Never getting URIBL_PH_SURBL hits

[Jeff A. Earickson]

Hmmm, I've noticed that we have started getting hits against
URIBL_PH_SURBL in the last few days with our Solaris 9 setup.
Haven't changed much, except for the new anti-phishing version
of Message.pm.  I saw the hits before this change.

Jeff Earickson
Colby College

On Mon, 15 Nov 2004, Quentin Campbell wrote:

> Date: Mon, 15 Nov 2004 07:47:02 -0000
> From: Quentin Campbell <Q.G.Campbell at NEWCASTLE.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Never getting URIBL_PH_SURBL hits
>
>> -----Original Message-----
>> From: MailScanner mailing list
>> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Julian Field
>> Sent: 12 November 2004 14:11
>> To: MAILSCANNER at JISCMAIL.AC.UK
>> Subject: Re: Never getting URIBL_PH_SURBL hits
>>
>> I've only got 1 non-Solaris MX and that doesn't handle huge
>> amounts of mail.
>> But no URIBL_PH_SURBL on there either.
>>
>> Maybe it is just a geographic thing. Sure glad I wrote my
>> "phishing net"
>> code though!
>>
> [snip]
>
> This is another UK.AC site but we have seen 130 URIBL_PH_SURBL hits in
> the last 3.5 hours this morning.
>
> These were all logged on the seven RH AS 3 mail gateways we operate.
> They together handle about 1,000,000 messages/day for individual users.
>
> It is worth pointing out as a comparison that on two other identically
> configured RH AS 3 mail gateways we operate to filter e-mail for another
> university plus three small colleges (all in AC.UK), I have seen just 4
> URIBL_PH_SURBL hits in the same period. The volume of mail handled in
> these cases is significantly less than the figure given above.
>
> Rather than being "geographical", it seems that the incidence of
> phishing spam is related to the domain(s) you host and the volume of
> mail you receive.
>
> Quentin
> ---
> PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>                           University of Newcastle,
>                           Newcastle upon Tyne,
> FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
> ------------------------------------------------------------------------
> "Any opinion expressed above is mine. The University can get its own."
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!