http://permalink.gmane.org/gmane.mail.spam.rbl.surbl hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5775 <pre> Is the concern that I'm publishing the list as opposed to requiring a specific query to answer? My intent has been to share abuse data among sites running my source code (potentially, after considering reputation issues), since I don't want to run a DNS lookup service for all my code users or be a central point of failure with the abuse data. I don't feel I'm being particularly revealing here since I'm not disclosing how I end up deciding those IPs and those domains are abusive. But,... my code all gets released as Open Source, so that too, will become publicly available knowledge soon. Since I started collecting instead of ignoring this data about 20 hours ago, the number of base domains involved in the abuse has only gone up to 246, only a few more than where it had been last night. The number of IP addresses involved in this (bot) abuse continues to rise. It's at 6932 right now. It will be around 6945 by the time this message gets distributed by the mailing list. - Ron </pre> Ron Guerin 2012-03-23T21:32:42 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5774 <pre> Hi Ron, Thanks for some interesting research. One thing we might caution about is forming an unintentional feedback loop with abusers. If abuse information is provided publically then it can be used by the attackers to improve their attacks. We don't know that it's happening in this case, but it's something to be aware of. </pre> SURBL Whitelisters 2012-03-23T09:47:28 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5773 <pre>I am making this available in the event it is interesting or useful to someone. It is a really rough first effort, and I expect to do something more useful with it as time goes on. With the caveat that this should be considered "experimental data", I have finally begun to publish some abuse data. This data is presently re-generated hourly. http://tighturl.com/tighturl-abuse-ips.csv http://tighturl.com/tighturl-abuse-domains.csv The IP addresses are those that have submitted URLs that have been banned at tighturl.com within the last 7 days. They are in the format: unixtimestamp,IPv4address The domains are base domains[1] that have been banned from tighturl.com or have been submitted by currently banned IP addresses within the last 7 days. They are in the format: unixtimestamp,basedomain I have not found over time that an IP address that submits abuse also submits non-abuse. I'm interested in comments or suggestions. - Ron [1] Based upon http://www.surbl.org/tld/two-level-tlds and http://www.su</pre> Ron Guerin 2012-03-23T01:20:54 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5772 <pre>Hai! Please do. I will also post a message on the zones list about it. Thanks, Raymond Dijkxhoorn, Prolocation Op 12 feb. 2012 om 18:16 heeft Paul Freeman &lt;paul&lt; at &gt;noc4.net&gt; het volgende geschreven: </pre> Raymond Dijkxhoorn 2012-02-17T08:04:46 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5771 <pre> </pre> Paul Freeman 2012-02-12T17:16:09 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5770 <pre> [snip..] Jeff, Thanks. I'm in the testing/deploying stage now. Probably going live next week, will take you up on your offer then. Just wanted to know if anybody else had tried this and what landmines were out there. Dave </pre> Dave Funk 2012-02-12T07:43:09 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5769 <pre> Hi Dave, SURBL has nameservers running on IPv6 addresses. If you'd like to provide DNS service over v6, I think we an add your servers to the delegations for that. SURBL does not currently blacklist IPv6 addresses, but it may in future. Cheers, Jeff C. </pre> Jeff Chan 2012-02-12T06:20:26 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5768 <pre>Anybody have experience running rbldnsd (serving surbl zones) on IPv6 addresses? Clearly the data -in- the zones are IPv4 values but the servers can communicate using IPv6 addresses. I'm in the process of a general config refresh &amp; IPv6 deployment and noticed that the surbl dns servers lists that my copies are in (a.surb.org &amp; b.surbl.org) only contain IPv4 addrs (A records), no AAAA records. So is this just inertial or is there a reason for not listing IPv6 addrs for rbldnsd servers? I did a local test with rbldnsd-0.996b on SLES11-SP1 and it seems to run/answer on IPv6 just fine. Dave </pre> Dave Funk 2012-02-11T23:17:25 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5767 <pre> On 2011-08-31, at 3:24 AM, Raymond Dijkxhoorn wrote: My, what a dirty company! http://www.mywot.com/en/scorecard/aldaniti.net Warning! This site has a poor