From lars.eggert@nokia.com Tue Aug 2 06:41:56 2011 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29B0921F85E3 for ; Tue, 2 Aug 2011 06:41:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.172 X-Spam-Level: X-Spam-Status: No, score=-104.172 tagged_above=-999 required=5 tests=[AWL=1.316, BAYES_00=-2.599, GB_I_INVITATION=-2, RCVD_IN_DNSWL_LOW=-1, SARE_NETPROD=0.111, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xnAVpRQ9Y7iD for ; Tue, 2 Aug 2011 06:41:55 -0700 (PDT) Received: from mgw-da01.nokia.com (smtp.nokia.com [147.243.128.24]) by ietfa.amsl.com (Postfix) with ESMTP id 1E11621F85CE for ; Tue, 2 Aug 2011 06:41:55 -0700 (PDT) Received: from mail.fit.nokia.com (esdhcp030222.research.nokia.com [172.21.30.222]) by mgw-da01.nokia.com (Switch-3.4.4/Switch-3.4.3) with ESMTP id p72Dg2qn029415 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 2 Aug 2011 16:42:03 +0300 From: Lars Eggert X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.97.2 at fit.nokia.com Content-Type: multipart/signed; boundary="Apple-Mail=_81B9B03A-0161-42E2-90ED-A338ED79DC6D"; protocol="application/pkcs7-signature"; micalg=sha1 Date: Tue, 2 Aug 2011 16:41:55 +0300 Message-Id: <894FD715-659E-4190-9850-F6F16FA140D5@nokia.com> To: asrg@irtf.org Mime-Version: 1.0 (Apple Message framework v1244.3) X-Mailer: Apple Mail (2.1244.3) X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7 (mail.fit.nokia.com); Tue, 02 Aug 2011 16:41:55 +0300 (EEST) X-Nokia-AV: Clean Subject: [Asrg] Call for Nominations: Applied Networking Research Prize (ANRP) for IETF-82 X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: anrp@isoc.org, Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Aug 2011 13:41:56 -0000 --Apple-Mail=_81B9B03A-0161-42E2-90ED-A338ED79DC6D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 CALL FOR NOMINATIONS: APPLIED NETWORKING RESEARCH PRIZE (ANRP) =20 http://irtf.org/anrp *** Submit nominations until August 28 for the ANRP for IETF-82, *** November 13-18, 2011 in Taipei, Taiwan: *** http://fit.nokia.com/anrp/82/ The Applied Networking Research Prize (ANRP) is awarded for recent results in applied networking research that are relevant for transitioning into shipping Internet products and related standardization efforts. Researchers with relevant, recently published results are encouraged to apply for this prize, which will offer them the opportunity to present and discuss their work with the engineers, network operators, policy makers and scientists that participate in the Internet Engineering Task Force (IETF) and its research arm, the Internet Research Task Force (IRTF). Third-party nominations for this prize are also encouraged. The goal of the Applied Networking Research Prize (ANRP) is to recognize the best new ideas in networking, and bring them to the IETF and IRTF especially in cases where they would not otherwise see much exposure or discussion. The Applied Networking Research Prize (ANRP) consists of: * cash prize of $500 (USD) * invited talk at the IRTF Open Meeting * travel grant to attend the week-long IETF meeting (airfare, hotel, registration, stipend) * recognition at the IETF plenary * invitation to related social activities * potential for additional travel grants to future IETF meetings, based on community feedback HOW TO APPLY Only a single person can be nominated based on a peer-reviewed, recently-published, original journal, conference or workshop paper they authored. The nominee must be one of the main authors of the nominated paper. Both self nominations (nominating one=92s own paper) and third-party nominations (nominating someone else=92s paper) are encouraged. The nominated paper should provide a scientific foundation for possible future IETF engineering work or IRTF experimentation, analyze the behavior of Internet protocols in operational deployments or realistic testbeds, make an important contribution to the understanding of Internet scalability, performance, reliability, security or capability, or otherwise be of relevance to ongoing or future IETF or IRTF activities. Applicants must briefly describe how the nominated paper relates to these goals, and are encouraged to describe how presentation of these research results will foster their transition into new IETF engineering or IRTF experimentation, or otherwise seed new activities that will have an impact on the real-world Internet. The goal of the Applied Networking Research Prize (ANRP) is to foster the transitioning of research results into real-world benefits for the Internet. Therefore, applicants must indicate that they (or the nominee, in case of third-party nominations) are available to attend the respective IETF meeting in person and in its entirety. Nominations must include: * the name and email address of the nominee * a reference to the published nominated paper * a PDF copy of the nominated paper * a statement that describes how the nominated paper fulfills the goals of the award * a statement that the nominee is available to attend the respective IETF meeting in person and in its entirety * a brief biography or CV of the nominee * optionally, any other supporting information (link to nominee's web site, etc.) *** Nominations are submitted via the submission site: *** http://fit.nokia.com/anrp/82/ SELECTION PROCESS A small selection committee comprised of individuals knowledgeable about the IRTF, IETF and the broader networking research community will evaluate the submissions against these selection criteria. The goal is to select 1-2 submissions for the Applied Networking Research Prize (ANRP) during each nomination period. All nominees will be notified by email. IMPORTANT DATES Applications open: August 1, 2011 Applications close: August 28, 2011 Notifications: September 20, 2011 IETF-82 Meeting: November 13-18, 2011 in Taipei, Taiwan=20 SPONSORS The Applied Networking Research Prize (ANRP) is supported by the Internet Society (ISOC), as part of its Internet Research Award Programme, in coordination with the Internet Research Task Force (IRTF).