Discuss November 2005

discuss@lists.surbl.org

16 participants
19 discussions

Re: [SURBL-Discuss] Re: tripod dot com
by List Mail User 10 Nov '05

10 Nov '05

>... >On Tuesday, November 8, 2005, 11:55:36 AM, Dhawal Doshy wrote: >> Catherine Hampton writes: > >>>> Thanks Jeff, i'll continue doing the spamcop reporting. If only there >>>> was some way for mass submission (i have a list of 177 sub-domains if >>>> anyone is interested). >>> >>> <raising hand> >>> >>> Please email the list to updates(a)spambouncer.org and I'll list them >>> in the Spam Haven URLs list. Thanks! > >> http://mx2.netmagicians.com/tripod.txt, just mailed them to the support team >> at lycos.com as well who will remove the offending accounts. > >Please do report them to lycos. Getting the sites shut down is >arguably more important than blacklisting, IMO. > >Jeff C. >-- >Don't harm innocent bystanders. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Reporting the tripod sites to Lycos and shutting them is indeed more important than blacklisting the tripod sites - Agreed. But a quick extract of the HTML pages shows that the 179 tripod pages seem to only redirect to a total of 8 sites currently - those should get blacklisted. The current set is (not the same as the ones I saw earlier): Site Registrar Contact email -------------------------------------------------------------------------------- http://www.aneigpie.com-MUNG - NameBay caturedin(a)yahoo.com http://www.arecurel.com-MUNG - NameBay livoutsid(a)yahoo.com http://www.baniclu.com-MUNG - NameBay caturedin(a)yahoo.com http://www.cherdon.info-MUNG - Directi tospecie(a)yahoo.com http://www.cherit.info-MUNG - Directi tospecie(a)yahoo.com http://www.chersky.info-MUNG - Directi tospecie(a)yahoo.com http://www.offmantate.com-MUNG - YesNIC greatestemal(a)yahoo.com http://www.onlialowus.com-MUNG - YesNIC greatestemal(a)yahoo.com All currently have a 5 minute TTL and are at IP 211.233.16.84, which is listed at Spamhaus under SBL31414, a general dirty block at KIDC, though the example domains in the SBL include Kurayev's name servers registered by the ex-Joker (now Nicline) ROKSO domain reseller "Alex Blood"/"Ryan Kelly". All use the same name servers: ns0.areshooti.com-MUNG - YesNIC revisitinger(a)yahoo.com ns0.stomauset.com-MUNG - YesNIC omeceral(a)yahoo.com Of course the YesNIC name servers, have no name servers themselves. Paul Shupak track(a)plectere.com

5 4

Re: [SURBL-Discuss] Re: tripod dot com
by List Mail User 09 Nov '05

09 Nov '05

>... >On Tuesday, November 8, 2005, 10:08:46 PM, List User wrote: >> a quick >> extract of the HTML pages shows that the 179 tripod pages seem to only >> redirect to a total of 8 sites currently - those should get blacklisted. >> The current set is (not the same as the ones I saw earlier): > >> Site Registrar Contact email >> -------------------------------------------------------------------------------- >> http://www.aneigpie.com-MUNG - NameBay caturedin(a)yahoo.com >> http://www.arecurel.com-MUNG - NameBay livoutsid(a)yahoo.com >> http://www.baniclu.com-MUNG - NameBay caturedin(a)yahoo.com >> http://www.cherdon.info-MUNG - Directi tospecie(a)yahoo.com >> http://www.cherit.info-MUNG - Directi tospecie(a)yahoo.com >> http://www.chersky.info-MUNG - Directi tospecie(a)yahoo.com >> http://www.offmantate.com-MUNG - YesNIC greatestemal(a)yahoo.com >> http://www.onlialowus.com-MUNG - YesNIC greatestemal(a)yahoo.com > >> All currently have a 5 minute TTL and are at IP 211.233.16.84, which is >> listed at Spamhaus under SBL31414, a general dirty block at KIDC, though >> the example domains in the SBL include Kurayev's name servers registered >> by the ex-Joker (now Nicline) ROKSO domain reseller "Alex Blood"/"Ryan Kelly". > >Hi Paul, >Thanks I've blacklisted those, but TBH it may not help too much >since they don't seem to be appearing in spams themselves. > >Keep on getting those domains shut down. :-) > >Jeff C. >-- >Don't harm innocent bystanders. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > I didn't even notice, but the tripod subdomains got their own SBL yesterday - SBL34478 for dafhicksha.tripod.com-MUNG redirecting to arecurel.com-MUNG, but at a different IP, 222.122.72.120 (at KORNET instead of KIDC - same country, different spam haven). Chances are that the IPs 211.233.16.107 and 221.143.42.212 were either earlier sites, or soon to be used sites (there are 4 'A' records for the each of the name servers - with 5 minute TTLs its is hard to tell which direction things are moving, to or from, without staying on top on them and checking). Similar SBLs include SBL34456/SBL34454 for 211.233.16.78 and 211.233.16.107 respectively - though those show the domain conumese.com of SBL34454, which was spam'd directly (i.e. not tripod'd) and a batch of other directly spam'd domains at the same IP 211.233.16.107. There, at least the domain doubelev.com-MUNG was using ascii and multi-character HTML table formated spam: -------------------------------------------------------------------------------- [headers - snipped] Content-Transfer-Encoding: quoted-printable Ho overpayi or your Meddi isit our Pharm ress Sho wdy, Quit ng f cations - v aExp p. AmCIXaVALeVI bienALISnaxLIUMvitraAGRA 3.70 1.20 3.30 Want to know more? - http://hardselleex.doubelev.com-MUNG ------=_NextPart_000_004A_01C5E293.A074B480 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable [HMTL - snipped] -------------------------------------------------------------------------------- So there are many parallel drug spams hosted and advertising the same site(s) at once (my copy of the spam is from Sunday early morning). The one above is using the more common three-registrar system; Spam domain at Namebay, name server rosettarkin.com-MUNG at RGNames and nearly identical name server indivualre.com-MUNG at YesNIC (the name servers use the same contact data, except the email, at both registrars). Paul Shupak track(a)plectere.com

