Discuss June 2005

discuss@lists.surbl.org

24 participants
34 discussions

New redirector crap
by Raymond Dijkxhoorn 30 Jun '05

30 Jun '05

Hi! There is a new redirector thats been abused heavilly by spammers: <a href=http://redir.internet.com/rss/click/rsv%2e%72%65co%72c%6fmp%61%6ei%2ec… target=_blank>C1icck here to 0rder interest</a> Its pointing towards a pillspammer. Meanwhile, while we are contacting internet.com you could add this ruleset to your SA configs: uri PROLO_REDIR_INET_CHECK1 /^http:\/\/redir\.internet\.com\/rss\// score PROLO_REDIR_INET_CHECK1 8.0 describe PROLO_REDIR_INET_CHECK1 PROLO_REDIR-INET CHECK, Body Bye, Raymond.

2 1

What ever happened to "Louisville CO 80027" spam?
by Rob McEwen 25 Jun '05

25 Jun '05

What ever happened to "Louisville CO 80027" spam? Did they change their scheme? Get Prosecuted? Rob McEwen PowerView Systems

1 0

False positive in WS
by Rakesh 23 Jun '05

23 Jun '05

Hi For the first time I have recieved false positive on URI checks. I have subscribed for the "Word of the day" from dictionary.com which had a link to the the SaintLeo university website. However their domain was list in ws.surbl.org SaintLeo.com.multi.surbl.org Can body please take care of this false positive. -- Regards, Rakesh B. Pal Netcore Solutions Pvt. Ltd. ======================================================== Success is how high you reach after you hit the bottom. ======================================================== ---------------------------------------------------------- Netcore Solutions Pvt. Ltd. Website: http://www.netcore.co.in Spamtraps: http://cleanmail.netcore.co.in/directory.html ----------------------------------------------------------

4 6

RE: [SURBL-Discuss] Blog comment spam and SURBL
by Chris Santerre 21 Jun '05

21 Jun '05

>-----Original Message----- >From: Duncan Hill [mailto:dhill+surbl@cricalix.net] >Sent: Monday, June 20, 2005 11:05 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] Blog comment spam and SURBL > > >I've noticed that the poker comment spammers have found my >blog (which is >configured to run in moderation mode). Is there any point in >reporting the >reports WordPress sends me into the SURBL submission process? >The biggest >benefit I can see is for anyone who uses SA tied into WP's >comment queue - >auto spam tagging. Jeff has always liked to keep a seperation between Blog and Mail spammers. If he doesn't want them, (He might), we will take them at URIBL.com. We figure there is no difference between the two. --Chris

3 2

Blog comment spam and SURBL
by Duncan Hill 20 Jun '05

20 Jun '05

I've noticed that the poker comment spammers have found my blog (which is configured to run in moderation mode). Is there any point in reporting the reports WordPress sends me into the SURBL submission process? The biggest benefit I can see is for anyone who uses SA tied into WP's comment queue - auto spam tagging. -- My mind not only wanders, it sometimes leaves completely.

1 0

Re: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 17 Jun '05

17 Jun '05

I went back through old archives, and... I found a case of affiliate abuse involving inphonic. The email came to a non-existant account, not the one I use with inphonic and it was very similar to the one you got (i.e. links to inphonic pages, but redirects to the affiliate). This is old (Aug. 2003), but after I had been a customer, and the domains are all still valid (and look bad). Only one is currently listed in SURBLs (noted alongside of it). The involved domains were: myobdeals.com greatoffers.us homebasedbusinessclub.com [jp] imarketoffers.com I also check, all "real" inphonic emails have come from servers in their own domain with working rDNS and FCrDNS. I had never noticed this one, because it was to an obvious "bad" account (a misspelling of an account which I sometime post with, so it had both been "scraped" and typo'd - It got on a CD over a year ago, and now is one of the few accounts I outright refuse, instead of just piping down the automatic spam-reporting machinery - too much "mom&pop" operation spam to it). Anyway, it was two years ago, and I got just one - but it shows they have had past problem (but with just one vs. your > 10, my case was probably cleared up quickly). Paul Shupak track(a)plectere.com

