Discuss

discuss@lists.surbl.org

1 participants
1864 discussions

RE: [SURBL-Discuss] local whitelists
by Chris Santerre 04 Jul '05

04 Jul '05

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Saturday, July 02, 2005 12:14 AM > To: SURBL Discuss > Subject: [SURBL-Discuss] local whitelists > > > Within the past week or so some developer or administrator of > anti-spam software said that they had a large installation or > userbase that recently started using SURBLs, but only after they > were able to locally whitelist some FPs. I can't find that > message currently. Does anyone recall anything like that being > said recently somewhere? (Seems I'm on too many mailing lists to > keep track of....) > > I would like to ask them to share their whitelist entries with > us so we can prevent FPs more broadly. > > Does anyone recall a conversation like that recently? If so can > you point me to where? > > TIA, > > Jeff C. Do you mean Catherine at spambouncer.org? She had a new version release. --Chris

1 0

local whitelists
by Jeff Chan 02 Jul '05

02 Jul '05

Within the past week or so some developer or administrator of anti-spam software said that they had a large installation or userbase that recently started using SURBLs, but only after they were able to locally whitelist some FPs. I can't find that message currently. Does anyone recall anything like that being said recently somewhere? (Seems I'm on too many mailing lists to keep track of....) I would like to ask them to share their whitelist entries with us so we can prevent FPs more broadly. Does anyone recall a conversation like that recently? If so can you point me to where? TIA, Jeff C. -- Don't harm innocent bystanders.

1 0

New redirector crap
by Raymond Dijkxhoorn 30 Jun '05

30 Jun '05

Hi! There is a new redirector thats been abused heavilly by spammers: <a href=http://redir.internet.com/rss/click/rsv%2e%72%65co%72c%6fmp%61%6ei%2ec… target=_blank>C1icck here to 0rder interest</a> Its pointing towards a pillspammer. Meanwhile, while we are contacting internet.com you could add this ruleset to your SA configs: uri PROLO_REDIR_INET_CHECK1 /^http:\/\/redir\.internet\.com\/rss\// score PROLO_REDIR_INET_CHECK1 8.0 describe PROLO_REDIR_INET_CHECK1 PROLO_REDIR-INET CHECK, Body Bye, Raymond.

2 1

What ever happened to "Louisville CO 80027" spam?
by Rob McEwen 25 Jun '05

25 Jun '05

What ever happened to "Louisville CO 80027" spam? Did they change their scheme? Get Prosecuted? Rob McEwen PowerView Systems

1 0

False positive in WS
by Rakesh 23 Jun '05

23 Jun '05

Hi For the first time I have recieved false positive on URI checks. I have subscribed for the "Word of the day" from dictionary.com which had a link to the the SaintLeo university website. However their domain was list in ws.surbl.org SaintLeo.com.multi.surbl.org Can body please take care of this false positive. -- Regards, Rakesh B. Pal Netcore Solutions Pvt. Ltd. ======================================================== Success is how high you reach after you hit the bottom. ======================================================== ---------------------------------------------------------- Netcore Solutions Pvt. Ltd. Website: http://www.netcore.co.in Spamtraps: http://cleanmail.netcore.co.in/directory.html ----------------------------------------------------------

4 6

RE: [SURBL-Discuss] Blog comment spam and SURBL
by Chris Santerre 21 Jun '05

21 Jun '05

>-----Original Message----- >From: Duncan Hill [mailto:dhill+surbl@cricalix.net] >Sent: Monday, June 20, 2005 11:05 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] Blog comment spam and SURBL > > >I've noticed that the poker comment spammers have found my >blog (which is >configured to run in moderation mode). Is there any point in >reporting the >reports WordPress sends me into the SURBL submission process? >The biggest >benefit I can see is for anyone who uses SA tied into WP's >comment queue - >auto spam tagging. Jeff has always liked to keep a seperation between Blog and Mail spammers. If he doesn't want them, (He might), we will take them at URIBL.com. We figure there is no difference between the two. --Chris

3 2

Blog comment spam and SURBL
by Duncan Hill 20 Jun '05

20 Jun '05

I've noticed that the poker comment spammers have found my blog (which is configured to run in moderation mode). Is there any point in reporting the reports WordPress sends me into the SURBL submission process? The biggest benefit I can see is for anyone who uses SA tied into WP's comment queue - auto spam tagging. -- My mind not only wanders, it sometimes leaves completely.