= --Apple-Mail=_81B9B03A-0161-42E2-90ED-A338ED79DC6D Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMRjCCBVAw ggQ4oAMCAQICEGxdPUZzCwUJ8KBiJwH+bYgwDQYJKoZIhvcNAQEFBQAwgd0xCzAJBgNVBAYTAlVT MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29y azE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEg KGMpMDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuVmVyaVNpZ24g Q2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHMzAeFw0xMDEwMTUwMDAwMDBaFw0x MTEwMTUyMzU5NTlaMIIBEzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT aWduIFRydXN0IE5ldHdvcmsxRjBEBgNVBAsTPXd3dy52ZXJpc2lnbi5jb20vcmVwb3NpdG9yeS9S UEEgSW5jb3JwLiBieSBSZWYuLExJQUIuTFREKGMpOTgxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZh bGlkYXRlZDEzMDEGA1UECxMqRGlnaXRhbCBJRCBDbGFzcyAxIC0gTmV0c2NhcGUgRnVsbCBTZXJ2 aWNlMRQwEgYDVQQDFAtMYXJzIEVnZ2VydDEkMCIGCSqGSIb3DQEJARYVbGFycy5lZ2dlcnRAbm9r aWEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwolKEyOz/NQZJJlw0x9XBS9W wCmabdY1fXpbWSdcaJiEWhQpRzSIC/pgIwCgaUW9g3JsWioXCawyjUVeg8xR42sR690f4z+OPAUm 3jokZxsuRaGX6fuPkPQomYAGz7htUHws/8FZIU+4dciETQf4vF5ptitJ+QZCVRCTLqisj6mG/kG4 65Op3G5/YZF9F/a390LdhuRP6vdY2Y+dqm8LDa0zmENPpoE98u1pIZGqCcnskN/nNBtEPd+a4lNh ZSGnPuL4XCUSJYR9NB7FAYBvi5N7LSWHR3fspwa5EgpXynJcsLzaLA0iGfjFOBYFxul/07edmyw4 FIXuCIkaMDUfEwIDAQABo4HSMIHPMAkGA1UdEwQCMAAwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcX ATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhMAsGA1UdDwQEAwIF oDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDov L2luZGMxZGlnaXRhbGlkLWczLWNybC52ZXJpc2lnbi5jb20vSW5kQzFEaWdpdGFsSUQtRzMuY3Js MA0GCSqGSIb3DQEBBQUAA4IBAQAlSTzUKqa3ZouKWFQfIJ+4l/KsztPnY4Onwzt8lqAmeiFPqOmf kLTXbXDKtC6caFadNtyHpnsmQFFKXwhe5Z9/AaVSwryu6F9992DzYLp3j8PE0DSU0wmpUXUtp+rz TFqJRkzB8RCBoq/TPBmkMPr68qB0TkU3dbYiVIvscOt1MRkdHiwG4wKQLyCf8XRRWqmMY6lbun7g kiEWiris5StGKRvE5+e1SrcdnoZxIKQFF7Etr+4ftClrsDQWX9nRCEjYcmz4y/deq+HU8ylBaKZE 0ZJmcnYlAaD50OYWi0ckGDnKYyeMUEtCZJSV0otm2LqyIUAu9WPv/GNHt2ntjnUaMIIG7jCCBdag AwIBAgIQcRVmBUrkkSFN6bxE+azT3DANBgkqhkiG9w0BAQUFADCByjELMAkGA1UEBhMCVVMxFzAV BgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTow OAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24g QXV0aG9yaXR5IC0gRzMwHhcNMDkwNTAxMDAwMDAwWhcNMTkwNDMwMjM1OTU5WjCB3TELMAkGA1UE BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBO ZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29t L3JwYSAoYykwOTEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5WZXJp U2lnbiBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEczMIIBIjANBgkqhkiG9w0B AQEFAAOCAQ8AMIIBCgKCAQEA7cRH3yooHXwGa7vXITLJbBOP6bGNQU4099oL42r6ZYggCxET6Zvg SU6Lb9UB0F8NR5GKWkx0Pj/GkQm7TDSejW6hglFi92l2WJYHr54UGAdPWr2f0jGyVBlzRmoZQhHs EnMhjfXcMM3l2VYKMcU2bSkUl70t2olHGYjYSwQ967Y8Zx50ABMN0Ibak2f4MwOuGjxraXj2wCyO 4YM/d/mZ//6fUlrCtIcK2GypR8FUKWVDPkrAlh/Brfd3r2yxBF6+wbaULZeQLSfSux7pg2qE9sSy riMGZSalJ1grByK0b6ZiSBp38tVQJ5op05b7KPW6JHZi44xZ6/tu1ULEvkHH9QIDAQABo4ICuTCC ArUwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20w EgYDVR0TAQH/BAgwBgEB/wIBADBwBgNVHSAEaTBnMGUGC2CGSAGG+EUBBxcBMFYwKAYIKwYBBQUH AgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9jcHMwKgYIKwYBBQUHAgIwHhocaHR0cHM6Ly93 d3cudmVyaXNpZ24uY29tL3JwYTA0BgNVHR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnZlcmlzaWdu LmNvbS9wY2ExLWczLmNybDAOBgNVHQ8BAf8EBAMCAQYwbgYIKwYBBQUHAQwEYjBgoV6gXDBaMFgw VhYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUS2u5KJYGDLvQUjibKaxLB4shBRgwJhYkaHR0cDov L2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nbzEuZ2lmMC4GA1UdEQQnMCWkIzAhMR8wHQYDVQQDExZQ cml2YXRlTGFiZWw0LTIwNDgtMTE4MB0GA1UdDgQWBBR5R2EIQf04BKJL57XM9UP2SSsR+DCB8QYD VR0jBIHpMIHmoYHQpIHNMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4x HzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlT aWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENs YXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHM4IRAItbdVaE VIULAM+vOEjOsaQwDQYJKoZIhvcNAQEFBQADggEBADlNz0GZgbWpBbVSOOk5hIls5DSoWufYbAlM JBq6WaSHO3Mh8ZOBz79oY1pn/jWFK6HDXaNKwjoZ3TDWzE3v8dKBl8pUWkO/N4t6jhmND0OojPKv YLMVirOVnDzgnrMnmKQ1chfl/Cpdh9OKDcLRRSr4wPSsKpM61a4ScAjr+zvid+zoK2Q1ds262uDR yxTWcVibvtU+fbbZ6CTFJGZMXZEfdrMXPn8NxiGJL7M3uKH/XLJtSd5lUkL7DojS7Uodv0vj+Mxy +kgOZY5JyNb4mZg7t5Q+MXEGh/psWVMu198r7V9jAKwV7QO4VRaMxmgD5yKocwuxvKDaUljdCg5/ wYIxggSLMIIEhwIBATCB8jCB3TELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMu MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwOTEeMBwGA1UECxMVUGVyc29uYSBO b3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5WZXJpU2lnbiBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2Ny aWJlciBDQSAtIEczAhBsXT1GcwsFCfCgYicB/m2IMAkGBSsOAwIaBQCgggJtMBgGCSqGSIb3DQEJ AzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTExMDgwMjEzNDE1NVowIwYJKoZIhvcNAQkE MRYEFLG+NfUytUvQjRBiP9XmDWgPc50jMIIBAwYJKwYBBAGCNxAEMYH1MIHyMIHdMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l dHdvcmsxOzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20v cnBhIChjKTA5MR4wHAYDVQQLExVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMTLlZlcmlT aWduIENsYXNzIDEgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBIC0gRzMCEGxdPUZzCwUJ8KBiJwH+ bYgwggEFBgsqhkiG9w0BCRACCzGB9aCB8jCB3TELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlT aWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJt cyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwOTEeMBwGA1UECxMV UGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5WZXJpU2lnbiBDbGFzcyAxIEluZGl2aWR1 YWwgU3Vic2NyaWJlciBDQSAtIEczAhBsXT1GcwsFCfCgYicB/m2IMA0GCSqGSIb3DQEBAQUABIIB AJt/6YHMwjf0pTi6Mbe6R25gNNMyREIxl5y50FRt20/2WEUBEXYMOzO4DO0CWZX/AuHrTEoSP9nn wYllA2MXIEW8Gj7zcEcMxayX6KaKffxiT6sI0zkwH6tPqgQ0FKE4SR/1J2vqjx+CKcflZfarPCOd uInPGGayjakQig/qDxz71DUz1mwdPV0NmYpEu8OhlYuMNOpf8FH0xuTxV0Bd5knwDB2al5Vnbt6Q HbcwakjppAud1QJer1i1tbe2utoIT4LqoMfMXamBirjLb6JfMmvfyHJWu4NLUF5nSgVxYiLW36dh OhGi+Ay1Gi20lp7hYPlqQMmYK9gwGTcjAtmNkXQAAAAAAAA= --Apple-Mail=_81B9B03A-0161-42E2-90ED-A338ED79DC6D-- From martijn.grooten@virusbtn.com Mon Aug 22 07:52:39 2011 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB37121F8B40 for ; Mon, 22 Aug 2011 07:52:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.001 X-Spam-Level: X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[BAYES_50=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xQSBATYBOPRB for ; Mon, 22 Aug 2011 07:52:39 -0700 (PDT) Received: from mx6.sophos.com (mx6.sophos.com [213.31.172.36]) by ietfa.amsl.com (Postfix) with ESMTP id F248521F8541 for ; Mon, 22 Aug 2011 07:52:37 -0700 (PDT) Received: from mx6.