20: niftyoffer.com * 21: proinkjets.com * 22: rocketmouse.net * 23: yourmailsource.com * 24: zbeta.com * @SPAM/spamsource: 553 SPEWS [1] zaconta, see http://spews.org/ask.cgi?S1467; SPEWS [1] tonerbuys, see http://spews.org/ask.cgi?S1506; 207.178.170/24: 553 SPAM,PINK 207.178.128.0/17 iswest.net AS5033 dedicated spam network - S1467,S2747,S2705,S2657,S786,S1467,SBL9192 2003-07 * SPEWS/spews.org: 553 SPEWS2 [1] zaconta, see http://spews.org/ask.cgi?S1467; SPEWS2 [1] tonerbuys, see http://spews.org/ask.cgi?S1506; 207.178.170/24: 553 SPEWS2 [2] zaconta, see http://spews.org/ask.cgi?S1467 >1and1.com http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&scoring=d&q=1and1.com+abu se&btnG=Search Domain List matching contacts_email of hostmaster(a)1and1.com * 1: 1-asian-sex.com * 2: 1and1.com * 3: ansonline.com * 4: attachs.com * 5: autoperl.com * 6: basix.com * 7: bb4f.info * 8: bloated.org * 9: bonzil.com * 10: clickforhosting.com * 11: college-nudes.net * 12: colomb.org * 13: cyber-cd.com * 14: discreetdvd.com * 15: diveadventurers.com * 16: domymarketing.com * 17: dynawebdesigns.com * 18: e-hostonline.net * 19: e-mazingdeals.com * 20: equestriantherapy.org * 21: equotesonline.com * 22: extremmovies.com * 23: ffa-usa.com * 24: freepussypass.com * 25: ghostbiz.com * 26: globaladvt.com * 27: gun-sales.com * 28: ivee.org * 29: ladygodivanetwork.com * 30: linethai.com * 31: marketingconceptsgroup.com * 32: medicalwebservices.net * 33: metreward.com * 34: micacy.com * 35: michigan-business.com * 36: myhouselist.com * 37: myproemail.com * 38: nastiest-teens.com * 39: njmovietime.com * 40: onlinehome-server.com * 41: onlinehome.us * 42: propappr-alachua-fl.org * 43: softwarepark-goa.org * 44: something-else.org * 45: speedyvalues.com * 46: systechintegration.com * 47: theinfoman.com * 48: uptimesoftware.com * 49: wonderfulldeals.com > >Gotomypc.com sells a remote access product >Yale.edu is the domain for Yale University http://spews.org/html/S2611.html Domain List matching spews of S2611 * 1: ca.us * 2: expertcity.com * 3: gotomypc.com * 4: internap.com * 5: pcmag-direct.com * 6: pnap.net * 7: spamlaws.com * 8: twtelecom.net * 9: wd10.com * 10: wd12.com * 11: whew.com * 12: worldatamail.com Results: Positive=5, Negative=25 (2004-09-07 15:44:25 UTC) * @ISP/blackholes.us: 66.151/16: 553 ISP INTERNAP - http://hatcheck.org/google?internap; http://hatcheck.org/sbl?internap [Blockparade] * @SPAM/spamsource: 66.151.158/24: 553 SPEWS [1] expertcity/gotomypc, see http://spews.org/ask.cgi?S2611; 66.151/16: 553 SPAM,PINK,BLOCK 66.150/16 66.151/16 66.151 66.151.44.151 joe4257769(a)mailgeorgebush.net INTERNAP 2003-04 * DRBL/drbl.all: 66.151/16: 553 DRBL weight: 0.6; vote.drbl.vimas.kiev.ua(a)ns.vimas.kiev.ua/0.6 * SPEWS/spews.org: 66.151.158/24: 553 SPEWS2 [1] expertcity/gotomypc, see http://spews.org/ask.cgi?S2611 * FIVETEN/internap.com.spam-support: added 2002-07-07; spam support - hosting sendoutmail.com and jdrmedia.com; added 2003-07-22; spam support - hosting e-i1.com spamming from NET-63-251-54-64-1; added 2003-07-02; spam support - hosting http://www.adaniexports.com on 63.251.163.110; added 2004-03-08; spam support - see http://www.spamhaus.org/SBL/sbl.lasso?query=SBL14734; added 2004-07-31; spam support - see http://www.spamhaus.org/SBL/sbl.lasso?query=SBL10031; added 2004-07-31; spam support - transit for AS30038 whose entire 69.63.160.0/20 is on the SBL; added 2003-01-15; spam support - see http://www.spamhaus.org/sbl/listings.lasso?isp=internap.com; added 2003-05-20; spam support - hosting http://www.pr0debtc0nsu1tants.com on 64.74.96.230, was on 63.251.163.110, was on verio; added 2002-01-22; on sprint.net; added 2002-10-07; spam support - hosting netflip.com; added 2003-02-04; spam support - transit for AS18633; added 2003-04-13; spam support - transit for wholesalebandwidth; added 2002-12-07; spam support - dns service for columbiahouse.com; added 2002-09-17; spam support - see http://spews.org/html/S373.html; added 2002-09-10; spam support - hosting randbad.com on 209.191.175.226; added 2002-07-22; spam support - hosting internetseer.com and roving.com I would love a copy of all the reported FPs. Perhaps they should be moved to the IC list? --Chris