1 0

tripod dot com
by Dhawal Doshy 08 Nov '05

08 Nov '05

Hi, tripod dot com is now the new geo-cities, any plans to list it (yup, i know about the surbl no fps policy but no harm in asking)? i currently don't see it whitelisted (unless i'm wrong). We are getting quite a few spams from there. e.g. labedbreashi dot tripod dot com which redirects to filiaprom dot com thanks, - dhawal

5 11

Re: [SURBL-Discuss] tripod dot com
by List Mail User 08 Nov '05

08 Nov '05

>... >On Tuesday, November 8, 2005, 5:12:52 AM, List User wrote: >> So, Jeff, can the tripod.com domain just be treated as if it >> were a two-level TLD for SURBL? Another pair are ianampolkcho tripod.com >> and armonmafinneywilco tripod.com (Yes, they have been reported). > >For those keeping score, the systems are not currently set up to >work that way, both on the data side and probably also on the >application side. I'm not sure how smart we are to let the >spammers know this. :-( > >> BTW. He's also using the CNET redirector again (clearly CNET's >> policy of blacklisting instead of whitelisting doesn't work). > >Perhaps you mean whitelisting instead of blacklisting? > >Jeff C. >-- >Don't harm innocent bystanders. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Unfortunately I meant it the way I wrote it; CNET blacklists sites *after* complaints - They should whitelist sites that have paid or contracted with them instead of blacklisting sites people complain about. You assumed that they were acting rationally, which should be a good assumption, but isn't in this case. However I did mean to use redirectors (plural, not singular - they have many in their various domains). Paul Shupak track(a)plectere.com

2 1

Re: [SURBL-Discuss] tripod dot com
by List Mail User 08 Nov '05

08 Nov '05

These are the latest versions of Leo Kuvayev's pill spam which does still come from many XX.geocities domains (recent ones from de and sg). An interesting twist to the newest stuff - the spam domains are at bookmyname and Namebay, but the name servers are at RGNames and YesNIC; Of particular interest is the ones at YesNIC have no name servers, just hosts in the root cache (e.g. filiaprom dot com, uses stomauset dot com and areshooti dot com), and YesNIC's standard procedure for "suspending" a domain is to remove its name servers - so this technique allows the domains to continue to be used long after they have been suspended (look up the various Spamhaus listings for the CP name server set in the domain serverbackup64 dot com - which was "suspended" Sept. 29, but is still getting new SBL listing mentions - e.g. SBL34264). A similar trick is used for the RGNames domains, where he buys a domain package including DNS from them, but never allows the RGNames' servers (i.e. pf[12].rgpack.com) to receive or serve and data for the domains. The most common case seems to be the spamvertised domain at bookmyname or Namebay with two name servers, one each at RGNames and YesNIC, with identical contact data, except for different email addresses (i.e. same name for the registrant and contacts, partial address at YesNIC and full address at RGNames). The actual spam is the identical vertical pill stuff (not currently using HTML tables) and the various ED drug spams. So, Jeff, can the tripod.com domain just be treated as if it were a two-level TLD for SURBL? Another pair are ianampolkcho tripod.com and armonmafinneywilco tripod.com (Yes, they have been reported). BTW. He's also using the CNET redirector again (clearly CNET's policy of blacklisting instead of whitelisting doesn't work). Paul Shupak track(a)plectere.com