2 1

Re: Fw: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 17 Jun '05

17 Jun '05

Having seen what you sent, I would immediately agree with listing all the "CLEARCUT" domains, including at the least, CLEARCUTSAVINGS. COM, ccs44. com, peakedig. com, peakedigital. com and all the others you had previously listed. It does look like a pretty clear case of "affiliate" abuse, and I'm still willing to give inphonic the benefit of the doubt. I would send an email (with copies of everything) to affiliates(a)inphonic.com and see what kind of response you get - if they don't drop clearcut/peakedigital et. al., I will stop buying from them and recommending them (I just sent them somebody on Friday, who bought two phones for $270 less than the local Cingular Store wanted for the same Cingular package - they were about $90 under Amazon). InPhonic is big, not Fortune 500, but *very* large. They do have "emarketing", but as I have said - I've never gotten anything from them despite the fact that they have a valid email address (unique, so I also know it has never been sold or "rented"). The 800 number on the web pages will eventually get someone who will have a "real" manager (but still in "sales") call back - Corporate Communications is (202) 333-0001, and from their own Sprint press release (also on their pages), the V.P. for Corporate Communications is "Tripp Donnelly", email tdonnelly(a)inphonic.com. I have had *such* good dealings with them that I would expect some quick response - copy him as well as the affiliate address above. Right now, I say inphonic looks clean, but is implicated by bad management of their affiliate program. The clearcut/peakedigital people are using at least two "spam friendly" hosting providers and should be listed right away (i.e. at least one is the same as the one Ralsky used for the emails that got Verizon to sue him - clearcut is using Yikes for both "unsubscribe" and a 1by1 pixel marker in the spam copy you sent). Please tell me/us whatever you get back from InPhonic. It will certainly affect my sending them customers (I'm normally a quite loyal customer when I find a company with good service - though admittedly their "free extras" are junk). Bye, Paul Shupak track(a)plectere.com

1 0

Re: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 17 Jun '05

17 Jun '05

>... > >Paul Shupak noted on Thursday, June 16, 2005 0943: > >> >... >> >20050615-1132 inphonic.com >> >... >> Most of your list is recognizable spammers, but I've actually bought >> from inphonic and can recommend them. Not only are they often the least >> expensive (re. the largest rebate on free cell phones) place to get most >> US carriers' cell phones (Amazon comes in as, surprising to me, a close >> second place usually), but their service is very good, and they have never >> sent me any email except a single follow-up after each transaction. >> >> Are you certain the user didn't call one of their telephone numbers? >> They use *many* company names and many domains - with different and *hidden* >> pricing structures. It is tricky to find the best price from them (they may >> have a half dozen different prices for the same thing, depending on the path >> you take and the cookies you accept to get to a page - very disingenuous, but >> legal - I often tell people to just use Amazon, whose pricing is easier to >> deal with - and far simpler). Once you deal with any of the "front" companies >> everything later comes from the parent - inphonic.com (and even worst - they >> seem to have "affiliates" who do re-directs and mirror pages). >> >> It also seems unlikely to be an "affiliate" spam case, since all >> the affilaites I have seen use a different domain to start, then mark your >> session with one or more cookies (it is far cheaper to go direct, don't walk >> the tree and accept no cookies - then you usually get offered the lowest of >> the available prices). Also, I think they are the single largest reseller >> for both Cingular and T-Mobile (and they were for AT&T, pre-merger). >> > >Yes Paul, unfortunately it appears that InPhonic has decided to take >spamvertising for a whirl, with or without Sprint PCS' blessing. > >My small network consists of my family here at home. We have never had any >prior business relationship with InPhonic. We've never bought anything from >InPhonic or Sprint PCS, and we have not been in the market for any cell phones >for at least two years. I hadn't heard of InPhonic until receiving this spam. > >InPhonic apparently hired a well-known spammer (Spamhaus Block List #20212 at >http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20212) to inflict their message >on the rest of us. They operate with the following domains that I know about, >and almost certainly others: > >clearcutsavings.com >ccs44.com >clearcutsav.com >clrctsvg.com >goccutsav.com >nyclearcut.com > >Since 5/19 "Clearcut", for lack of a better name, has sent me 18 spams. 17 were >false negatives; SA caught the other one. Time for me to up my SURBL scoring, >huh? ;) > >Anyway, here's the relevant spam text: > >"Phone free after instant rebate. This offer is fulfilled by InPhonic inc., an >authorized dealer for Sprint. Offer subject to credit approval or deposit, and >is available to customers activating a new line of service on a two-year >contract with Sprint. Not all US markets are served by Sprint. If you are not in >a Sprint area you will receive another great offer from another major wireless >company. Other restrictions apply, see full offer for details. Offer Expires >soon. Offer may vary." > >And, below is the text from the embedded image: > >"If you no longer wish to receive offers fulfilled from InPhonic, Inc., click >here or write to InPhonic, Inc., ATTN: Customer Relations-compliance 9301 >Peppercorn Place, Largo MD 20774. This is an email ad." > >Of course, clicking on that GIF won't take you to InPhonic, it'll send you to >Clearcut. Here's the code: > ><a href="http://g.clearcutsavings.com/ryhig.aspx?m=[munge]&w=[munge]/"><img >src="http://mirror.clearcutsavings.com/images/ap/spo02.gif" border=0></a> > >My vote for InPhonic is still black. I have no axe to grind though. Whatever >the more experienced among you think, I'm willing to live with it. > >I've sent the spample in various forms to Paul off-list for his review. If >anyone else wants the zip file, please let me know and I'll send it right over. > >TTYL, > >Sean > > I agree - this looks damning enough for me. Do note that clearcut seems to be an "affiliate" - They are in Texas, inphonic is in Maryland (and in NY). I am now entirely certain that "clearcut" is guilty - If an email or telephone call to inphonic doesn't get any response, I'd list them too (it does look like "affiliate" abuse though, since you say that clicking does not take you to inphonic). I did say that they have "strange" (at best) pricing options and a very sophisticated (and not in a good way) web site. BTW. The reason I like inphonic, is that they tend to payout 60-80% of the commision to the customer - so rarely is the phone "free", usually you get paid $150 to $250 to take it (e.g. I got paid $500 for my last two phones). If clearcut is *only* offering "free", that is unusual, even for the affiliates. Paul Shupak track(a)plectere.com P.S. They have an 800 number, mostly staffed by peons, but ask for a manager and somebody will actually call back the next day (my experiences) - I didn't want to give out a Social Security number (and didn't).