3 5

Need help checking FP list from Theo
by Jeff Chan 08 Sep '04

08 Sep '04

Theo got us a list of 112 new false positives from across all SURBLs. He showed me the source messages which are almost all subscribed newsletters and mailing list messages, so they seem quite hammy. Given the type of source messages and some spot checking, I'm inclined to whitelist them all, but I'd like to ask for some help checking them first. Can anyone help check these? 123inkjets.com 1and1.com 1sound.com 4d.com 65.17.207.40 69.50.139.61 8k.com aaronsw.com achtungachtung.com activatormail.com addictivetechnologies.net aec.at agnitum.com aladdinsys.com amnesty-volunteer.org ampcast.com apple.ru atstake.com barebones.com bbspot.com bis1bp.com bridgingthegapforhealthcare.org classesusa.com clearcredit.com commonwealthclub.org conceptdraw.com crime-research.org ctsg.com default-homepage-network.com design-tools.com dontspyon.us drbott.com drivesavers.com drorshalev.com duckland.org ecsirt.net faithfulamerica.org fetchsoftworks.com fipr.org firearmsandliberty.com firepaige.org firewiredirect.com flingstone.com forest.net geoffmetcalf.com globat.com gotomypc.com guninski.com hasbrouck.org hiramoto.org hnc3k.com imgfarm.com imrsvcs.com inderjeetsodhi.com joegratz.net karelia.com lacie.com lacipeterson.com m-w.com macsales.com mail15.com maliasoft.com moveon.org mutemail.com mysurvey.com navi.cx news-miner.com ourfuture.org oxsemi.com passthison.com pcpitstop.com pivx.com pivxlabs.com popmoney.net port5.com postarmor.com prosoftengineering.com qwik-fix.net ravantivirus.com redhawk.org redlers.com reunion.com safecenter.net salary.com saturnevents.com secnetops.biz secnetops.com seti.org smalldog.com snopes.com soundclick.com spywareinfo.com tex-edit.com the-livingstons.org tidbits.com tu-cottbus.de ukclimbing.com umbrella.name uophx.edu uoregon.edu userfriendly.org vechtwijk.nl virtual.net virusall.com westdam.com wiebetech.com wireless-starter-kit.com wlug.org worldwidemart.com wpi.edu wsacorp.com yale.edu Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