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 0D5BB7514E3 for ; Mon, 22 Aug 2011 15:53:38 +0100 (BST) Received: from uk-exch2.green.sophos (uk-exch2.green.sophos [10.100.199.17]) by mx6.sophos.com (Postfix) with ESMTPS id E22367514CE for ; Mon, 22 Aug 2011 15:53:37 +0100 (BST) Received: from UK-EXCHMBX1.green.sophos ([fe80:0000:0000:0000:e1bd:d3c1:23.222.229.221]) by uk-exch2.green.sophos ([10.100.199.17]) with mapi; Mon, 22 Aug 2011 15:53:37 +0100 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Date: Mon, 22 Aug 2011 15:53:35 +0100 Thread-Topic: VB2011 Barcelona - Call for last-minute papers Thread-Index: Acxg20TL6Z509ANYQZCTkFOIrRYoKA== Message-ID: <18B53BA2A483AD45962AAD1397BE132537B1B6B91B@UK-EXCHMBX1.green.sophos> Accept-Language: en-US, en-GB Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US, en-GB Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [Asrg] VB2011 Barcelona - Call for last-minute papers X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2011 14:52:40 -0000 See below. Martijn. You may already have seen this elsewhere - in which case please accept my apologies for bombarding you with the same information - but I would like to bring to your attention the call for last-minute papers for VB2011, the 21st Virus Bulletin International anti-malware and anti-spam conference. The conference will include a programme of 30-minute presentations running in two concurrent streams: Technical and Corporate, the running order for which has already been finalized and can be seen at http://www.virusbtn.com/conference/vb2011/programme/. In addition to the scheduled presentations, a portion of the technical stream has been set aside for last-minute presentations. VB is now seeking submissions for these last-minute presentations. The last-minute presentations will be selected by a committee who will be looking for presentations dealing with up-to-the-minute specialist topics. Those selected for the last-minute presentations will be notified 18 days prior to the conference start, and will be required to prepare a 30-minute presentation to be given on Thursday 6th October at the Hesperia Tower hotel in Barcelona, Spain. Those selected for the last-minute presentations will receive a 50% discount on the conference registration fee. HOW TO SUBMIT A PROPOSAL Please use our online abstract submission form at http://www.virusbtn.com/conference/abstracts/ You will need to include: - an abstract of approximately 300 words outlining the proposed paper - five key points your presentation will cover - full contact details with each submission The deadline for submissions is 8 September 2011. Submissions received later than 8 September 2011 will not be considered. Thank you for your time, I hope to hear from you. Kind regards Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From martijn.grooten@virusbtn.com Mon Aug 22 09:34:12 2011 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6192D21F8B9C for ; Mon, 22 Aug 2011 09:34:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[AWL=2.000, BAYES_00=-2.599, GB_I_LETTER=-2, J_CHICKENPOX_32=0.6] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 57ibif5ecYAg for ; Mon, 22 Aug 2011 09:34:11 -0700 (PDT) Received: from mx4.sophos.com (mx4.sophos.com [216.47.234.213]) by ietfa.amsl.com (Postfix) with ESMTP id 76D3621F8B9B for ; Mon, 22 Aug 2011 09:34:10 -0700 (PDT) Received: from mx4.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 911644E0603 for ; Mon, 22 Aug 2011 17:35:14 +0100 (BST) Received: from uk-exch1.green.sophos (uk-exch1.green.sophos [10.100.199.16]) by mx4.sophos.com (Postfix) with ESMTPS id 37F0A4E0288 for ; Mon, 22 Aug 2011 17:35:14 +0100 (BST) Received: from UK-EXCHMBX1.green.sophos ([fe80:0000:0000:0000:e1bd:d3c1:23.222.229.221]) by uk-exch1.green.sophos ([10.100.199.16]) with mapi; Mon, 22 Aug 2011 17:35:11 +0100 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Date: Mon, 22 Aug 2011 17:35:05 +0100 Thread-Topic: URL shorteners, spam and DNS Thread-Index: Acxg6XLAjW2JUX7JSMav+/IRaKYcsA== Message-ID: <18B53BA2A483AD45962AAD1397BE132537B1B6BA45@UK-EXCHMBX1.green.sophos> Accept-Language: en-US, en-GB Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-cr-hashedpuzzle: oEM= yl4= AiV4 BKFV BSjR BoR4 Cu3Y DlhV EElF EsPZ F+Zj GXhY GaCH HM3a H7MU IdVj; 1; YQBzAHIAZwBAAGkAcgB0AGYALgBvAHIAZwA=; Sosha1_v1; 7; {C82ACDAA-75B6-4ACF-A5AB-F1569643EB8B}; bQBhAHIAdABpAGoAbgAuAGcAcgBvAG8AdABlAG4AQAB2AGkAcgB1AHMAYgB0AG4ALgBjAG8AbQA=; Mon, 22 Aug 2011 16:35:05 GMT; VQBSAEwAIABzAGgAbwByAHQAZQBuAGUAcgBzACwAIABzAHAAYQBtACAAYQBuAGQAIABEAE4AUwA= x-cr-puzzleid: {C82ACDAA-75B6-4ACF-A5AB-F1569643EB8B} acceptlanguage: en-US, en-GB Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [Asrg] URL shorteners, spam and DNS X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2011 16:34:12 -0000 URL shorteners (bit.ly, goo.gl, tinyurl.com etc.) have become popular in re= cent years for rather obvious reasons. They are being used by spammers for = equally obvious reasons - both in email and on other platforms (e.g. Twitte= r). A filter that checks URLs/domains against a blacklist will either miss the = bad domains hidden behind the shorteners or, if they blacklist the shortene= r, find itself blocking legitimate messages. Do Not Use (third-party) URL S= horteners is sound advice to those sending email, but it's not going to sto= p random users from copying shortened URLs from Twitter or Facebook and pas= ting them into