Discuss October 2006

discuss@lists.surbl.org

8 participants
8 discussions

Start a nNew thread

multi.surbl.org not i DNS
by Uffe Bager 25 Oct '06

25 Oct '06

I'm unable to resolve multi.surbl.org, it this a general problem? Uffe

2 1

Re: [SURBL-Discuss] www.citylimits.org
by Jeff Chan 25 Oct '06

25 Oct '06

On Tuesday, October 24, 2006, 11:39:31 AM, Joseph Brennan wrote: > www.citylimits.org is in the ws list. > It is a nonprofit organization, and they tell me people here at Columbia > have asked why they have not got their mail. > What was this listing based on? A quick web and newsgroup search got me > nothing about this domain and spam. > Joseph Brennan > Columbia University Information Technology Thanks. Looks possibly legit so, removing it. Please note that false positive reports generally should be sent to whitelist at surbl. org. Jeff C. -- Don't harm innocent bystanders.

1 0

www.citylimits.org
by Joseph Brennan 24 Oct '06

24 Oct '06

www.citylimits.org is in the ws list. It is a nonprofit organization, and they tell me people here at Columbia have asked why they have not got their mail. What was this listing based on? A quick web and newsgroup search got me nothing about this domain and spam. Joseph Brennan Columbia University Information Technology

1 0

Re: [SURBL-Discuss] Logo competition
by Jeff Chan 18 Oct '06

18 Oct '06

On Tuesday, October 3, 2006, 9:26:43 PM, Steve Sobol wrote: > Are you guys still looking for a logo? I've been pretty busy :( Yep. Can you make your logo with thicker lines and text? Jeff C. -- Don't harm innocent bystanders.

2 1

FP in PH and AB SURBL - www.4emi.com
by Russ Ringer 18 Oct '06

18 Oct '06

www.4emi.com is coming up as listed in PH and AB SURBL. EMI Solutions is a legitimate supplier we use in manufacturing aircraft electronics and should not be listed in either PH or AB. Funny thing is I can't find the listing on abusebutler or castlecops. This server is running SpamAssassin version 3.0.3

2 2

Google toolbar's whitelist
by jm＠jmason.org 10 Oct '06

10 Oct '06

I'm sure someone will find this useful: http://sb.google.com/safebrowsing/update?version=goog-white-domain:1:-1 found via http://blog.outer-court.com/forum/67024.html , --j.

1 0

Re: [SURBL-Discuss] Logo competition
by Jeff Chan 04 Oct '06

04 Oct '06

On Thursday, August 17, 2006, 9:12:51 PM, Steve Sobol wrote: > Jeff Chan wrote: >>> http://stevesobol.com/content/surbllogo.jpg >> >>> This is just a preliminary, I-did-this-in-five-minutes concept. >> >> It's good. (Red circle and slash = "no" and url://) >> >> Can you make one with spam:// ? > Absolutely not, but see > http://stevesobol.com/content/surbllogo2.jpg > (Ok, I was just kidding, of course I can do it!) > If that looks OK to you, I'll take that concept and come up > with a final product. Hi Steve, Looks great; thanks much! If I could request a modification, it would be for bolder type and thicker lines if possible. Also I'd probably make the text black, as in blackhat. Cheers, Jeff C. -- Don't harm innocent bystanders.

2 1

Yahoo redirector?
by Joseph Brennan 03 Oct '06

03 Oct '06

What's going on here? Numerous examples of porn spam sent Sunday have all different hostnames that resolve to the same few IP addresses, apparently by round robin: $ host takinoivanober.com takinoivanober.com has address 68.142.212.127 takinoivanober.com has address 68.142.212.128 takinoivanober.com has address 68.142.212.129 takinoivanober.com has address 68.142.212.130 takinoivanober.com has address 68.142.212.135 takinoivanober.com has address 68.142.212.126 $ host zascehjukalsderr.com zascehjukalsderr.com has address 68.142.212.130 zascehjukalsderr.com has address 68.142.212.135 zascehjukalsderr.com has address 68.142.212.126 zascehjukalsderr.com has address 68.142.212.127 zascehjukalsderr.com has address 68.142.212.128 zascehjukalsderr.com has address 68.142.212.129 $ host sex368yzx.com sex368yzx.com has address 68.142.212.129 sex368yzx.com has address 68.142.212.130 sex368yzx.com has address 68.142.212.135 sex368yzx.com has address 68.142.212.136 sex368yzx.com has address 68.142.212.137 sex368yzx.com has address 68.142.212.128 Reverse DNS resolves to Yahoo, only: $ host 68.142.212.130 130.212.142.68.in-addr.arpa domain name pointer p10w14.geo.mud.yahoo.com. $ host 68.142.212.127 127.212.142.68.in-addr.arpa domain name pointer p10w11.geo.mud.yahoo.com. $ host 68.142.212.128 128.212.142.68.in-addr.arpa domain name pointer p10w12.geo.mud.yahoo.com. The range 68.142.192 through 68.142.255 is all Inktomi, contact address network-abuse(a)cc.yahoo-inc.com, so it really is Yahoo. The interesting bit is that connecting by IP address or yahoo hostname gets a "Error 400 - Bad Request", but connecting by the spammer hostname gets a web page. I'd be especially interested in a generalized way of catching this. Joseph Brennan Columbia University Information Technology

4 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss October 2006