7 25

Numerous FPs
by Ryan Thompson 07 Sep '04

07 Sep '04

Reposting, for those not following the original thread. I found the following FPs in WS in a large recent ham corpus. I suggest whitelisting all of these. buckeye-express.com -- Used in a personal email address, looks legit; 7 examples nm.ru -- Used in a personal email address, looks legit advanstar.com -- Legit uses; found in a well-known dental newsletter; also personal email address of one of the editors; 3 messages 00fun.com -- Confirmed, more than one user on our system sent or received eCards from them northstarconferences.com -- Legit conference host site subscribed to by two users; 9 messages in this corpus mardox.com -- Search engine; registered 1875 days ago, and *looks* like the user did actually submit their site to them. postsnet.com -- Registered exactly one year ago, 51 NANAS, blank home page, ehh... but I have 4 different legit newsletters with links to them. webspawner.com -- Created in 1996; free host/email npdor.com -- Surveys; been around since 1999. 103 NANAS, but they've been advertised by some reputable "word of the day" mailers (dictionary.com) Maybe a good candidate for UC. :-) 2 examples imninc.com -- Domain is 507 days old; they do newsletters. At least one of them is legit. :-) worldhealth.net -- It's 3468 days old today (1995). One of our users attended a conference of theirs, and signed up for a newsletter. hoteldiscounts.com -- 2459 days old (1997), found in actual room booking confirmations for Comfort Inn. - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

5 6

Nonexistent domains
by Ryan Thompson 07 Sep '04

07 Sep '04

What's the deal with nonexistent domains? I've been seeing more of these in my corpora. They don't look like typos. Are spammers making up names, or are they registering domains and having them deleted later (either by their choice, or the registrars'?) Should we even consider listing them, or is poisoning not-yet-registered domains too much of a risk? Here's an example mail. In this case, the other domain in the email, "netdreamwatches.com", is already in many SURBLs, but "netdreamwatches4.com" does not exist. My thought is *not* to list the NX'ers if there's another existing domain in the mail fit for SURBL. ------------------------------------------------------------------------- Received: from 250.93.180.0 by 82.181.73.98; Sat, 04 Sep 2004 21:06:45 -0500 Message-ID: <COYELLCYZAXZCUMLBQUNZDMH(a)hotmail.com> From: "Everett Dooley" <sexdw(a)yahoo.com> Reply-To: "Everett Dooley" <sexdw(a)yahoo.com> To: private(a)email.com Subject: Order now for free shipping on all watches! Date: Sat, 04 Sep 2004 20:09:45 -0600 X-Mailer: AOL 9.0 for Windows US sub 022 MIME-Version: 1.0 Content-Type: text/plain; boundary="--80228313128822712" X-Priority: 3 X-MSMail-Priority: Normal X-IP: 99.152.240.119 hey there!, Great deals on imitation rolex and etc.... go to http://www.netdreamwatches.com for more info kind regards Everett Dooley get out of this sessions http://dreamwatches4.com/beout.asp -------------------------------------------------------------------------- - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

3 2

RE: [SURBL-Discuss] Numerous FPs
by Chris Santerre 07 Sep '04

07 Sep '04

Some info: Domain List matching contacts_email of can_craft(a)yahoo.com * 1: a2zsol.com * 2: bannerscape.com * 3: db-hosting.com * 4: global-submit.com * 5: mardox.com <-- * 6: safe-mail.com * 7: safemaildeluxe.com Domain List matching contacts_email of hostmaster(a)hotels.com * 1: 180096hotel.com * 2: 8002hotels.com * 3: hoteldiscounts.com <-- * 4: hotelresnetwork.com * 5: vegashotel.com Not sure if that helps to decide on those 2. But can't hurt to have the info :) --Chris

2 1

RE: [SURBL-Discuss] Need help checking FP list from Theo
by Chris Santerre 07 Sep '04