2 1

Re: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 16 Jun '05

16 Jun '05

>... >Hello --- > >Below is a fresh list of dates and domains. All times are Pacific (GMT - 7). > >Kind regards, > >Sean Sowell > >... >20050615-1132 inphonic.com >... > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Most of your list is recognizable spammers, but I've actually bought from inphonic and can recommend them. Not only are they often the least expensive (re. the largest rebate on free cell phones) place to get most US carriers' cell phones (Amazon comes in as, surprising to me, a close second place usually), but their service is very good, and they have never sent me any email except a single follow-up after each transaction. Are you certain the user didn't call one of their telephone numbers? They use *many* company names and many domains - with different and *hidden* pricing structures. It is tricky to find the best price from them (they may have a half dozen different prices for the same thing, depending on the path you take and the cookies you accept to get to a page - very disingenuous, but legal - I often tell people to just use Amazon, whose pricing is easier to deal with - and far simpler). Once you deal with any of the "front" companies everything later comes from the parent - inphonic.com (and even worst - they seem to have "affiliates" who do re-directs and mirror pages). It also seems unlikely to be an "affiliate" spam case, since all the affilaites I have seen use a different domain to start, then mark your session with one or more cookies (it is far cheaper to go direct, don't walk the tree and accept no cookies - then you usually get offered the lowest of the available prices). Also, I think they are the single largest reseller for both Cingular and T-Mobile (and they were for AT&T, pre-merger). Paul Shupak track(a)plectere.com

2 1

20050615 embedded image spam
by Sean Sowell 16 Jun '05

16 Jun '05

Hello --- Below is a fresh list of dates and domains. All times are Pacific (GMT - 7). Kind regards, Sean Sowell 20050614-0137 virtualcitycasino.com 20050614-0242 sererih.com 20050614-0314 ltoptout.com 20050614-0619 radiocarbodatin.com 20050614-0621 radiocarbodatin.com 20050614-0824 donmehme.com 20050614-0925 dmgy.com 20050614-0925 totalgiveaway.com 20050614-1007 scottyoungwq.net 20050614-1033 clickboothlnk.com 20050614-1332 hcsyd.com 20050614-1332 highlifeplastic.com 20050614-1417 primaryads.ca 20050614-1417 startyoursavingstoday.ca 20050614-1516 getbestofitnesstothisitem.com 20050614-1625 clickboothlnk.com 20050614-1823 freecdsuperstore.com 20050614-1823 optit.com 20050614-1914 thfirshuman.com 20050614-1958 thfirshuman.com 20050614-2129 soonerwe.com 20050615-0022 colocolofh.com 20050615-0200 creditapplications.info 20050615-0200 fxfn.com 20050615-0200 impulsemg.com 20050615-0402 luckyemperor.com 20050615-0406 donlittlbiof.com 20050615-0409 donlittlbiof.com 20050615-0513 i-cami.com 20050615-0532 duffha.com 20050615-0955 irq12.com 20050615-0955 petcarerx.com 20050615-1104 qualitymba.info 20050615-1112 qualitymba.info 20050615-1131 dvdmegapacks.com 20050615-1132 ccs44.com 20050615-1132 inphonic.com 20050615-1137 nyclearcut.com 20050615-1310 livemercial.com 20050615-1348 byonbard.com 20050615-1348 heatn.com 20050615-1348 lifeonaclick.com 20050615-1451 prima11.com 20050615-1505 urchoise.com 20050615-1517 flourishnutrition.com 20050615-1517 healthsitesinc.com 20050615-1551 beirahc.com 20050615-1557 actma.com 20050615-1617 creditapplications.info 20050615-1617 fxfn.com 20050615-1617 impulsemg.com 20050615-1655 urchoise.com 20050615-1737 investmystock.com 20050615-1737 onlinestocktrading.ws 20050615-1800 i-cami.com 20050615-1823 prima11.com 20050615-1823 rewardsgateway.com 20050615-2306 sasthear.com 20050615-2309 sasthear.com

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss June 2005