emails and shortened URLs are unlikely to stop featuring on = Twitter. Tell those providing shorteners to check URLs against blacklists is also a = good idea - and probably necessary for them to stop ending up on blacklists= themselves - but if a filter happens to prefer a different blacklist it do= esn't help much. (I also don't know if checks are made every time someone c= licks on the link or just when the shortened URL is generated.) So I was wondering if it would help if shorteners published the URLs in a D= NS txt record. As the path of a shortened URL usually consists of lowercase= , uppercase letters and numbers, the uppercase letters need to be encoded, = e.g. by preceding them with an underscore. So for instance to look up the U= RL behind http://bit.ly/gkP0H would require a lookup of the TXT record for gk_p0_h._short.bit.ly Now I don't know if this is something that would actually help those develo= ping spam-/content-filters. Doing a HTTP lookup to determine the URL isn't = exactly rocket science - though intuitively, it seems more 'natural' to use= DNS, especially if that's what is used for the URL blacklist lookup. Nor do I know if this would be something that would interest those providin= g shortening services. As it would allow browsers to avoid making a HTTP re= quest to their services, it would mean they would stop having reliable clic= k through statistics which, I guess, are a source of revenue to them. But I thought I'd post it here anyway as perhaps it is useful. In which cas= e I'm sure it can be improved upon. Martijn. Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From steve@blighty.com Mon Aug 22 09:54:48 2011 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0273C21F8C0C for ; Mon, 22 Aug 2011 09:54:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.195 X-Spam-Level: ** X-Spam-Status: No, score=2.195 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FB_WORD2_END_DOLLAR=3.294, GB_I_LETTER=-2, J_CHICKENPOX_32=0.6, J_CHICKENPOX_42=0.6, MANGLED_MEDS=2.3] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f85Ng4bYR+ud for ; Mon, 22 Aug 2011 09:54:47 -0700 (PDT) Received: from m.wordtothewise.com (misc.wordtothewise.com [184.105.179.154]) by ietfa.amsl.com (Postfix) with ESMTP id 4C00821F8C04 for ; Mon, 22 Aug 2011 09:54:47 -0700 (PDT) Received: from platter.wordtothewise.com (204.11.227.194.static.etheric.net [204.11.227.194]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: steve) by m.wordtothewise.com (Postfix) with ESMTPSA id A4B9B2DEB3 for ; Mon, 22 Aug 2011 09:55:52 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1244.3) From: Steve Atkins In-Reply-To: <18B53BA2A483AD45962AAD1397BE132537B1B6BA45@UK-EXCHMBX1.green.sophos> Date: Mon, 22 Aug 2011 09:55:56 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: <74437D36-AAB7-4298-AFC7-B91E216B7412@blighty.com> References: <18B53BA2A483AD45962AAD1397BE132537B1B6BA45@UK-EXCHMBX1.green.sophos> To: Anti-Spam Research Group - IRTF X-Mailer: Apple Mail (2.1244.3) Subject: Re: [Asrg] URL shorteners, spam and DNS X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2011 16:54:48 -0000 On Aug 22, 2011, at 9:35 AM, Martijn Grooten wrote: > URL shorteners (bit.ly, goo.gl, tinyurl.com etc.) have become popular = in recent years for rather obvious reasons. They are being used by = spammers for equally obvious reasons - both in email and on other = platforms (e.g. Twitter). >=20 > A filter that checks URLs/domains against a blacklist will either miss = the bad domains hidden behind the shorteners or, if they blacklist the = shortener, find itself blocking legitimate messages. Do Not Use = (third-party) URL Shorteners is sound advice to those sending email, but = it's not going to stop random users from copying shortened URLs from = Twitter or Facebook and pasting them into emails and shortened URLs are = unlikely to stop featuring on Twitter. >=20 > Tell those providing shorteners to check URLs against blacklists is = also a good idea - and probably necessary for them to stop ending up on = blacklists themselves - but if a filter happens to prefer a different = blacklist it doesn't help much. (I also don't know if checks are made = every time someone clicks on the link or just when the shortened URL is = generated.) >=20 > So I was wondering if it would help if shorteners published the URLs = in a DNS txt record. As the path of a shortened URL usually consists of = lowercase, uppercase letters and numbers, the uppercase letters need to = be encoded, e.g. by preceding them with an underscore. So for instance = to look up the URL behind >=20 > http://bit.ly/gkP0H >=20 > would require a lookup of the TXT record for >=20 > gk_p0_h._short.bit.ly >=20 > Now I don't know if this is something that would actually help those = developing spam-/content-filters. Doing a HTTP lookup to determine the = URL isn't exactly rocket science - though intuitively, it seems more = 'natural' to use DNS, especially if that's what is used for the URL = blacklist lookup. >=20 > Nor do I know if this would be something that would interest those = providing shortening services. As it would allow browsers to avoid = making a HTTP request to their services, it would mean they would stop = having reliable click through statistics which, I guess, are a source of = revenue to them. It's not going to happen. To do this would require a fairly complex, database backed "stunt" DNS = server, hooked fairly intimately into the URL shorteners core = application. URL shorteners are deployed by people who understand webservers and = HTTP, not DNS servers. Getting them to deploy anything beyond the basic = DNS required to serve a website is a non-starter. The only thing I'd expect to get any level of traction for would be = something that can be implemented in a webserver, in much the same way = as the URL shortener itself is implented (and, probably, running in the = same webapp as the shortener itself). There are several obvious