07 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, September 07, 2004 4:54 AM >To: SURBL Discussion list >Cc: postmaster(a)outblaze.com >Subject: Re: [SURBL-Discuss] Need help checking FP list from Theo > > >On Monday, September 6, 2004, 11:10:50 PM, Ryan Thompson wrote: > >> bis1bp.com FP: Hmm... Domain doesn't resolve thanks >to their not >> being any authoritative nameservers. >> It's 87 days old. If this was really >found in ham, >> I'd say de-list. > >I found this one in the original message and it's part of a >security mailing list mention of a phishing site. Removing >from whitelist. > > http://seclists.org/lists/bugtraq/2004/Jun/0268.html > >It no longer resolves but should be fine to block on IMO. > >Jeff C. Dang it, I replied to a piece of this thread out of order :) I'll try to reply to all of them now... I am +1 for whitelisting .edu. Heck I'm borderline skiplisting them in the hard code. Once we get these all settled, I'd like to find how they all got in here in the first place! seti.org being listed put up red flags for me! Who put that in here? Even if it was me, I should be flogged! Hold on to your chairs, but I agree with Jeff! :) Cleanup is great, but how do things like yale and seti get listed in the first place???? -_Chris

3 2

RE: ANNOUNCE: Top SURBL DNS queries and whitelist hits
by Chris Santerre 07 Sep '04

07 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, September 06, 2004 9:55 PM >To: SURBL Announce; SpamAssassin Users >Subject: ANNOUNCE: Top SURBL DNS queries and whitelist hits > > >We've made a list of the top SURBL DNS queries into my name server: > > http://www.surbl.org/dns-queries.counts.txt > >and a version with only whitelist hits: > > http://www.surbl.org/dns-queries.whitelist.counts.txt > >The sample size is somewhat small at 32k queries over the last 48 >trailing hours, but it's still somewhat interesting. Specifically >2000 queries are sampled every 3 hours. (Please ignore some of >the junk at the end of the unwhitelisted counts. That's stuff >left over from DNS packets which I haven't cleaned out yet.) > >I'm slightly surprised how high in the total rankings some spam >domains are. That represents a huge amount of spam sent and >blocked. :-) > Would it be possible to hard code a "SKIP" for certain URLs? 175 yahoo.com 157 w3.org 87 msn.com 77 flowgo.com Why have the code even bother to check those? Sort of like a permanent hard coded Whitelist. (Bah, Skiplist! I have to stop calling it a whitelist!) This would save traffic. Just a thought. --Chris

