Ipswitch Forums / Ipswitch Products / IMail Server / URL Domain Black List... what's the point? / Latest Posts

RE: URL Domain Black List... what's the point?

jerger — Wed, 23 Apr 2008 11:35:59 GMT

hey its the only thing i could come up with... don't ask.

RE: URL Domain Black List... what's the point?

tripodal — Tue, 22 Apr 2008 15:57:10 GMT

baby rabbit sex huh?

RE: URL Domain Black List... what's the point?

jerger — Mon, 21 Apr 2008 17:09:49 GMT

well the reason why people bother the tech guys... is youtube.com isn't spam but babyrabbitsex.com might be spam. so they should stick to 100% spammer urls... not "pick and choose who we like"

RE: URL Domain Black List... what's the point?

John T — Sat, 19 Apr 2008 19:03:15 GMT

[quote][b]eyleron (4/17/2008)[/b][hr]John T,

I think you were joking or rolling eyes or being sarcastic?

As much as one may dislike Microsoft, YouTube, MySpace, etc., we cannot have their URLs in the blacklist. [/quote]

My policy, that of my clients, and that of most network admins I know is to block Social Engineering websites, as any misguided business purpose they may have is far outweighted by the stuff that users have no business accessing during work from work using company owned and provided resources and assets.

The emotions are shown since I know others will disagree. :D

RE: URL Domain Black List... what's the point?

Ronaldr — Fri, 18 Apr 2008 19:25:45 GMT

the whitelist overrides the url blacklist right ?? so maybe just add the urls you want to keep in there ?

i notice that the whitelist does not override the DNS blacklist tho....

*also might i add*

the URL blacklist is static

Go to your imail directory.... on a windows machine C:/Imail/url-blacklist.txt

open it with notepad and take out "youtube.com" or whatever you dont want in there and save it....no need to bother the tech guys.

Its simple

RE: URL Domain Black List... what's the point?

jerger — Thu, 17 Apr 2008 12:22:54 GMT

lol their site is down. please help list the false positives or ones that we can remove... so we can remove them each time a new list comes out

http://forums.ipswitch.com/Topic42848-10-1.aspx

i have added my own so mine is probably 2-3 x bigger than theres. pm me if you want it along with my phrase list.

RE: URL Domain Black List... what's the point?

eyleron — Thu, 17 Apr 2008 11:05:54 GMT

John T,

I think you were joking or rolling eyes or being sarcastic?

As much as one may dislike Microsoft, YouTube, MySpace, etc., we cannot have their URLs in the blacklist.

I checked the latest downloadable list at http://www.ipswitch.com/support/imail/index.asp and YouTube is in there, as is Barnes and Noble.

IPSwitch's process (http://www.ipswitch.com/support/imail/blacklist_policy.asp) for adding these URLs is completely broken!

Broken broken broken. I told tech support months ago about "live.com" in their list. It's still in there today. I have lost faith in IPSWITCH and I'll have to stop using their list. :angry:

RE: URL Domain Black List... what's the point?

John T — Thu, 17 Apr 2008 05:11:39 GMT

[quote][b]eyleron (4/15/2008)[/b][hr]Today I found youtube.com in the URL Blacklist.[/quote]

As it should be. ;):w00t::cool::hehe:

RE: URL Domain Black List... what's the point?

eyleron — Tue, 15 Apr 2008 14:47:36 GMT

Today I found youtube.com in the URL Blacklist.

We just started testing a Barracuda service that runs before IMail does its anti-spam.

Jerger, I'd appreciate if you would PM me the lists you're using.

RE: URL Domain Black List... what's the point?

jerger — Mon, 10 Mar 2008 15:10:03 GMT

in the url list... remove the word "live.com" i was having hte same issue. remove anything thats generic and popular like yahoo.com etc.... since you dont want to block all legit sites. now if someone comes up with poop.yahoo.ax.com then you would block that specific site.

their default blocklist is blocking live.com and i believe campaigner.com which causes further issues. go through and clean up the list. if you want ill pm you my phrase and url lists

also i have reported several bugs in their anti spam methods and code... which was done in October... these still are not fixed... and they are releasing version 10 at the end of the month!

i hope they are not using us as lab rats... if they are and everything gets even further out of control with server issues... i dont see how they plan on keeping customers or attracting new ones. *frustrated* day 50 of troubleshooting our servers.

RE: URL Domain Black List... what's the point?

eyleron — Mon, 10 Mar 2008 13:17:26 GMT

Robbie,

Yeah, I've seen that only the premium anti-spam is a dynamic updated list.

It just scares me that those URLs got in the list in the first place.

And now, today, when my sysadmin downloaded the latest list, I see that windowslive.com is in their URL Domain Black List! When the free version of HotMail (LiveMail) plunks an ad in the footer for "windowslive.com" in outgoing emails to my server, they'll be marked as spam.