ways to do that - http queries to a related = hostname (http://destination.wttw.me/q8Qzth), a related path = (http://wttw.me/d/q8Qzth), a suffix to the URL, a different MIME type, = etc, etc. The cleanest way would be to use a different request type. Conveniently, = that's already implemented. If you send a HEAD request for the URL, = you'll get a 301 Moved response, and a Location: header containing the = target URL. And, at least for the URL shortener I use (bit.ly), that HEAD request = will not count as a click for statistics tracking. platter:steve$ telnet wttw.me 80 Trying 168.143.174.97... Connected to wttw.me. Escape character is '^]'. HEAD /q8Qzth HTTP/1.1 Host: wttw.me Connection: close HTTP/1.1 301 Moved Server: nginx Date: Mon, 22 Aug 2011 16:52:38 GMT Content-Type: text/html; charset=3Dutf-8 Connection: close Set-Cookie: _bit=3D4eXXXXXXXXXXXXXXa8;domain=3D.wttw.me;expires=3DSat = Feb 18 11:52:38 2012;path=3D/; HttpOnly Cache-control: private; max-age=3D90 Location: http://irtf.org/ MIME-Version: 1.0 Content-Length: 108 Connection closed by foreign host. Cheers, Steve From feenberg@nber.org Mon Aug 22 11:10:16 2011 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93C8921F8508 for ; Mon, 22 Aug 2011 11:10:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.585 X-Spam-Level: X-Spam-Status: No, score=-3.585 tagged_above=-999 required=5 tests=[BAYES_40=-0.185, J_CHICKENPOX_32=0.6, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YDden3HvevFE for ; Mon, 22 Aug 2011 11:10:15 -0700 (PDT) Received: from mail2.nber.org (mail2.nber.org [66.251.72.79]) by ietfa.amsl.com (Postfix) with ESMTP id BE31E21F84D8 for ; Mon, 22 Aug 2011 11:10:15 -0700 (PDT) Received: from nber6.nber.org (nber6.nber.org [66.251.72.76]) by mail2.nber.org (8.14.4/8.14.4) with ESMTP id p7MIB25S021746; Mon, 22 Aug 2011 14:11:02 -0400 (EDT) (envelope-from feenberg@nber.org) Received: from localhost (feenberg@localhost) by nber6.nber.org (8.14.4/8.14.4/Submit) with ESMTP id p7MI2H3a021489; Mon, 22 Aug 2011 14:02:18 -0400 (EDT) X-Authentication-Warning: nber6.nber.org: feenberg owned process doing -bs Date: Mon, 22 Aug 2011 14:02:17 -0400 (EDT) From: Daniel Feenberg X-X-Sender: feenberg@nber6 To: Anti-Spam Research Group - IRTF In-Reply-To: <18B53BA2A483AD45962AAD1397BE132537B1B6BA45@UK-EXCHMBX1.green.sophos> Message-ID: References: <18B53BA2A483AD45962AAD1397BE132537B1B6BA45@UK-EXCHMBX1.green.sophos> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.39/RELEASE, bases: 20110822 #5987054, check: 20110822 clean Subject: Re: [Asrg] URL shorteners, spam and DNS X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2011 18:10:16 -0000 On Mon, 22 Aug 2011, Martijn Grooten wrote: > URL shorteners (bit.ly, goo.gl, tinyurl.com etc.) have become popular in > recent years for rather obvious reasons. They are being used by spammers > for equally obvious reasons - both in email and on other platforms (e.g. > Twitter). > > A filter that checks URLs/domains against a blacklist will either miss > the bad domains hidden behind the shorteners or, if they blacklist the > shortener, find itself blocking legitimate messages. Do Not Use > (third-party) URL Shorteners is sound advice to those sending email, but > it's not going to stop random users from copying shortened URLs from > Twitter or Facebook and pasting them into emails and shortened URLs are > unlikely to stop featuring on Twitter. > Is there some reason the spam filter can't just send a head request to bit.ly and find out the destination URL? That wouldn't require any cooperation among the various parties to this potential transaction, and cooperation is always in short supply in this field. Daniel Feenberg From dotzero@gmail.com Mon Aug 22 11:20:19 2011 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5DFA121F8586 for ; Mon, 22 Aug 2011 11:20:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.999 X-Spam-Level: X-Spam-Status: No, score=-2.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_32=0.6, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VOHe8AiXVwEW for ; Mon, 22 Aug 2011 11:20:18 -0700 (PDT) Received: from mail-qw0-f54.google.com (mail-qw0-f54.google.com [209.85.216.54]) by ietfa.amsl.com (Postfix) with ESMTP id 929CB21F84E8 for ; Mon, 22 Aug 2011 11:20:18 -0700 (PDT) Received: by qwc9 with SMTP id 9so4190737qwc.13 for ; Mon, 22 Aug 2011 11:21:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=6CElMnSl+JIYP8vmrcBp9stk4iFnTiSpA3TtjDO1Ick=; b=ePHYmsSqJoeKcmBqvnhtmQ4cWyZlnHJHUOWPr+s7O8uekajxUgAgXEbSkbiCXIIMG7 RK562K+04LIq/Tckmg3PRUEUcLofJeV7TWM2VhQ/+hLFODAEzoC1o9J5oUCsdqwZ+wVl muOrA+EcqMsY59fCRa2Day8cJJhxUUlNFrJrE= MIME-Version: 1.0 Received: by 10.229.134.6 with SMTP id h6mr1592002qct.14.1314037279503; Mon, 22 Aug 2011 11:21:19 -0700 (PDT) Received: by 10.229.220.65 with HTTP; Mon, 22 Aug 2011 11:21:19 -0700 (PDT) In-Reply-To: References: <18B53BA2A483AD45962AAD1397BE132537B1B6BA45@UK-EXCHMBX1.green.sophos> Date: Mon, 22 Aug 2011 14:21:19 -0400 Message-ID: From: Dotzero To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Asrg] URL shorteners, spam and DNS X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2011 18:20:19 -0000 On Mon, Aug 22, 2011 at 2:02 PM, Daniel Feenberg wrote: > > > On Mon, 22 Aug 2011, Martijn Grooten wrote: > >> URL shorteners (bit.ly, goo.gl, tinyurl.com etc.) have become popular in >> recent years for rather obvious reasons. They are being used by spammers for >> equally obvious reasons - both in email and on other platforms (e.g. >> Twitter). >> >> A filter that checks URLs/domains against a blacklist will either miss the >> bad domains hidden behind the shorteners or, if they blacklist the >> shortener, find itself blocking legitimate messages. Do Not Use >> (third-party) URL Shorteners is sound advice to those sending email, but >> it's not going to stop random users from copying shortened URLs from Twitter >> or Facebook and pasting them into emails and shortened URLs are unlikely to >> stop