From: Curt Hibbs Date: 2004-10-26T12:10:22+09:00 Subject: Re: [SOLUTION] RubyGarden Spam - One step to Solution There's a lot of good information in your response. Thanks for taking the time to write it up. There was quite a bit here that I didn't know. Curt David Ross wrote: > > trans. (T. Onoma) wrote: > > >On Monday 25 October 2004 08:50 pm, David Ross wrote: > >| Chad Fowler wrote: > >| >On Tue, 26 Oct 2004 04:56:53 +0900, David Ross > wrote: > >| >>You *can* integrate this into wiki's. Its very easy. Okay thanks, 80% > >| >>spamming solved. > >| >>Most, if not ALL the ips listed in > >| >>http://www.istori.com/cgi-bin/wiki?WikiBlackList *ARE* in the RBLs > >| > > >| >We have been. For months. > >| > > >| >>Thanks, have a nice day. Problem solved > >| > > >| >Unfortunately not. > >| > >| First Rubygarden Spam email > >| ----------------------------------------- > >| The rubygarden wiki has been over-run with spam links. > >| > >| 220.163.37.233 is one of the offending source IP addresss. > >| > >| I fixed the home page, and then saw the extent of the crap. Looks like > >| many personal pages have been altered. > >| > >| Those with user pages may want to go check their own page to > assist with > >| the clean up. > >| > >| James > >| > >| ----------------------------------------- > >| > >| ------------------------------------- > >| > >| I've got a list, but it has become obvious that maintaining a list > >| manually isn't going to work. I'm tempted to require registration and > >| authentication at this point as much as I hate the thought. > >| > >| Chad > >| > >| > >| ------------------------------------- > >| > >| http://rbls.org/?q=220.163.37.233 > >| > >| You're not reading the email.. > >| > >| Thanks for lying, its listed since June 2003 > >| > >| No, problem is 80% solved. There are some actual unlogged IPs. Please > >| educate yourself in security, you obviously aren't qualified. > > > >Umm... why not try to educate rather then accuse. I for one > would certainly > >like to know that in the hell you're talking about, but you're > not explaining > >yourself very well. > > > >T. > > > > > > > > > > > :) Well as you notied in the past I have a habit of writing really short > replies that make my emails sound inappropriate. > > /me breaths, "Ok lets start" > > An RBL is Realtime Blackhole List. These lists are held on servers which > can be accessed by anyone. All you do is send a query to the server and > it replies with a special response in the format of "127.0.0. code>" One big RBL project is SORBS, located at > http://www.dnsbl.sorbs.net/. The project has a nice selection of servers > to pick from which are lists for different reasons. I use so many in my > servers because each one has different IPs and strengths. These RBLs are > not just for mail servers, they list different types of abusers. These > RBLs are be used in any type of network application for the use of > blocking who abuse the internet. The internet is a very insecure place > where anyone could abuse it very much if they have the knowledge. I'm > blessed to have been on computers for over 20 years :) Commodore++ > > Okay now to explain the reponses you get from the RBL servers > 127.0.0.2 - Open Relay > 127.0.0.3 - Open Proxy > 127.0.0.4 - Spam Source > 127.0.0.5 - Provisional Spam Source Listing block (will be removed if > spam stops) > 127.0.0.6 - Formmail Spam > 127.0.0.7 - Spam Supporter > 127.0.0.8 - Spam Supporter (indirect) > 127.0.0.9 - End User (non mail system) > 127.0.0.10 - Shoot On Sight > 127.0.0.11 - Non-RFC Compliant (missing postmaster or abuse) > 127.0.0.12 - Does not properly handle 5xx errors > 127.0.0.13 - Other Non-RFC Compliant > 127.0.0.14 - Compromised System - DDoS > 127.0.0.15 - Compromised System - Relay > 127.0.0.16 - Compromised System - Autorooter/Scanner > 127.0.0.17 - Compromised System - Worm or mass mailing virus > 127.0.0.18 - Compromised System - Other virus > 127.0.0.127 - Other > > These reponse names differ on RBL servers, but mean the exact same. You > can get more reponse information on different servers from > http://www.aspnetmime.com/dnsbl.aspx > > > Heres another type of list and a "howitworks" > http://dsbl.org/howitworks > > People can send in form data to specify if the target is bad. I don't > use the /unconfirmed.dsbl.org/. I use the list.dsbl.org and > /multihop.dsbl.org. The target can be tested by very trustful users, > list.dsbl.org and multihop. These are very reliable servers to check. > > These are recognized as good blacklists to use > / > > The IP that did in fact spam RubyGarden @ http://dsbl.org/listing?220.163.37.233 Okay, the evidence where Chad went wrong. The link above is the the IP that spammed RubyGarden, the IP is listed in the singlehop(list.) server . Chad rather didn't read the email, or he lied. Could be because I thought about it first on the mailing list. Others have used RBLs for network services elsewhere. If those specific BLs were implemented it would eliminate over 80% or more of the spam problem. By the way, Thanks T. for asking. I keep getting ahead of myself thinking everyone has the same knoweldge. *My fault* Thanks for being curious, and have a nice day. I might continue this email if I think of any other important information that might help more understand how to use RBL lists. David Ross -- Hazzle free packages for Ruby? RPA is available from http://www.rubyarchive.org/ --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.775 / Virus Database: 522 - Release Date: 10/8/2004