I know that they can't check it for every "legitimate," "whitelisted" URL in the world. There are millions.

However, again, the URLs like amazon.com, airlines, yahoo, MS, etc. Fortune 500 companies, etc. isn't very difficult to accumulate over time (for IPSWITCH).

Very frustrating. If this continues, I'll have to take the advice of not using their list at all, and only use the list linked above.

**UPDATE** I just did a check for gotomeeting.com and THAT one is still in there too. I've reported this to tech support before and I guess I'll need to do this again.

RE: URL Domain Black List... what's the point?

jerger — Mon, 12 Nov 2007 13:12:43 GMT

its also very out of date and almost useless. the server itself cannot handle a good black list. if your file grows beyond 1mb it will crash and break the block list entirely ignoring it for most checks if not all. so its kind of silly that the list itself can only be useful under 1mb. their tech support claims its limitless, but that isnt functional. good blacklists that are 2-3mb large will crash and delete all your entries.

find out new urls at:
http://www.joewein.de/sw/blacklist.htm

RE: URL Domain Black List... what's the point?

Robbie Boucher — Thu, 08 Nov 2007 13:04:40 GMT

The URL Domain Blacklist filter is not updated dynamically. It runs off of a static text file that resides in your IMail topdir. If you've been running IMail for a long time and have never updated that file yourself, it will have old entries from the original file that version 8.x installers used. You will either need to customize that file manually yourself or use the updated files listed on the Ipswitch Support site and then use the antispamseeder.

Link for the updated files on the Ipswitch Support Site:
http://www.ipswitch.com/support/imail/index.asp

Scroll about 2/3's of the way down that page...

RE: URL Domain Black List... what's the point?

eyleron — Thu, 08 Nov 2007 11:53:06 GMT

OK, so now that we all know what the URL Domain Black List does, let's return to the topic.

What's the point... if legitimate addresses keep showing up in the list?

Last month, we had live.com and some other Microsoft address in the list.
This month, I found gotomeeting.com in there.
GoToMeeting is a pretty popular desktop share / conferencing solution.
Live.com is Microsoft's new branding. You might as well blacklist HotMail.com and Microsoft.com!

What's the deal? If these addresses are being added by automated system, IPSWITCH needs to ensure that they're not responding to people trying smear the name of legitimate companies. Maybe their automated systems are susceptible to corruption? They need to use humans to vet these lists, or we just can't use them!

Next, wellsfargo.com and nwa.com and gap.com show up in there!

RE: URL Domain Black List... what's the point?

John T — Fri, 27 Oct 2006 02:44:31 GMT

DNS blacklists check the IP address of the connecting server (and/or others before it). It does not check the from address.

URL blacklists check the header and/or subject and/or body for URLs contained on the list.

Most lists of both types are dynmaic although some are static or semi-static.

RE: URL Domain Black List... what's the point?

Rayzback — Thu, 26 Oct 2006 23:35:45 GMT

Watch blocking things like stuff.com because that will block legitimatestuff.com too I think... not completely sure

RE: URL Domain Black List... what's the point?

JulianEGI — Thu, 26 Oct 2006 23:30:41 GMT

Yeah, that makes sense. I didn't know that URL blacklists check for links inside of the email.

That still doesn't explain though how legitimate servers end up on that list.

RE: URL Domain Black List... what's the point?

Rayzback — Thu, 26 Oct 2006 23:25:09 GMT

Doesn't this look for URL links in the message from the domains listed... like http://buymycrap.com

Where DNS blacklist look at the domain the mail is being sent from... like Ahole@buymycrap.com

Many spammers want you to see their add and visit their site by clicking the link in the message. Others try and get you to change your password by having you click on a link that really goes to their spoofed site.

As far as I know they aren't updated. I go through our companies junk mail (that makes it through Imail) every couple weeks and add any domains that use hyperlinks to the list.

Since most spammers use a method like junk1.buymycap.com the first week and junk2.bymycrap.com the second, etc.buymycrap.com ..... I just put buymycrap.com in the list....

Hope this helps...

URL Domain Black List... what's the point?

JulianEGI — Thu, 26 Oct 2006 18:16:08 GMT

We use IMail 2006.1 with Premium Anti-Spam. Recently I noticed that a lot of false positives are generated by the URL Domain Black List (Header: X-IMAIL-SPAM-URL-DBL). This list contains legitimate domains such as live.com and lulu.com .

Here are my questions:

1) What is the purpose of the URL Domain Black List, if there are plenty of DNS Blacklists out there, that are actively managed?

2) How is that list updated? Does the Anti-Spam automatically add domains? Shouldn't the list be automatically be updated and downloaded from Ipswitch?

Is anyone else having problems with this list? Anybody has any repercussions from disabling the list?

Thanks,
Julian