featuring on Twitter. >> > > Is there some reason the spam filter can't just send a head request to > bit.ly and find out the destination URL? That wouldn't require any > cooperation among the various parties to this potential transaction, and > cooperation is always in short supply in this field. > Bit.ly allows you to add a "+" to the end of a shortened URL to see where it goes and to also see some stats regarding the URL. Picking a random URL from Google News, try this.... http://bit.ly/ovrbAu+. My understanding is that a number of other well known shortener providers have followed suit. Mike From skull@bofhland.org Mon Aug 22 12:18:27 2011 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A659F21F8C51 for ; Mon, 22 Aug 2011 12:18:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_32=0.6] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5f9tV9eBr8xR for ; Mon, 22 Aug 2011 12:18:27 -0700 (PDT) Received: from mithrandir.bofhland.org (mithrandir.bofhland.org [IPv6:2a02:9a8:94::b]) by ietfa.amsl.com (Postfix) with ESMTP id 8700121F8C4B for ; Mon, 22 Aug 2011 12:18:26 -0700 (PDT) Received: from zarathustra.local (baggins.skullkrusher.net [147.123.72.2]) by mithrandir.bofhland.org (Postfix) with ESMTPSA id 410FE6004C for ; Mon, 22 Aug 2011 21:19:29 +0200 (CEST) Message-ID: <4E52ABC0.7010102@bofhland.org> Date: Mon, 22 Aug 2011 21:19:28 +0200 From: "Emanuele Balla (aka Skull)" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:6.0) Gecko/20110812 Thunderbird/6.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <18B53BA2A483AD45962AAD1397BE132537B1B6BA45@UK-EXCHMBX1.green.sophos> In-Reply-To: X-Enigmail-Version: 1.3 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] URL shorteners, spam and DNS X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Aug 2011 19:18:27 -0000 On 8/22/11 8:02 PM, Daniel Feenberg wrote: > Is there some reason the spam filter can't just send a head request to > bit.ly and find out the destination URL? That wouldn't require any > cooperation among the various parties to this potential transaction, and > cooperation is always in short supply in this field. Yeah! This way smaller redirectors abused by real spammers are simply DDoSed out of business and stop being an issue!!! +1! ;-) -- Paranoia is a disease unto itself. And may I add: the person standing next to you may not be who they appear to be, so take precaution. ----------------------------------------------------------------------------- http://bofhskull.wordpress.com/ From johnl@iecc.com Mon Aug 22 23:57:09 2011 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CAA2821F8B4F for ; Mon, 22 Aug 2011 23:57:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.263 X-Spam-Level: X-Spam-Status: No, score=-110.263 tagged_above=-999 required=5 tests=[AWL=-0.923, BAYES_20=-0.74, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zOQCWM7uFaWi for ; Mon, 22 Aug 2011 23:57:09 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [64.57.183.53]) by ietfa.amsl.com (Postfix) with ESMTP id D442121F8B18 for ; Mon, 22 Aug 2011 23:57:08 -0700 (PDT) Received: (qmail 18004 invoked from network); 23 Aug 2011 06:58:14 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 23 Aug 2011 06:58:14 -0000 Date: 23 Aug 2011 06:57:52 -0000 Message-ID: <20110823065752.13963.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <18B53BA2A483AD45962AAD1397BE132537B1B6BA45@UK-EXCHMBX1.green.sophos> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] URL shorteners, spam and DNS X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2011 06:57:09 -0000 >So I was wondering if it would help if shorteners published the URLs in >a DNS txt record. They could publish them in a DNS A record, which would require no hackery at all to browsers. That is, instead of http://bit.ly/abcde -> http://abcde.bit.ly But this would be a big problem for large ISPs, due to DNS caches filling up with the things, a problem noted when Facebook did something similar. R's, John From joao.gouveia@anubisnetworks.com Tue Aug 23 03:24:45 2011 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5292421F8B28 for ; Tue, 23 Aug 2011 03:24:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.931 X-Spam-Level: X-Spam-Status: No, score=-1.931 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, URI_HEX=0.368] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q7KrNnyiB1Jw for ; Tue, 23 Aug 2011 03:24:44 -0700 (PDT) Received: from smtp41.anubisnetworks.com (smtp41.anubisnetworks.com [80.67.98.239]) by ietfa.amsl.com (Postfix) with ESMTP id 416DE21F8B27 for ; Tue, 23 Aug 2011 03:24:42 -0700 (PDT) Received: from smtp41.anubisnetworks.com (localhost [127.0.0.1]) by smtp41.anubisnetworks.com (Postfix) with ESMTP id 0E3B928E126 for ; Tue, 23 Aug 2011 12:25:48 +0200 (CEST) Received: from frog.anubis.via (zimbra.anubisnetworks.com [195.22.26.196]) by smtp41.anubisnetworks.com (Postfix) with ESMTP id E21BF28A1CA for ; Tue, 23 Aug 2011 12:25:47 +0200 (CEST) Received: from frog.anubis.via (frog.anubis.via [192.168.23.28]) by frog.anubis.via (Postfix) with ESMTP id 06588441B3 for ; Tue, 23 Aug 2011 11:25:26 +0100 (WEST) Date: Tue, 23 Aug 2011 11:25:26 +0100 (WEST) From: =?utf-8?B?Sm/Do28=?= Gouveia To: Anti-Spam Research Group - IRTF Message-ID: <37dc2607-64fd-42d4-9ab8-58bccbd1f3eb@frog> In-Reply-To: <20110823065752.13963.qmail@joyce.lan> Content-Type: multipart/mixed; boundary="=_97ab7c6a-d0b9-4c20-9080-abb9e043c120" MIME-Version: 1.0 X-Originating-IP: [195.22.26.226] X-Mailer: Zimbra 7.1.1_GA_3213 (ZimbraWebClient - FF3.0 (Linux)/7.1.1_GA_3196) Subject: Re: [Asrg] URL shorteners, spam and DNS X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2011 10:24:45 -0000 --=_97ab7c6a-d0b9-4c20-9080-abb9e043c120 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi, ----- Original Message ----- > From: "John Levine" > To: asrg@irtf.org > Sent: Tuesday, August 23, 2011 7:57:52 AM > Subject: Re: [Asrg] URL shorteners, spam and DNS > > >So I was wondering if it would help if shorteners published the URLs > >in > >a DNS txt record. > > They could publish them in a DNS A record, which would require no > hackery at all to browsers. That is, instead of > > http://bit.ly/abcde -> http://abcde.bit.ly We're actually doing something similar with Mailspike, not only for shorten= ers bot also for some abused web hosting providers. The general idea is tracking shorteners being used in spam and do the get-f= inal-destination-and-check-if-it-is-bad on our infrastructure, and then we = publish "bad" shortener URIs as FQDNs using rbldsnsd. I'm attaching a sample perl implementation if you want to take a look. This is valid also for example for yahoogroups and others. For example: http://tech.groups.yahoo.com/group/ebishuartrl/message points to a spammy U= RI, and the yahoo entry would map to the fqdn: 78e73102.0d448dd4.db0f6f37.tech.groups.yahoo.com Thus allowing listing full URIs as fqdns. > > But this would be a big problem for large ISPs, due to DNS caches > filling > up with the things, a problem noted when Facebook did something > similar. > > R's, > John > > > _______________________________________________ > Asrg mailing list > Asrg@irtf.org > http://www.irtf.org/mailman/listinfo/asrg > -- Joao Gouveia AnubisNetworks Av. Quinta Grande, 53 Edif=C3=ADcio Prime, 5=C2=BAA Alfragide 2610-156 AMADORA Portugal Tel. : +351 21 7252110 Mobile : +351 91 9512960 Fax : +351 21 7252119 joao.gouveia@anubisnetworks.com http://www.anubisnetworks.com --=_97ab7c6a-d0b9-4c20-9080-abb9e043c120 Content-Type: application/x-perl; name=ExtendedURI.pm Content-Disposition: attachment; filename=ExtendedURI.pm Content-Transfer-Encoding: base64 IyEvdXNyL2Jpbi9wZXJsDQoNCj1oZWFkMSBOQU1FDQoNCkV4dGVuZGVkVVJJIC0gQ29udmVydCBh IGdpdmVuIFVSSSBpbnRvIGFuIGVuY29kZWQgZm9ybWF0IHRoYXQgY2FuIGJlIHVzZWQgdG8gbG9v a3VwIHZpYSBETlMgb24gTWFpbHNwaWtlIEVCTA0KDQo9Y3V0DQoNCj1oZWFkMSBNRVRIT0RTDQoN Cj1vdmVyIDQNCg0KPWl0ZW0gZW5jb2RlKCR1cmwpDQoNClJldHVybnMgdGhlIGVuY29kZWQgVVJJ Lg0KDQpFeGFtcGxlOg0KDQoJZW5jb2RlKCJodHRwOi8vZXhhbXBsZS5jb20vWFgvc29tZWxhcmdl cnBhdGgvdGhhdD9mb289YmFyIiknDQoNCglyZXR1cm5zOg0KDQoJYmFyLmZvby44YzlkNTNhOC42 NDViZDQyOC5YWC5leGFtcGxlLmNvbQ0KDQo9Y3V0DQoNCnBhY2thZ2UgRXh0ZW5kZWRVUkk7DQoN CnVzZSBzdHJpY3Q7DQp1c2UgdmFycyBxdyhASVNBKTsNCnVzZSBieXRlczsNCnVzZSBEaWdlc3Q6 Ok1ENSBxd3sgbWQ1X2hleH07DQp1c2UgU3RyaW5nOjpDUkMzMjsNCg0KbXkgJE1BWEhPU1RTSVpF ID0gMTEyOw0KbXkgJE1BWFBBUlRTSVpFID0gODsNCg0Kc3ViIHN1Yl9lbmNvZGUgew0KCW15ICRz dHJpbmcJPSBzaGlmdDsNCglteSAkbWF4cGFydAk9IHNoaWZ0IHx8ICRNQVhQQVJUU0laRTsNCiAg ICAgICAgI3JldHVybiAgJyInLiRzdHJpbmcuIi0iLnN1YnN0cihtZDVfaGV4KCRzdHJpbmcpLDAs MzQpLiciJzsNCiAgICAgICAgI3JldHVybiAgJyInLiRzdHJpbmcuIi0iLnN1YnN0cihtZDVfaGV4 KCRzdHJpbmcpLDAsJG1heHBhcnQpLiciJzsNCiAgICAgICAgcmV0dXJuICBzdWJzdHIobWQ1X2hl eCgkc3RyaW5nKSwwLCRtYXhwYXJ0KTsNCn0NCnN1YiBlbmNvZGUgew0KCW15ICR1cmwJCT0gc2hp ZnQgfHwgcmV0dXJuICcnOw0KCW15ICRyYmwJCT0gc2hpZnQgfHwgJyc7DQoJbXkgJG1heHBhcnQJ PSBzaGlmdCB8fCAkTUFYUEFSVFNJWkU7DQoJbXkgJG1heAkJPSBzaGlmdCB8fCAkTUFYSE9TVFNJ WkU7DQoJJHJibCA9ICIuJHJibCIgaWYgJHJibDsNCg0KICAgICAgICBpZiAoICR1cmwhfi9eXHcr OlwvXC8vICkgew0KICAgICAgICAgICAgICAgICR1cmw9Imh0dHA6Ly8iLiR1cmw7DQogICAgICAg IH0NCiAgICAgICAgJHVybD1+L2h0dHBzPzpcL1wvKC4rPykoXC98JCkoLiopLzsNCiAgICAgICAg bXkgJGRvbWFpbj0kMTsNCgkkbWF4IC09IChsZW5ndGgoJGRvbWFpbikgKyBsZW5ndGgoJHJibCkg KyAkbWF4cGFydCArMSk7DQogICAgICAgIG15ICRwYXRoPSIvIi4kMyBpZiAkMzsNCiAgICAgICAg bXkgJHJlc3VsdDsNCg0KICAgICAgICBpZiAoICRwYXRoICkgew0KICAgICAgICAgICAgICAgIG15 IEBzbGljZXM9c3BsaXQoL1tcL1w/XD1cJl0vLCRwYXRoKTsgIyBTcGxpdCBwYXRoIGludG8gc2xp Y2VzDQogICAgICAgICAgICAgICAgc2hpZnQoQHNsaWNlcyk7ICMgcmVtb3ZlIGVtcHR5IHNsaWNl DQoNCgkJIyBFbmNvZGUgaXQNCgkJd2hpbGUgKChteSAkc2xpY2UgPSBzaGlmdChAc2xpY2VzKSkg JiYgKCRtYXggPiAoJG1heHBhcnQrMSkpKSB7DQoJCQlzdWJzdHIoJHBhdGgsMCxsZW5ndGgoJHNs aWNlKSsxKSA9ICcnOw0KICAgICAgICAgICAgICAgCQkkcmVzdWx0ID0gIHN1Yl9lbmNvZGUoJHNs aWNlLCRtYXhwYXJ0KS4iLiRyZXN1bHQiOw0KCQkJJG1heCAtPSAoJG1heHBhcnQgKzEpOw0KCQl9 DQoJCWNob3AoJHJlc3VsdCk7DQoJCSRyZXN1bHQgPSBzdWJfZW5jb2RlKCRwYXRoLCRtYXhwYXJ0 KS4iLiRyZXN1bHQiDQoJCQlpZiAkcGF0aDsNCgkJcmV0dXJuICIkcmVzdWx0LiRkb21haW4kcmJs IjsNCiAgICAgICAgfSBlbHNlIHsgDQoJCSMgSWYgbm8gcGF0aCBkZXRlY3RlZCwganVzdCByZXR1 cm4gdGhlIG9yaWdpbmFsIGRvbWFpbg0KCQlyZXR1cm4gJGRvbWFpbjsNCgl9DQp9DQoNCjQyOw0K --=_97ab7c6a-d0b9-4c20-9080-abb9e043c120-- From martijn.grooten@virusbtn.com Tue Aug 23 09:54:21 2011 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9455621F8B78 for ; Tue, 23 Aug 2011 09:54:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_32=0.6] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OQnrMSmhn8We for ; Tue, 23 Aug 2011 09:54:21 -0700 (PDT) Received: from mx4.sophos.com (mx4.sophos.com [216.47.234.213]) by ietfa.amsl.com (Postfix) with ESMTP id F27E921F8B33 for ; Tue, 23 Aug 2011 09:54:19 -0700 (PDT) Received: from mx4.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 76BD44E05D2 for ; Tue, 23 Aug 2011 17:55:26 +0100 (BST) Received: from uk-exch2.green.sophos (uk-exch2.green.sophos [10.100.199.17]) by mx4.sophos.com (Postfix) with ESMTPS id 14AFB4E0115 for ; Tue, 23 Aug 2011 17:55:26 +0100 (BST) Received: from UK-EXCHMBX1.green.sophos ([fe80:0000:0000:0000:e1bd:d3c1:23.222.229.221]) by uk-exch2.green.sophos ([10.100.199.17]) with mapi; Tue, 23 Aug 2011 17:55:23 +0100 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Date: Tue, 23 Aug 2011 17:55:19 +0100 Thread-Topic: [Asrg] URL shorteners, spam and DNS Thread-Index: Acxg+FMTCYywvXwpQwS5goTXLKvZewAvC+Ng Message-ID: <18B53BA2A483AD45962AAD1397BE132537B1B6C0D5@UK-EXCHMBX1.green.sophos> References: <18B53BA2A483AD45962AAD1397BE132537B1B6BA45@UK-EXCHMBX1.green.sophos> In-Reply-To: Accept-Language: en-US, en-GB Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-cr-hashedpuzzle: +kM= BjWD BkEf B1GQ B1h+ C98c EA2v Ellg FV4m HRdP HSJa HwtP ICPY INWT JYNW Jdsn; 1; YQBzAHIAZwBAAGkAcgB0AGYALgBvAHIAZwA=; Sosha1_v1; 7; {4021A2C3-1126-489B-83F9-A051C99BCD83}; bQBhAHIAdABpAGoAbgAuAGcAcgBvAG8AdABlAG4AQAB2AGkAcgB1AHMAYgB0AG4ALgBjAG8AbQA=; Tue, 23 Aug 2011 16:55:19 