5 5

Re: Need help checking FP list from Theo
by Alden Levy 07 Sep '04

07 Sep '04

>Date: Tue, 7 Sep 2004 11:50:50 -0400 >From: Chris Santerre <csanterre(a)merchantsoverseas.com> >Subject: RE: [SURBL-Discuss] Re: Need help checking FP list from Theo >To: "'SURBL Discussion list'" <discuss(a)lists.surbl.org> >Message-ID: <620A4FF9B83DD511B69900062939D037AC015E(a)internal.merchantsoverseas.com> >OK, you asked for it ;) >Some of this info will give you a 'feel' for who the hosts operate. >>>Theo got us a list of 112 new false positives >from across all >>>SURBLs. He showed me the source >messages which are almost >>>all subscribed newsletters and mailing list >messages, so they >>>seem quite hammy. >> >>>Given the type of source messages and some >spot checking, I'm >>>inclined to whitelist them all, but I'd like to >ask for some help >>>checking them first. Can anyone help check >these? >> >>123inkjets.com > >Oh, these guys are on my personal poop list! > >http://groups.google.com/groups?q=123inkjets.com+abuse&hl=en&lr=&ie=UTF-8&s a >=G&scoring=d > >Domain List matching cluster of russ-effrig > > * 1: 007inkjets.com <snip> > * 24: zbeta.com > > * @SPAM/spamsource: 553 SPEWS [1] zaconta, see >http://spews.org/ask.cgi?S1467; > SPEWS [1] tonerbuys, see http://spews.org/ask.cgi?S1506; > 207.178.170/24: 553 SPAM,PINK 207.178.128.0/17 iswest.net AS5033 >dedicated spam network - S1467,S2747,S2705,S2657,S786,S1467,SBL9192 2003-07 > * SPEWS/spews.org: 553 SPEWS2 [1] zaconta, see >http://spews.org/ask.cgi?S1467; > SPEWS2 [1] tonerbuys, see http://spews.org/ask.cgi?S1506; > 207.178.170/24: 553 SPEWS2 [2] zaconta, see >http://spews.org/ask.cgi?S1467 > >>1and1.com >http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&scoring=d&q=1and1.com+ab u >se&btnG=Search > >Domain List matching contacts_email of hostmaster(a)1and1.com > > * 1: 1-asian-sex.com > * 2: 1and1.com <snip> > * 49: wonderfulldeals.com >> >>Gotomypc.com sells a remote access product >>Yale.edu is the domain for Yale University > >http://spews.org/html/S2611.html > >Domain List matching spews of S2611 > > * 1: ca.us <snip> > * 12: worldatamail.com > Results: Positive=5, Negative=25 (2004-09-07 15:44:25 UTC) > > * @ISP/blackholes.us: 66.151/16: 553 ISP INTERNAP - >http://hatcheck.org/google?internap; http://hatcheck.org/sbl?internap >[Blockparade] > * @SPAM/spamsource: 66.151.158/24: 553 SPEWS [1] expertcity/gotomypc, >see http://spews.org/ask.cgi?S2611; > 66.151/16: 553 SPAM,PINK,BLOCK 66.150/16 66.151/16 66.151 >66.151.44.151 joe4257769(a)mailgeorgebush.net INTERNAP 2003-04 > * DRBL/drbl.all: 66.151/16: 553 DRBL weight: 0.6; > vote.drbl.vimas.kiev.ua(a)ns.vimas.kiev.ua/0.6 > * SPEWS/spews.org: 66.151.158/24: 553 SPEWS2 [1] expertcity/gotomypc, >see http://spews.org/ask.cgi?S2611 > * FIVETEN/internap.com.spam-support: added 2002-07-07; > spam support - hosting sendoutmail.com and jdrmedia.com; added >2003-07-22; > spam support - hosting e-i1.com spamming from NET-63-251-54-64-1; >added 2003-07-02; > spam support - hosting http://www.adaniexports.com on 63.251.163.110; >added 2004-03-08; > spam support - see >http://www.spamhaus.org/SBL/sbl.lasso?query=SBL14734; added 2004-07-31; > spam support - see >http://www.spamhaus.org/SBL/sbl.lasso?query=SBL10031; added 2004-07-31; > spam support - transit for AS30038 whose entire 69.63.160.0/20 is on >the SBL; > added 2003-01-15; > spam support - see >http://www.spamhaus.org/sbl/listings.lasso?isp=internap.com; > added 2003-05-20; > spam support - hosting http://www.pr0debtc0nsu1tants.com on >64.74.96.230, was on 63.251.163.110, was on verio; > added 2002-01-22; on sprint.net; added 2002-10-07; spam support - >hosting netflip.com; > added 2003-02-04; spam support - transit for AS18633; added >2003-04-13; > spam support - transit for wholesalebandwidth; added 2002-12-07; > spam support - dns service for columbiahouse.com; added 2002-09-17; > spam support - see http://spews.org/html/S373.html; added 2002-09-10; > spam support - hosting randbad.com on 209.191.175.226; added >2002-07-22; > spam support - hosting internetseer.com and roving.com >I would love a copy of all the reported FPs. Perhaps they should be moved to >the IC list? >--Chris Chris, I agree that these (with the exception of yale.edu) should be moved to the IC list. Unfortunately, since these companies DO have SOME (ONE?) legitimate function, we can't blacklist them here. Of course, I wouldn't object if they were! --Alden

1 0

RE: [SURBL-Discuss] Open Redirector
by Chris Santerre 07 Sep '04

07 Sep '04

>-----Original Message----- >From: Leonardo Helman [mailto:surbl@lists.com.ar] >Sent: Monday, September 06, 2004 2:17 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Open Redirector > > >I'll sent it. > >I've translated that document to spanish. > >Here is the translation. >--------------------------------------------------------------- I know it has already been said, but Thank You! Little things like this mean a lot! Thanks for taking the time to translate and send!! --Chris

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss