Discuss September 2004

discuss@lists.surbl.org

62 participants
229 discussions

RE: Start an IP list to block?
by Kristopher Austin 10 Sep '04

10 Sep '04

It seems to me that Jeff is talking about a way of implementing what Chris is talking about. If not, then it still seems like a great compromise! I love the idea! Kris -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Friday, September 10, 2004 9:44 AM To: SURBL Discussion list; Spamassassin-Talk Subject: Re: Start an IP list to block? On Friday, September 10, 2004, 7:33:10 AM, Chris Santerre wrote: >>From: Jeff Chan [mailto:jeffc@surbl.org] >>On Thursday, September 9, 2004, 5:34:05 PM, Jeff Chan wrote: >>> My first pass at cleaning the resolved IP data would be to take >>> the to 70th percentile of IP addresses and only use those to >>> check domain resolved IPs to. It's not perfect, but it should >>> cut down on the uncertainty. >> >>I should add that this mostly applies to data where we have a >>constant feed of actual spam reports such as from SpamCop. It >>does not apply as strongly to data sources where we only have a >>unitary list of domains, for example where each domain appears >>once over the whole list. Though even there, it applies weakly, >>for example a dozen domains that all resolve to the same network >>probably could be used to bias future domains appearing in the >>same network towards list inclusion. >> >>But when you have a stream of reports about the *same domain*, >>then you can get better statistics about that domain or it's >>resolved IP. There simply more data to work with in more >>meaningful ways. > Holy confusion! I can't tell where you are on this subject now Jeff :) > Are you saying , that if we get really good data like what was in my > original post, and we keep the data in the 90th percentile area, then we > might possibly be able to list the IP hosts and have SURBL check against it? > If so..I'm up for that. > Granted it would take a little more research then just a domain listing, but > I think the benefits are very good. Especially if we keep it only high > ranking IP offenders. I mean, we may add less then 50 IPs a year? Just the > really nasty spammers. If you're talking about adding resolved IP addresses to SURBLs, no we're not going to do that. :-( What I'm talking about is an internal process where we keep track of resolved IP addresses and use that to add new domains to SURBLs sooner if they resolve to a similar IP range (probably /24s). We would use the resolved IP addresses to add domains to sc.surbl.org and possibly other lists sooner. Most would probably get added on the first report. :-) http://www.surbl.org/faq.html#numbered Jeff C.

1 0

RE: [SURBL-Discuss] RE: Start an IP list to block?
by Matthew Wilson 10 Sep '04

10 Sep '04

If it helps, I agree with Chris. One point to note: Virtual hosters can't use IP addresses in their URLs, because the web server needs a http host header to differentiate between all the possible virtual hosted sites. However, it really wouldn't be difficult to have the SURBL URI detection algorithm find dotted quad URLs, and store these in the SURBL database just like any other domain name... -Matthew -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Chris Santerre Sent: Thursday, September 09, 2004 4:19 PM To: 'Raymond Dijkxhoorn'; Alex Broens Cc: SURBL Discussion list (E-mail); Spamassassin-Talk (E-mail); users-return-15498-sa-list=alexb.ch(a)spamassassin.apache.org Subject: [SURBL-Discuss] RE: Start an IP list to block? >-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Thursday, September 09, 2004 5:10 PM >To: Alex Broens >Cc: users-return-15498-sa-list=alexb.ch(a)spamassassin.apache.org; SURBL >Discussion list (E-mail); Spamassassin-Talk (E-mail) >Subject: Re: Start an IP list to block? > > >Hi! > >> Chris, Raymond , >> >> I went thru a random few of these and they're were listed at >Spamhaus. >> Using spamhaus at SMTP level or SA doing RBL lookups would >have caught and >> stopped them... Spamcop probably has quite a few of them >listed as well > >No, that wont work. The spams are sended in via trojans/proxys only the >websites are static. SOME are blocked with DSBL and so but most of the >time they start a spamrun with a fresh set it seems. > >So yes, they are inside spamhaus, but only the websites, didnt see >mails sended out from there (yet). > Agreed. They may be listed, but for mail, not hosting. They use other IPs to send, and keep the host on their IPs. SOme of the bigger spammers are saying "Screw SURBL, I've got enough dough to get a new domain for every run, and it still remains profitible." To which we have 2 replies: 1) Those registers are going to feel some rath soon from the antispam community. 2) We gonna mark the IP, you silly little monkeys! I think the code should be added into the SURBL code. It would need to be a patch for SA 3.0 as it is prbly too late for it to go in now. But it should be simple to grab the IP of the 20 random URL domains and match against SURBL as well. Then they can purchase as many domains as they like, won't matter a bit. --Chris _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

5 7

RE: [SURBL-Discuss] RE: Start an IP list to block?
by Chris Santerre 10 Sep '04

10 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, September 09, 2004 6:16 PM >To: SURBL Discuss; SpamAssassin Users >Subject: Re: [SURBL-Discuss] RE: Start an IP list to block? > > >On Thursday, September 9, 2004, 2:26:37 PM, Chris Santerre wrote: > > >>>-----Original Message----- >>>From: jm(a)jmason.org [mailto:jm@jmason.org] >>>Sent: Thursday, September 09, 2004 5:17 PM >>>To: Raymond Dijkxhoorn >>>Cc: Alex Broens; >>>users-return-15498-sa-list=alexb.ch(a)spamassassin.apache.org; SURBL >>>Discussion list (E-mail); Spamassassin-Talk (E-mail) >>>Subject: Re: Start an IP list to block? >>> >>> >>>-----BEGIN PGP SIGNED MESSAGE----- >>>Hash: SHA1 >>> >>> >>>Raymond Dijkxhoorn writes: >>>> Hi! >>>> >>>> > Chris, Raymond , >>>> > >>>> > I went thru a random few of these and they're were listed >>>at Spamhaus. >>>> > Using spamhaus at SMTP level or SA doing RBL lookups would >>>have caught and >>>> > stopped them... Spamcop probably has quite a few of them >>>listed as well >>>> >>>> No, that wont work. The spams are sended in via >>>trojans/proxys only the >>>> websites are static. SOME are blocked with DSBL and so but >>>most of the >>>> time they start a spamrun with a fresh set it seems. >>>> >>>> So yes, they are inside spamhaus, but only the websites, >>>didnt see mails >>>> sended out from there (yet). >>> >>>Are their NS records listed in the SBL? >>> >>>- --j. > >> No, but extremely easy to add. However....I'm not sure Jeff >would like that. >> Would have to be a seperate list. > >> -_Chris > >ADD THEM TO SBL. DO NOT ADD THEM TO SURBL. > >Holy fsck guys! We have a good thing going here. We're put a >lot of work into it so far, and it's working pretty well. Let's >not tear apart the SURBL project, OK? > >Give me a chance to make some improvements in the next version >of the data engine. It will take into account resolved IPs >and get new domains onto the lists sooner. > ahahahahahha...lookout....he's gonna blow! :-) I didn't see the bigger picture here. Didn't know that SA devs have written it that way because SC already did this. Knowing now that SC already does this, I wouldn't want the extra work for SURBL. So...on this idea...your safe. One never knows what freaky idea I might come up with tomorrow ;) --Chris (Still ying to Jeff's yang!)

2 1

RE: [SURBL-Discuss] whitelist senderbase top domains?
by Chris Santerre 10 Sep '04

10 Sep '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, September 10, 2004 6:16 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] whitelist senderbase top domains? > > >On Friday, September 10, 2004, 3:09:35 AM, Alex Broens wrote: >> Jeff Chan wrote: >>> The >>> question is do these ISP' own domain names appear as >>> URIs in spams? > >> if you define 409's and all kinds of beggar-mail as >> spam/unsolicited/notrequested, yes... >> though I don't have any msgs to prove it right now... > >LOL I asked the wrong question too. The real question is >should we block all email that contains those ISPs' URIs? > >Should everyone who uses webmail to send a message from >hinet.net be blocked? I don't think so. AAAAAHHHH hinet and kornet are the scurge of my exhistence!!!!! I can't blacklist because our vendors use these. Bastards! :) Drives me insane I can't just firewall asia! Sorry for anybody here on the list from asia, but I'm sure you know why! Hell the whole PacRim could be bit bucketed for so many end users! They should make it an option when home users sign up for an account :) --Chris

2 1

test.surbl.org
by Leonardo Helman 10 Sep '04

10 Sep '04

Hi, Should I send this to spamassasin list? I've done some tests on mailscanner-spamcopuri-spamassasin, and the beast marks messages with spam uri correctly, but I couldn't make it report anything on: (I'm checking for 127.0.0.2) test.surbl.org (It consults only on surbl.org not on test.surbl.org) That's because it only checks the registered domain and not its subdomains? So if someone send me a mail with a http://spam.not-listed-as-spammer.com in it, it will not hit any surbl. Is this correct? host -t any test.surbl.org.multi.surbl.org reports: test.surbl.org.multi.surbl.org. text "multi.surbl.org permanent test point" test.surbl.org.multi.surbl.org. has address 127.0.0.2 Saludos -- Leonardo Helman Pert Consultores Argentina

4 6

Large ham corpus hits against SURBLs
by Jeff Chan 10 Sep '04

10 Sep '04

I've extracted the plaintext * URI domains from a 14 GB ham corpus, taken the top 70th and 85th percentiles of the most frequently occurring domains and compared them against all SURBL domains, the master list of which can be found at: http://spamcheck.freeapp.net/multi.domains.sort At the 70th percentile level, there were only two matches: automotivedigest.com processrequest.com At the 85th percentile there were a few more: automotivedigest.com chartshop.com ct002.com dakotaairparts.com hallogram.com infoaeroplan.ca investorsinsight.com processrequest.com sitepronews.com topachat.com These are arguably false positives. What do we know about them. Should we whitelist or not whitelist any? * looking at plaintext has advantages and disadvantages: 1. quick and easy 2. does not "double or triple count" messages which also have BASE 64 or quoted printable encoded versions of the same URIs 3. misses some such encoded URIs which don't have plaintext equivalents in a different part of the message Nonetheless the data are still probably generally useful. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 3

more FPs
by John Lundin 10 Sep '04

10 Sep '04

Finally got around to running geturi 0.5 on some recent submitted FPs and ham. I have permission to forward the original messages if needed. codefeed .com -0.2000 (1) gittigidiyor .com -0.2500 (1) The first, from a java newsletter blog ref, has no NANAS hits. Created Feb '03. I can't read the language on the second, from a quoted sig in a MySQL newsletter, but it has one NANAS hit and was created in Feb '00. Probably not controversial. destinationsite .com -3.0000 (1) ntcr .us -0.3333 (1) These two are. Both are from a Jupitermedia Web Events newsletter. And yes, the guy who submitted it signed up for 'em. I already asked. Both with netcreations RPs. First registered Jan '98, second Nov '03, so they aren't fly-by-night. (Crawl by night?) destinationsite has seventy-eight widely varied NANAS hits, and their web page redirects to postmasterdirect .com, describing them as, "The most trusted source of 100% opt-in email customer acquisition solutions." ntcr .us has forty-three less varied NANAS hits, site unviewable with my browser. (I sent the latter in once before for a DS hit, but it's in WS now.) And from personal email is a possibly worse pair... from a local linux UG newsletter that quotes a marketpro computer show flyer: emailfactory .com and emf0 .com (apparently same folks), being used as a web bug and unsub address, respectively. 183 and 22 NANAS, created oct '98 and feb '03. "Precision opt-in email marketing tools." Unfortunately, I know at least one other person who is (or was) subscribed to the mailing list for this show, which comes through here regularly. You choose if you want to hold your nose and remove 'em. And that's it out of 4991 messages checked, after removal of FFP's. Oh, yes, before I forget, a testimonial: Earlier this year a friend and I jointly built three computers, one of which is the box I'm writing this on. He did price comparisons on components. And one of his messages on the topic was flagged as spam. I checked, and one vendor site had been flagged by ws.surbl.org. Naturally, I suggested that the vendor in question wasn't a good choice. We ordered elsewhere. That correspondence just showed up in my corpora. Their site was still in WS, so I checked. Hmm. Web page down, what else? So I googled, and found that they were not merely spammy but had been fraudulent! So surbl saved me grief even outside of the email filtering. :-) Another use for a wonderful tool. -- lundin(a)cavtel.net "The chance of forgetting something is directly proportional to.. to.. uh.."

4 5

Whitelist Please
by Bitz 10 Sep '04

10 Sep '04

http://www.funnygreetings.com Listed at WS_URI_RBL X-Spam-Status: No, hits=5.1 required=10.0 tests=RATWR10_MESSID=0.111, WS_URI_RBL=5 Thanks, -b.

10 30

Start an IP list to block?
by Chris Santerre 10 Sep '04

10 Sep '04

OK, this isn't the first time we've had this discussion, but Raymond and I felt this should be made public again. He ran thru some tests of 1500+ domains and found the following data. Looks like they maybe send from zombies, and never their hosts. IPs are similar across the board. So is there a way to use the IP info in a good way? Could SA or SURBL do a quick ping of the URL and match against a URL? This would allow us to simply list 1 IP instead of all these domains. (I'm well aware of virtual hosts! So only the filthiest of spammers would be put on this IP list. Then their IP better boot them or anyone hosted on that box would feel the rath of SURBL.) --Chris > >See this list, most of them all use the same IP, pill spammers... > >abducted2550pirrs.com has address 219.254.32.111 >acdfiaj.info has address 219.254.32.69 >agronomy9603dryg.com has address 219.254.32.111 >arrowhead2272tads.com has address 219.254.32.111 >asdeczxa.com has address 219.254.32.97 >atonement9529pirrs.com has address 219.254.32.111 >auguring7087pirrs.com has address 219.254.32.111 >authorise5969rneds.us has address 219.254.32.111 >baby29.com has address 219.254.32.99 >baby30.com has address 219.254.32.99 >baby31.com has address 219.254.32.99 >baby32.com has address 219.254.32.99 >baby33.com has address 219.254.32.99 >baby34.com has address 219.254.32.99 >bankloanunitedtrust.com has address 219.254.32.115 >baroque9879biz.com has address 219.254.32.111 >baste7039tads.com has address 219.254.32.111 >befalling7627tads.com has address 219.254.32.111 >benzine6086dryg.com has address 219.254.32.111 >beyond735dryg.com has address 219.254.32.111 >boon3678rx.com has address 219.254.32.111 >boon3678rx.com has address 219.254.32.111 >brutally6279dryg.com has address 219.254.32.111 >bull2903pirrs.com has address 219.254.32.111 >bulrush5448nx.com has address 219.254.32.111 >burnie5422pinn.com has address 219.254.32.111 >buying4212pirrs.com has address 219.254.32.111 >cannery7310pinn.com has address 219.254.32.111 >chapter1224dryg.com has address 219.254.32.111 >childish7509tads.com has address 219.254.32.111 >cleat7228pirrs.com has address 219.254.32.111 >cobra133pirrs.com has address 219.254.32.111 >cocoa7878dryg.com has address 219.254.32.111 >collocutor9120dryg.com has address 219.254.32.111 >comparable6635tads.com has address 219.254.32.111 >crane4522dryg.com has address 219.254.32.111 >destitute6182drygs.com has address 219.254.32.111 >dhl7809tads.com has address 219.254.32.111 >diet33.com has address 219.254.32.99 >disbelief4546pinn.com has address 219.254.32.111 >disjoint5156drygs.com has address 219.254.32.111 >double182dryg.com has address 219.254.32.111 >dsmnfw.com has address 219.254.32.97 >duodenum1797nx.com has address 219.254.32.111 >earwax8995rneds.com has address 219.254.32.111 >edbhadj.info has address 219.254.32.69 >ejebemc.info has address 219.254.32.69 >embodiment6853rneds.com has address 219.254.32.111 >emerge2198dryg.com has address 219.254.32.111 >envumil.com has address 219.254.32.71 >euglena9723biz.us has address 219.254.32.111 >eventual5615tads.com has address 219.254.32.111 >fabled6151dryg.com has address 219.254.32.111 >faintly5417drygs.com has address 219.254.32.111 >faithless4562dryg.com has address 219.254.32.111 >fall3829nx.com has address 219.254.32.111 >fall3829nx.com has address 219.254.32.111 >gait1492pinn.com has address 219.254.32.111 >gjakwfal.com has address 219.254.32.77 >glassy5030nx.com has address 219.254.32.111 >grand2packz.com has address 219.254.32.121 >gui7176biz.com has address 219.254.32.111 >hayfield6948tads.com has address 219.254.32.111 >hayride5669nx.com has address 219.254.32.111 >healing7489biz.com has address 219.254.32.111 >higcijn.info has address 219.254.32.69 >highball9334tads.com has address 219.254.32.111 >home9724dryg.com has address 219.254.32.111 >humpback726pirrs.com has address 219.254.32.111 >imbed3506pinn.com has address 219.254.32.111 >indenting1562pill.com has address 219.254.32.111 >jetskiasl.com has address 219.254.32.77 >joliet5195biz.com has address 219.254.32.111 >kalmyk3865drygs.com has address 219.254.32.111 >kgajgieag.com has address 219.254.32.77 >laziness6976dryg.com has address 219.254.32.111 >lksdns.info has address 219.254.32.72 >luggage3300drygs.com has address 219.254.32.111 >mad1049biz.com has address 219.254.32.111 >madness1926tads.com has address 219.254.32.111 >med12now.com has address 219.254.32.111 >medic7.com has address 219.254.32.111 >medspro7.com has address 219.254.32.111 >mhjgcgd.info has address 219.254.32.69 >microchip9614biz.com has address 219.254.32.111 >milan1517biz.com has address 219.254.32.111 >monotone8601biz.com has address 219.254.32.111 >motto4080nx.com has address 219.254.32.111 >n4zyrtfast.com has address 219.254.32.121 >negater6398tads.com has address 219.254.32.111 >omni8306tads.com has address 219.254.32.111 >oneself5360pirrs.com has address 219.254.32.111 >optimize5129drug.com has address 219.254.32.111 >perigree4124biz.com has address 219.254.32.111 >phoneme6858biz.com has address 219.254.32.111 >pilz2004.com has address 219.254.32.111 >porno7775tads.com has address 219.254.32.111 >pottage6834pirrs.us has address 219.254.32.111 >prairie4725biz.com has address 219.254.32.111 >praise4m3ds.com has address 219.254.32.121 >pressman1177nx.com has address 219.254.32.111 >pretzel3736pills.com has address 219.254.32.111 >primness6560nx.us has address 219.254.32.111 >procuress4029pinn.com has address 219.254.32.111 >profligacy8404nx.com has address 219.254.32.111 >project2089biz.com has address 219.254.32.111 >prototypic6263nx.com has address 219.254.32.111 >qqqwertypoid.com has address 219.254.32.121 >quits8304drygs.com has address 219.254.32.111 >ram7888dryg.com has address 219.254.32.111 >rata2536tads.com has address 219.254.32.111 >recruited2055rneds.com has address 219.254.32.111 >replenish4787nx.com has address 219.254.32.111 >reset3166tads.com has address 219.254.32.111 >resist9528rneds.com has address 219.254.32.111 >rigor7247rneds.com has address 219.254.32.111 >rocked4915dryg.com has address 219.254.32.111 >rounded9866biz.com has address 219.254.32.111 >rustic9925rneds.com has address 219.254.32.111 >sable8898dryg.com has address 219.254.32.111 >safflower170dryg.com has address 219.254.32.111 >sahib5037biz.com has address 219.254.32.111 >saltine3407rneds.com has address 219.254.32.111 >sanguine882rneds.com has address 219.254.32.111 >sarah6314pirrs.com has address 219.254.32.111 >sash4453biz.com has address 219.254.32.111 >sealer6455biz.com has address 219.254.32.111 >sergeancy8489pinn.com has address 219.254.32.111 >sharper7539biz.com has address 219.254.32.111 >showplace1294pirrs.com has address 219.254.32.111 >shying1845biz.com has address 219.254.32.111 >sister31.com has address 219.254.32.99 >situp6764biz.com has address 219.254.32.111 >skunk9827drygs.com has address 219.254.32.111 >sky5490pirrs.com has address 219.254.32.111 >smnsdno.com has address 219.254.32.97 >soaker1916tads.com has address 219.254.32.111 >solaria8488nx.com has address 219.254.32.111 >soluble7830pinn.com has address 219.254.32.111 >speculate2541drygs.com has address 219.254.32.111 >spoilt7777rneds.com has address 219.254.32.111 >squares9697rx.com has address 219.254.32.111 >statutory1625pi11s.us has address 219.254.32.111 >stiffed5912tads.com has address 219.254.32.111 >stony4921rneds.com has address 219.254.32.111 >subjective1648biz.com has address 219.254.32.111 >sublunary1132nx.com has address 219.254.32.111 >sue3483pinn.com has address 219.254.32.111 >sufferable9011rneds.com has address 219.254.32.111 >summit4716drygs.com has address 219.254.32.111 >swaged5905biz.com has address 219.254.32.111 >techspyerase.biz has address 219.254.32.75 >tentative8691pinn.com has address 219.254.32.111 >terminable3646drygs.com has address 219.254.32.111 >them1275pinn.com has address 219.254.32.111 >tidiness6516drygs.com has address 219.254.32.111 >tiled2118rneds.com has address 219.254.32.111 >tingle3751drygs.com has address 219.254.32.111 >toaster7461drygs.com has address 219.254.32.111 >toothsome9441nx.com has address 219.254.32.111 >tragicomic8159drygs.com has address 219.254.32.111 >transient3126drygs.com has address 219.254.32.111 >trihedral2449rneds.com has address 219.254.32.111 >undefended7133pinn.com has address 219.254.32.111 >underload9603pirrs.com has address 219.254.32.111 >vcr1047pinn.com has address 219.254.32.111 >warriors221pinn.com has address 219.254.32.111 >wasserman5540pinn.com has address 219.254.32.111 >weaponless8185biz.com has address 219.254.32.111 >webgreencard.biz has address 219.254.32.75 >wetly3520pirrs.com has address 219.254.32.111 >winning7272tads.com has address 219.254.32.111 >yarmulke7279biz.com has address 219.254.32.111 >zulu5812pinn.com has address 219.254.32.111 > >akianapikas.org has address 201.12.78.140 >akianapotkasi.org has address 201.12.78.140 >akianasayara.org has address 201.12.78.140 >akianasofikals.org has address 201.12.78.140 >bertikasenofakel.org has address 201.12.78.140 >bertikasfenium.org has address 201.12.78.140 >bertikasfrakles.org has address 201.12.78.140 >bertikaskitaros.org has address 201.12.78.140 >bertikasporchma.org has address 201.12.78.140 >bertikaspotkasi.org has address 201.12.78.140 >bertikassayara.org has address 201.12.78.140 >biscamasornamiolis.org has address 201.12.78.140 >blacomanikas.org has address 201.12.78.140 >bortsimisbortsimis.org has address 201.12.78.140 >bortsimisfenium.org has address 201.12.78.140 >bortsimisinacalo.org has address 201.12.78.140 >bortsimispazda.org has address 201.12.78.140 >bortsimispitovshe.org has address 201.12.78.140 >bortsimispritkeras.org has address 201.12.78.140 >bortsimissimptomps.org has address 201.12.78.140 >bortsimisvaldisimus.org has address 201.12.78.140 >coolorgfunky.org has address 201.12.78.140 >crosstonfalls.org has address 201.12.78.140 >directionasios.org has address 201.12.78.140 >enofakelfrakles.org has address 201.12.78.140 >enofakelinacalo.org has address 201.12.78.140 >enofakelporchma.org has address 201.12.78.140 >enofakelpotkasi.org has address 201.12.78.140 >enofakelsofikals.org has address 201.12.78.140 >enomybertikas.org has address 201.12.78.140 >enomybortsimis.org has address 201.12.78.140 >enomyenofakel.org has address 201.12.78.140 >enomyfenium.org has address 201.12.78.140 >enomynimphos.org has address 201.12.78.140 >enomyownaros.org has address 201.12.78.140 >enomypazda.org has address 201.12.78.140 >enomypoises.org has address 201.12.78.140 >enomyxesros.org has address 201.12.78.140 >fagonyakiana.org has address 201.12.78.140 >fagonyxesros.org has address 201.12.78.140 >fakilafapinatos.org has address 201.12.78.140 >falloutstudios.org has address 201.12.78.140 >fbgba3kglads.org has address 201.12.78.140 >feniuminacalo.org has address 201.12.78.140 >feniumpotkasi.org has address 201.12.78.140 >feniumpritkeras.org has address 201.12.78.140 >feniumsofikals.org has address 201.12.78.140 >feniumtronits.org has address 201.12.78.140 >feniumxesros.org has address 201.12.78.140 >fraklesneynano.org has address 201.12.78.140 >fraklespikas.org has address 201.12.78.140 >fraklestronits.org has address 201.12.78.140 >halepoley.org has address 201.12.78.140 >inacalobertikas.org has address 201.12.78.140 >inacaloenomy.org has address 201.12.78.140 >inacalokitaros.org has address 201.12.78.140 >inacalomipatarios.org has address 201.12.78.140 >inacalopoises.org has address 201.12.78.140 >inacalosayara.org has address 201.12.78.140 >inacalosofikals.org has address 201.12.78.140 >inacalovaldisimus.org has address 201.12.78.140 >indakitosbortsimis.org has address 201.12.78.140 >indakitosenofakel.org has address 201.12.78.140 >indakitosinacalo.org has address 201.12.78.140 >indakitospoises.org has address 201.12.78.140 >indakitosxesros.org has address 201.12.78.140 >katanataropikas.org has address 201.12.78.140 >kitarosfenium.org has address 201.12.78.140 >kitarosmipatarios.org has address 201.12.78.140 >kitarosvaldisimus.org has address 201.12.78.140 >lopikranius.org has address 201.12.78.140 >manicsenofakel.org has address 201.12.78.140 >manicssofikals.org has address 201.12.78.140 >manicsvaldisimus.org has address 201.12.78.140 >mipatariosakiana.org has address 201.12.78.140 >mipatariosbortsimis.org has address 201.12.78.140 >mipatariossimptomps.org has address 201.12.78.140 >mipatariostronits.org has address 201.12.78.140 >neynanopotkasi.org has address 201.12.78.140 >nimphosfrakles.org has address 201.12.78.140 >nimphosinacalo.org has address 201.12.78.140 >nimphosindakitos.org has address 201.12.78.140 >nimphospoises.org has address 201.12.78.140 >nimphosxesros.org has address 201.12.78.140 >noahomakila.org has address 201.12.78.140 >ownarosfrakles.org has address 201.12.78.140 >ownarosneynano.org has address 201.12.78.140 >ownarosownaros.org has address 201.12.78.140 >ownarosporchma.org has address 201.12.78.140 >ownarossofikals.org has address 201.12.78.140 >ownarosxesros.org has address 201.12.78.140 >pazdaenomy.org has address 201.12.78.140 >pazdafrakles.org has address 201.12.78.140 >pazdanimphos.org has address 201.12.78.140 >pazdaownaros.org has address 201.12.78.140 >pazdapikas.org has address 201.12.78.140 >pikasfagony.org has address 201.12.78.140 >pikaskitaros.org has address 201.12.78.140 >pikasownaros.org has address 201.12.78.140 >pikasporchma.org has address 201.12.78.140 >pikassofikals.org has address 201.12.78.140 >pikasxesros.org has address 201.12.78.140 >pitovshebortsimis.org has address 201.12.78.140 >poisesbortsimis.org has address 201.12.78.140 >poisesfenium.org has address 201.12.78.140 >poisesneynano.org has address 201.12.78.140 >poisesnimphos.org has address 201.12.78.140 >poisesownaros.org has address 201.12.78.140 >poisespazda.org has address 201.12.78.140 >poisespikas.org has address 201.12.78.140 >poisespotkasi.org has address 201.12.78.140 >poisespritkeras.org has address 201.12.78.140 >poisesvaldisimus.org has address 201.12.78.140 >polisheneynano.org has address 201.12.78.140 >polishepoises.org has address 201.12.78.140 >porchmafenium.org has address 201.12.78.140 >porchmainacalo.org has address 201.12.78.140 >porchmaindakitos.org has address 201.12.78.140 >porchmamanics.org has address 201.12.78.140 >porchmaownaros.org has address 201.12.78.140 >porchmapikas.org has address 201.12.78.140 >porchmaxesros.org has address 201.12.78.140 >postfallshotels.org has address 201.12.78.140 >potkasimipatarios.org has address 201.12.78.140 >potkasiownaros.org has address 201.12.78.140 >potkasipotkasi.org has address 201.12.78.140 >potkasipritkeras.org has address 201.12.78.140 >pritkerasenofakel.org has address 201.12.78.140 >pritkerasmipatarios.org has address 201.12.78.140 >pritkerasnimphos.org has address 201.12.78.140 >pritkeraspoises.org has address 201.12.78.140 >pritkerassofikals.org has address 201.12.78.140 >pritkerasxesros.org has address 201.12.78.140 >sayaraenofakel.org has address 201.12.78.140 >sayaramipatarios.org has address 201.12.78.140 >sayarapoises.org has address 201.12.78.140 >sayarasofikals.org has address 201.12.78.140 >simptompsakiana.org has address 201.12.78.140 >simptompsfenium.org has address 201.12.78.140 >simptompskitaros.org has address 201.12.78.140 >sofikalsfenium.org has address 201.12.78.140 >sofikalsindakitos.org has address 201.12.78.140 >sofikalsmanics.org has address 201.12.78.140 >sofikalsownaros.org has address 201.12.78.140 >sofikalspikas.org has address 201.12.78.140 >sofikalsvaldisimus.org has address 201.12.78.140 >sopinaskarantinas.org has address 201.12.78.140 >testneworg.org has address 201.12.78.140 >tronitsindakitos.org has address 201.12.78.140 >tronitspolishe.org has address 201.12.78.140 >tronitssayara.org has address 201.12.78.140 >tronitsxesros.org has address 201.12.78.140 >valdisimusbertikas.org has address 201.12.78.140 >valdisimusfenium.org has address 201.12.78.140 >valdisimuspazda.org has address 201.12.78.140 >valdisimuspitovshe.org has address 201.12.78.140 >valdisimusporchma.org has address 201.12.78.140 >valdisimussofikals.org has address 201.12.78.140 >xesrosfrakles.org has address 201.12.78.140 >xesrosnimphos.org has address 201.12.78.140 >xesrospitovshe.org has address 201.12.78.140 >xesrospoises.org has address 201.12.78.140 >xesrosporchma.org has address 201.12.78.140 > >mypillsbrand.com has address 200.139.104.4 >mypillsvalue.com has address 200.139.104.4 >mypillsvalues.com has address 200.139.104.4 >mypillswebsite.com has address 200.139.104.4 >mythingscentral.com has address 200.139.104.4 >ourpillscomplete.com has address 200.139.104.4 >ourpillscompleted.com has address 200.139.104.4 >ourpillsdirect.com has address 200.139.104.4 >ourpillsforme.com has address 200.139.104.4 >ourpillshome.com has address 200.139.104.4 >ourpillsnet.com has address 200.139.104.4 >ourpillsweb.com has address 200.139.104.4 >ourpillswebsites.com has address 200.139.104.4 >thepillsforall.com has address 200.139.104.4 >thepillsspot.com has address 200.139.104.4 >thepillswebsites.com has address 200.139.104.4 >yourpills2k.com has address 200.139.104.4 >yourthings2k.com has address 200.139.104.4 >yourthingscentral.com has address 200.139.104.4 > >49fmsas.com has address 221.143.42.199 >49fmsas.com has address 221.143.42.178 >95j63s.com has address 221.143.42.199 >95j63s.com has address 221.143.42.178 >fbb4all.info has address 221.143.42.87 >flhiot.com has address 221.143.42.178 >flhiot.com has address 221.143.42.199 >freeblackberry.info has address 221.143.42.87 >gbhew.com has address 221.143.42.199 >gbhew.com has address 221.143.42.178 >lendingflow.net has address 221.143.42.34 >lqeriod.com has address 221.143.42.199 >lqeriod.com has address 221.143.42.178 >mypills2k.com has address 221.143.42.246 >mypills4all.com has address 221.143.42.50 >mythings2004.com has address 221.143.42.246 >mythings2k.com has address 221.143.42.50 >ourpillsfarm.com has address 221.143.42.246 >ourpillslive.com has address 221.143.42.246 >ourpillsmall.com has address 221.143.42.50 >ourpillswebs.com has address 221.143.42.246 >realfreemobile.us has address 221.143.42.87 >reoigb.com has address 221.143.42.199 >reoigb.com has address 221.143.42.178 >thepillsabsolute.com has address 221.143.42.50 >thepillsforus.com has address 221.143.42.246 >thepillssupply.com has address 221.143.42.246 >thepillswebsitess.com has address 221.143.42.246 >thoweu.com has address 221.143.42.178 >thoweu.com has address 221.143.42.199 >tnjjrtw.com has address 221.143.42.199 >tnjjrtw.com has address 221.143.42.178 >tnoiero.com has address 221.143.42.199 >tnoiero.com has address 221.143.42.178 >yourpillsvalue.com has address 221.143.42.50 >yourpillswebs.com has address 221.143.42.246 >yourthingschoice.com has address 221.143.42.246 >yourthingscompleted.com has address 221.143.42.246 >yourthingsdepot.com has address 221.143.42.50 >yourthingsfarm.com has address 221.143.42.246 >yourthingsspot.com has address 221.143.42.246 >ytuow.com has address 221.143.42.199 >ytuow.com has address 221.143.42.178 > >attractivebodysite.com has address 219.129.20.250 >beautyherbalimplement.com has address 219.129.20.208 >beautysupporters.com has address 219.129.20.208 >bestofhealthproducts.com has address 219.129.20.250 >bestproductclicks.com has address 219.129.20.250 >bodypamperingproducts.com has address 219.129.20.208 >doomedtobeauty.com has address 219.129.20.250 >everycan.com has address 219.129.20.247 >fitbodyinfo.com has address 219.129.20.250 >galamedicalherbs.com has address 219.129.20.208 >genialsolutionweb.com has address 219.129.20.250 >globalwellnessnews.com has address 219.129.20.250 >glossypharmaproducts.com has address 219.129.20.250 >greatfreeinfoblast.com has address 219.129.20.250 >greenleafshealth.com has address 219.129.20.208 >healthmegasuperstore.com has address 219.129.20.250 >healthorizon.com has address 219.129.20.208 >healthpluswellness.com has address 219.129.20.250 >healthproductslideshow.com has address 219.129.20.208 >healthydayitems.com has address 219.129.20.208 >healthydaymall.com has address 219.129.20.208 >healthydayneccesity.com has address 219.129.20.250 >idvitedtojoinherbsclub.com has address 219.129.20.208 >loudhealthmessage.com has address 219.129.20.250 >masshealthboom.com has address 219.129.20.250 >mosttrustedherbalsite.com has address 219.129.20.208 >newwealthline.com has address 219.129.20.208 >singletrustedsite.com has address 219.129.20.250 >superseductionproducts.com has address 219.129.20.208 >supporthealthproduct.com has address 219.129.20.208 >ultrasumpleproducts.com has address 219.129.20.208 >uniquelifechoice.com has address 219.129.20.250 >vitalhealthitems.com has address 219.129.20.208 >vividimportantitems.com has address 219.129.20.208 >waytoamazefriends.com has address 219.129.20.250 >worldunitedhealth.com has address 219.129.20.250 >yourwellnesscontainer.com has address 219.129.20.250 > >Bye, >Raymond. >

8 23

Re: [SURBL-Discuss] Re: Start an IP list to block?
by Frank Ellermann 10 Sep '04

10 Sep '04

Jeff Chan wrote: > Given that hosting and redirection are not zombied (yet), Won't take long. Thousands of SpamCast zombies blocked to use port 25 can't only DDoS the whole day, so doing some redirections is an obvious idea. Bye, Frank

1 0

← Newer
1
...
9
10
11
12
13
14
15
...
23
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss September 2004