2 1

Please remove SC2 rules or references
by Jeff Chan 04 Nov '05

04 Nov '05

Anyone using custom rules for sc2.surbl.org, please take them out now, since sc.surbl.org is using that data. Jeff C. -- Don't harm innocent bystanders.

1 0

okay to talk about sorbs here?
by George Georgalis 02 Nov '05

02 Nov '05

Before I started using spam.dnsbl.sorbs.net I tested a corpus of spam and ham and determined the best way to implement. But in the past 48 hours, mail relays from road runner, and cablevision have been added. http://www.us.sorbs.net/using.shtml spam.dnsbl.sorbs.net - List of hosts that have been noted as sending spam/UCE/UBE to the admins of SORBS. This zone also contains netblocks of spam supporting service providers, including those who provide websites, DNS or drop boxes for a spammer. Spam supporters are added on a 'third strike and you are out' basis, where the third spam will cause the supporter to be added to the list. While I appreciate sending the message to lame ISPs about controlling their users, adding these relays to the blacklist causes a lot of false positives. Has sorbs been reasonable in their judgment to add them, how often does it take 30 million (or whatever) random subscribers to produce 3 spams, and what is reasonable for an ISP to do about it? I have filled out their (sorbs) complex web support forms before, on behalf of a 3rd party, and never got a response. Now, since I'm complaining about relays being added that aren't mine, I cannot even get through the questions to a dialog I can enter my observation (when I properly answer the questions). Unfortunately for me this is 2 strikes and you're out, sorbs. Is there a good alternative for spam.dnsbl.sorbs.net? // George -- George Georgalis, systems architect, administrator <IXOYE>< http://galis.org/ cell:646-331-2027 mailto:george@galis.org

4 6

Re: RFC: multi.surbl.org testpoint A record value
by Frank Ellermann 02 Nov '05

02 Nov '05

Jeff Chan wrote: > Does anyone have any comments or preferences for either > style? Why set bit 7 if there is no 7th set at the moment ? It would be nice in my test output. OTOH I added support for bits 8..15 a year ago because that's what you wanted, and for that you could also use 127.0.255.126. === test output today (truncated) === 127.0.0.2 (------1-): .ix.dnsbl.manitu.net 127.0.0.2 (------10): .combined.njabl.org 127.0.0.2 (---43210): .opm.blitzed.org 127.0.0.2 (------1-): .multi.surbl.org 127.0.0.2 (-----21-): .sbl-xbl.spamhaus.org === demo output for 127.0.0.126 === 127.0.0.2 (------1-): .ix.dnsbl.manitu.net 127.0.0.2 (------10): .combined.njabl.org 127.0.0.2 (---43210): .opm.blitzed.org 127.0.0.2 (7654321-): .multi.surbl.org 127.0.0.2 (-----21-): .sbl-xbl.spamhaus.org === demo output for 127.0.255.126 === 127.0.0.2 (------1-): .ix.dnsbl.manitu.net 127.0.0.2 (------10): .combined.njabl.org 127.0.0.2 (---43210): .opm.blitzed.org 127.0.0.2 (FEDBCA987654321-): .multi.surbl.org 127.0.0.2 (-----21-): .sbl-xbl.spamhaus.org These "aesthetical considerations" are just for fun, if there are no more serious arguments at all. Bye

2 2

RFC: multi.surbl.org testpoint A record value
by Jeff Chan 02 Nov '05

02 Nov '05

Previously, each SURBL zone file, including the bitmask combined list multi.surbl.org, had testpoitns with A records resolving to 127.0.0.2. That was a design decision, and it was also convenient to the way the zone files were generated before. But Justin Mason or one of the other SpamAssassin developers argued that multi should have testpoints corresponding to all ones in each bitmask position. So one of the changes with the new SURBL engine now running is that the multi testpionts do have all the bits set for an A record value of 127.0.0.126 instead of 127.0.0.2 . This may work better with applications that decode the bits properly into individual list results, but it is a change from before and it may break other applications' use of the testpoints. Does anyone have any comments or preferences for either style? Jeff C. -- Don't harm innocent bystanders.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss November 2005