reputation. Trustworthiness 12 Very poor Vendor reliability 11 Very poor Privacy 10 Very poor Child Safety 11 Very poor Information from third-party trusted sources Third-party trusted sources provide additional information from numerous phishing and malware blacklists, and other trusted sources from the web. DateSourceComment 07/21/2011SpamCopAppeared on an automatically composed list of spamvertised websites. Total comment votes, by user chosen categories: Good site 3 Spam 7 Annoying ads or popups 2 Bad customer experience 1 Phishing or other scams 49 Malicious content, viruses 6 Ethical issues 2 Useless 4 Other 1 -- Neil Schwartzman Executive Director CAUCE : The Coalition Against Unsolicited Commercial Email http://cauce.org http://twitter.com/cauce IM: caucecanada Tel.: +1 (303) 800 6345 </pre> Neil Schwartzman 2011-08-31T09:54:11 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5766 <pre>Dear 'Aldaniti Team', Yes. And further to this, removal requests will not be handled on this list. In your case this will be good for you since you dont want all the dirt on a publicly archived mailinglist. Google your company name in the combination of spam and scam and you will have a slight idea why. We wont answer more in detail to your request. You should handle this via whitelist&lt; at &gt; Bye, Raymond. </pre> Raymond Dijkxhoorn 2011-08-31T07:24:45 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5765 <pre>Hi, We've just submitted a removal request for our domain aldaniti.net using lookup page in surbl.com. We send an email with all the information about our company and we explain that we do e-mail marketing actively for those who previously agreed and accepted to receive this kind of e-mail. But our domain is still in the blacklist. Is there anyway to know why are we being listed in ws.surbl.org blacklist? How long will it take for our domain to be removed from the list? In case we will be delisted, will there be any email notification? Regards, Aldaniti Team. </pre> Informes 2011-08-31T07:17:27 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5764 <pre>Many thanks Factory Furniture Ltd - specialist street furniture designers and manufacturers with in-house production facilities. FSC Chain of custody certification No.CU-COC-806405. The information in this e-mail and any attachments is confidential and is intended for the addressee only. Unless stated to the contrary, any opinions or comments are personal to the writer and do not represent the official view of Factory Furniture Ltd -----Original Message----- From: SURBL whitelisters [mailto:whitelist&lt; at &gt;surbl.org] Sent: 25 August 2011 14:53 To: discuss&lt; at &gt;lists.surbl.org Subject: Re: [SURBL-Discuss] help please Design Office wrote: Hello Dean, You're using a listed domain in your footer. You probably wanted to use http://www.fsc-uk.org/, an actual FSC site. Regards, SURBL _______________________________________________ Discuss mailing list Discuss&lt; at &gt;lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss </pre> Factory Furniture 2011-08-25T13:58:46 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5763 <pre> Hello Dean, You're using a listed domain in your footer. You probably wanted to use http://www.fsc-uk.org/, an actual FSC site. Regards, SURBL </pre> SURBL whitelisters 2011-08-25T13:53:04 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5762 <pre>Many thanks FACTORY FURNITURE The Stableyard, Coleshill Swindon SN6 7PT Tel: +44 (0) 1793 763829 Fax: +44 (0) 1793 861615 sales&lt; at &gt;factoryfurniture.co.uk www.factoryfurniture.co.uk Factory Furniture Ltd - specialist street furniture designers and manufacturers with in-house production facilities. FSC Chain of custody certification No.CU-COC-806405. For further information on Forestry Stewardship Council certified timbers http://www.fsc-uk.info/ The information in this e-mail and any attachments is confidential and is intended for the addressee only. Unless stated to the contrary, any opinions or comments are personal to the writer and do not represent the official view of Factory Furniture Ltd -----Original Message----- From: Neil Schwartzman [mailto:neil&lt; at &gt;cauce.org] Sent: 25 August 2011 13:43 To: SURBL Discussion list Subject: Re: [SURBL-Discuss] help please .fsc-uk.info/ On 2011-08-25, at 8:28 AM, Design Office wrote: Suggestions? Yeah. Go to SURBL.org, look up your domains and request a deli</pre> Factory Furniture 2011-08-25T13:01:00 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5761 <pre>.fsc-uk.info/ On 2011-08-25, at 8:28 AM, Design Office wrote: Suggestions? Yeah. Go to SURBL.org, look up your domains and request a delisting. One of them is on the WS (website) blacklist. As far as I can tell, the listing is erroneous, but I'm certain SURBL has more information that I do in that regard. -- Neil Schwartzman Executive Director CAUCE : The Coalition Against Unsolicited Commercial Email http://cauce.org http://twitter.com/cauce IM: caucecanada Tel.: +1 (303) 800 6345 </pre> Neil Schwartzman 2011-08-25T12:42:43 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5760 <pre>I am getting this message from a few recipients X-Supplementary-Info: &lt; c2bthomr14.btconnect.com #5.2.0 SMTP; 550 5.7.1 Rejected - listed at SURBL/CURBL&gt; any suggestions!! Dean Harvey Factory Furniture Ltd - specialist street furniture designers and manufacturers with in-house production facilities. FSC Chain of custody certification No.CU-COC-806405. For further information on Forestry Stewardship Council certified timbers http://www.fsc-uk.info/ The information in this e-mail and any attachments is confidential and is intended for the addressee only. Unless stated to the contrary, any opinions or comments are personal to the writer and do not represent the official view of Factory Furniture Ltd </pre> Design Office 2011-08-25T12:28:34 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5759 <pre>Hi Sam, Not that i know of. But it would be a good startingpoint i guess to just copy functionality of the BIT.LY API. Thats used in multiple places i know so easier to adopt elsewhere. Bye, Raymond. </pre> Raymond Dijkxhoorn 2011-08-04T08:13:32 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5758 <pre>I meant if the redirector returned a 404, I.E. the short link doesn't exist. And we do provide an API but I assume I would have to set up something special for this. Are there any guidelines to doing this? -Sam On 4 Aug 2011 08:30, "Raymond Dijkxhoorn" &lt;raymond&lt; at &gt;prolocation.net&gt; wrote: Hi! SURBL does check the links before sending. A good thing would be to provide a API 'like the big redirectors alleady do' where we can check things on. BIT.LY for example has a API we use for checking if a link is available or not. Exactly. A 404 doesnt tell much. In fact. To make this more specific. There are botnets that give a 404 or alike codes if you are outside the US. So they can target specific audience. Those codes cant be really trusted in cases like this. Remember, if you get reports of abuse, in 99.9% of the times there is something going on. You can ignore them and think you are ok. Most of the times thats whishfull thinking however. Bye, Raymond. _______________________________________________ Discus</pre> Sam Rudge 2011-08-04T07:39:23 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5757 <pre>Hi! SURBL does check the links before sending. A good thing would be to provide a API 'like the big redirectors alleady do' where we can check things on. BIT.LY for example has a API we use for checking if a link is available or not. Exactly. A 404 doesnt tell much. In fact. To make this more specific. There are botnets that give a 404 or alike codes if you are outside the US. So they can target specific audience. Those codes cant be really trusted in cases like this. Remember, if you get reports of abuse, in 99.9% of the times there is something going on. You can ignore them and think you are ok. Most of the times thats whishfull thinking however. Bye, Raymond. </pre> Raymond Dijkxhoorn 2011-08-04T07:29:56 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5756 <pre>I agree, the systems should check the shortener link to see if it returns 30{1,2} or 40x. Unfortunately our web-host thinks the alerts are an issue (they disabled the site for a while until I'd discussed the situation with them). So there is no way to disable/prevent these alerts? I don't see any way we can prevent spammers putting links to our shortener in emails other than stop the links from working, which we're doing. =( -Sam On 4 Aug 2011 00:55, "Dave Warren" &lt;lists&lt; at &gt;hireahit.com&gt; wrote: On 8/3/2011 3:33 PM, Ron Guerin wrote: This makes sense, given the lack of attention to detail spammers put into their craft in general. Perhaps it would be worthwhile if SURBL's (and others') processes included checking pages for 400 error codes before sending (automated?) abuse reports? _______________________________________________ Discuss mailing list Discuss&lt; at &gt;lists.surbl.org http... </pre> Sam Rudge 2011-08-04T07:20:27 http://permalink.gmane.org/gmane.mail.spam.rbl.surbl/5755 <pre> It's probably safer to use a text browser like curl. Be sure to set the user-agent to something workstation like. </pre> SURBL Whitelisters 2011-08-04T07:07:20 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.mail.spam.rbl.surbl