Subject: [Asrg] SURBL and newer URL's + is ASRG shuting down ?

From: "Kurt Magnusson" <[email-masked]>
Date: Wed, 17 Nov 2004 17:46:37 -0300

In may last year I put up an proposal for a spam method, using the fact that 
spam is a business proposal from the sender, therefore having to provide a 
communication method for the "customer", generally a phone no or a URL. The 
method, that I called Earnest, because I look for real info in the spams, 
got some critisism for that the blacklist over Ph.no's and URL's to find the 
spams, could be tainted.

I have now for 1.5 year been running a PoC, with generally very good 
results, using a simple shellscript with some grep lines. The blacklist, 
built using spams that got through and Spamarchive.org repositories, held up 
fine to the present Rolex/Viagra campaines. Before the Rolex explosion, I 
had an average of 2-3 spams in of ca 35 a day over the 1.5 years. To cope 
with Rolex, I added SURBL DNS list to the PoC, which thankfully decreased 
the post-Rolex hits from 20-30 in of 40-50 spams a day to 6-8 passing in.

SURBL has become a good tool, but it still have a turnaround of a couple of 
hours before a URL domain is in the DNS, for in my tests of SURBL, it later 
correctly has identified the spams that got in. I want to decrease the 
turnaround time, from when I can identify them.

Does anyone know of a spamlist/webpage using multiple independent honeypots, 
comparing spams and identifying them by the multiplicity of mails with the 
same contact info, then presenting data realtime, so one can use it to 
extract domains for blocking? It is OK if it is full mails, just that I can 
generate temp blocklists, until SURBL publish the domains.

Then the list has been rather low-volume the last 1.5 month, at least at the 
IETF web where I read it, is the group dying out, giving up?

Kurt Magnusson

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Frank Ellermann <[email-masked]>
Date: Thu, 18 Nov 2004 17:54:01 +0100

Kurt Magnusson wrote:

> is the group dying out, giving up?

The IETF closed MARID without prior consultation with the WG,
they offer RfC 3865.  Maybe you forgot to implement RfC 3865.

Accelerating SURBL is discussed on the SURBL list, you find
it on <http://news.gmane.org/group/gmane.mail.spam.rbl.surbl/>

Each "FUSSP" has its own mailing list, that's a feature because
the spammers never find out what anti-spammers try next (except
from shooting in their own feet and deleting mails with random
devices. ;-)  "R*lex" is a new synonym of "Vi*gr*", test "JHD".

Joke off, there was a new ASRG draft less than three days ago:
http://www.ietf.org/internet-drafts/draft-irtf-asrg-dnsbl-01.txt

                      Bye, Frank