GMT; UgBFADoAIABbAEEAcwByAGcAXQAgAFUAUgBMACAAcwBoAG8AcgB0AGUAbgBlAHIAcwAsACAAcwBwAGEAbQAgAGEAbgBkACAARABOAFMA x-cr-puzzleid: {4021A2C3-1126-489B-83F9-A051C99BCD83} acceptlanguage: en-US, en-GB Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] URL shorteners, spam and DNS X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Aug 2011 16:54:21 -0000 > Bit.ly allows you to add a "+" to the end of a shortened URL to see > where it goes and to also see some stats regarding the URL. Picking a > random URL from Google News, try this.... http://bit.ly/ovrbAu+. My > understanding is that a number of other well known shortener providers > have followed suit. I think they have and I think it's a great thing if you're a human and you = want to check a shortened URL before clicking the link. But if you're a com= puter it's not very useful, definitely not easier than sending a HEAD reque= st (which I hadn't though of and will of course be faster than GET). Martijn. Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From jwellband@gmail.com Tue Aug 30 15:07:13 2011 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63FEF21F8B75 for ; Tue, 30 Aug 2011 15:07:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.999 X-Spam-Level: X-Spam-Status: No, score=-2.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_53=0.6, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fU9FTkedSVhk for ; Tue, 30 Aug 2011 15:07:12 -0700 (PDT) Received: from mail-fx0-f54.google.com (mail-fx0-f54.google.com [209.85.161.54]) by ietfa.amsl.com (Postfix) with ESMTP id 91EA721F8B3A for ; Tue, 30 Aug 2011 15:07:12 -0700 (PDT) Received: by fxe4 with SMTP id 4so169620fxe.13 for ; Tue, 30 Aug 2011 15:08:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; bh=avKdNA4H6bSdvNe7lnSdRi0BzIa5CU2yaPv94JupsgA=; b=qIDqx4sQP+XJ88z7fyO4/uxnkU2DBNH2SzSIbK30Qt5F7+xk1nbjpNcHO+WraE0Vzh KK8x5yFxoPzw1NgY/csZIW339Agf6vdOVPOwHC+uQYnCHU8TnyazgBBGoiblwDv4Zv71 aYlDhRF0kBxcIA7PYRe22DSMfRCXX+vLvNR9Q= MIME-Version: 1.0 Received: by 10.223.23.6 with SMTP id p6mr552040fab.112.1314742120296; Tue, 30 Aug 2011 15:08:40 -0700 (PDT) Received: by 10.152.38.130 with HTTP; Tue, 30 Aug 2011 15:08:40 -0700 (PDT) Date: Tue, 30 Aug 2011 18:08:40 -0400 Message-ID: From: "Jason W." To: asrg@irtf.org Content-Type: text/plain; charset=UTF-8 Subject: [Asrg] Blacklisting email accounts? X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Aug 2011 22:07:13 -0000 (Maybe my google-fu isn't up to par and this has been discussed previously - if so, my apologies) With PCs being owned and email accounts being owned, has anyone considered blacklisting individual email accounts? Within the past month, I've gotten an influx of spam from people who I have communicated with. Given the content, I doubt these people would be sending me random links to foreign websites designed to own my PC. Some of these senders are people who I haven't communicated with in years, but my email address is probably in their email box or address book. It's all been consumer-grade email (Comcast, AOL, Yahoo, etc.) from people for whom it would not be a stretch to imagine them getting owned. Considering that some of these providers don't seem to be interested in cleaning up their outbound mail, has anyone considered blacklisting email accounts like we do IPs/hostnames? I do this for my personal mail stream, and it scales - get a spam from an owned person I don't need email from, drop 'em in the local BL. But for this to be effective, there'd have to be some kind of DNSBL'ish thing to query. I do understand that there are an infinite amount of email addresses for freemail domains ;) So this wouldn't stop spammer-created accounts. But if Aunt Tilly has to change her email address (or go through some removal-from-blocklist stuff - possibly go through some education), that could have the necessary impact to change her behavior so she wouldn't get owned again. This could be use a strong password, don't run an insecure OS, don't use insecure wiifi, whatever is deemed good information to better their understanding of what they've done. Or am I giving people too much credit in hoping they'd change after they meet the clue by four? For some, the aversion to getting another email address might outlive the desire to be lackadaisical.. -- HTH, YMMV, HANW :) Jason The path to enlightenment is /usr/bin/enlightenment. From graeme@graemef.net Wed Aug 31 01:43:45 2011 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23FC721F8B44 for ; Wed, 31 Aug 2011 01:43:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_53=0.6] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mpK66LV1Idoc for ; Wed, 31 Aug 2011 01:43:44 -0700 (PDT) Received: from boom.graemef.net (graemef-2-pt.tunnel.tserv5.lon1.ipv6.he.net [IPv6:2001:470:1f08:1362::2]) by ietfa.amsl.com (Postfix) with ESMTP id 974C321F8B37 for ; Wed, 31 Aug 2011 01:43:43 -0700 (PDT) Received: from squonk.lut.ac.uk ([131.231.87.200]) by boom.graemef.net with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1QygQ4-0001Im-EP for asrg@irtf.org; Wed, 31 Aug 2011 09:45:13 +0100 From: Graeme Fowler To: Anti-Spam Research Group - IRTF In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Date: Wed, 31 Aug 2011 09:45:05 +0100 Message-ID: <1314780305.28943.3.camel@localhost> Mime-Version: 1.0 X-Mailer: Evolution 2.28.3 (2.28.3-1.fc12) Content-Transfer-Encoding: 7bit X-graemef-Exiscan-ACL-Spam-Flag: Doubtful Subject: Re: [Asrg] Blacklisting email accounts? X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Aug 2011 08:43:45 -0000 On Tue, 2011-08-30 at 18:08 -0400, Jason W. wrote: > But for this to be effective, there'd have to be some kind of > DNSBL'ish thing to query. Whilst it's at a finer level of detail than you might require, there is the APER (Anti Phishing Email Reply) list which spun out of HE being targetted and is maintained by a decent group of volunteers: http://code.google.com/p/anti-phishing-email-reply/ At work we've found this of tremendous use. Graeme