1 0

Re: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 17 Jun '05

17 Jun '05

I went back through old archives, and... I found a case of affiliate abuse involving inphonic. The email came to a non-existant account, not the one I use with inphonic and it was very similar to the one you got (i.e. links to inphonic pages, but redirects to the affiliate). This is old (Aug. 2003), but after I had been a customer, and the domains are all still valid (and look bad). Only one is currently listed in SURBLs (noted alongside of it). The involved domains were: myobdeals.com greatoffers.us homebasedbusinessclub.com [jp] imarketoffers.com I also check, all "real" inphonic emails have come from servers in their own domain with working rDNS and FCrDNS. I had never noticed this one, because it was to an obvious "bad" account (a misspelling of an account which I sometime post with, so it had both been "scraped" and typo'd - It got on a CD over a year ago, and now is one of the few accounts I outright refuse, instead of just piping down the automatic spam-reporting machinery - too much "mom&pop" operation spam to it). Anyway, it was two years ago, and I got just one - but it shows they have had past problem (but with just one vs. your > 10, my case was probably cleared up quickly). Paul Shupak track(a)plectere.com

2 1

Re: Fw: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 17 Jun '05

17 Jun '05

Having seen what you sent, I would immediately agree with listing all the "CLEARCUT" domains, including at the least, CLEARCUTSAVINGS. COM, ccs44. com, peakedig. com, peakedigital. com and all the others you had previously listed. It does look like a pretty clear case of "affiliate" abuse, and I'm still willing to give inphonic the benefit of the doubt. I would send an email (with copies of everything) to affiliates(a)inphonic.com and see what kind of response you get - if they don't drop clearcut/peakedigital et. al., I will stop buying from them and recommending them (I just sent them somebody on Friday, who bought two phones for $270 less than the local Cingular Store wanted for the same Cingular package - they were about $90 under Amazon). InPhonic is big, not Fortune 500, but *very* large. They do have "emarketing", but as I have said - I've never gotten anything from them despite the fact that they have a valid email address (unique, so I also know it has never been sold or "rented"). The 800 number on the web pages will eventually get someone who will have a "real" manager (but still in "sales") call back - Corporate Communications is (202) 333-0001, and from their own Sprint press release (also on their pages), the V.P. for Corporate Communications is "Tripp Donnelly", email tdonnelly(a)inphonic.com. I have had *such* good dealings with them that I would expect some quick response - copy him as well as the affiliate address above. Right now, I say inphonic looks clean, but is implicated by bad management of their affiliate program. The clearcut/peakedigital people are using at least two "spam friendly" hosting providers and should be listed right away (i.e. at least one is the same as the one Ralsky used for the emails that got Verizon to sue him - clearcut is using Yikes for both "unsubscribe" and a 1by1 pixel marker in the spam copy you sent). Please tell me/us whatever you get back from InPhonic. It will certainly affect my sending them customers (I'm normally a quite loyal customer when I find a company with good service - though admittedly their "free extras" are junk). Bye, Paul Shupak track(a)plectere.com

1 0

Re: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 17 Jun '05

17 Jun '05

>... > >Paul Shupak noted on Thursday, June 16, 2005 0943: > >> >... >> >20050615-1132 inphonic.com >> >... >> Most of your list is recognizable spammers, but I've actually bought >> from inphonic and can recommend them. Not only are they often the least >> expensive (re. the largest rebate on free cell phones) place to get most >> US carriers' cell phones (Amazon comes in as, surprising to me, a close >> second place usually), but their service is very good, and they have never >> sent me any email except a single follow-up after each transaction. >> >> Are you certain the user didn't call one of their telephone numbers? >> They use *many* company names and many domains - with different and *hidden* >> pricing structures. It is tricky to find the best price from them (they may >> have a half dozen different prices for the same thing, depending on the path >> you take and the cookies you accept to get to a page - very disingenuous, but >> legal - I often tell people to just use Amazon, whose pricing is easier to >> deal with - and far simpler). Once you deal with any of the "front" companies >> everything later comes from the parent - inphonic.com (and even worst - they >> seem to have "affiliates" who do re-directs and mirror pages). >> >> It also seems unlikely to be an "affiliate" spam case, since all >> the affilaites I have seen use a different domain to start, then mark your >> session with one or more cookies (it is far cheaper to go direct, don't walk >> the tree and accept no cookies - then you usually get offered the lowest of >> the available prices). Also, I think they are the single largest reseller >> for both Cingular and T-Mobile (and they were for AT&T, pre-merger). >> > >Yes Paul, unfortunately it appears that InPhonic has decided to take >spamvertising for a whirl, with or without Sprint PCS' blessing. > >My small network consists of my family here at home. We have never had any >prior business relationship with InPhonic. We've never bought anything from >InPhonic or Sprint PCS, and we have not been in the market for any cell phones >for at least two years. I hadn't heard of InPhonic until receiving this spam. > >InPhonic apparently hired a well-known spammer (Spamhaus Block List #20212 at >http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20212) to inflict their message >on the rest of us. They operate with the following domains that I know about, >and almost certainly others: > >clearcutsavings.com >ccs44.com >clearcutsav.com >clrctsvg.com >goccutsav.com >nyclearcut.com > >Since 5/19 "Clearcut", for lack of a better name, has sent me 18 spams. 17 were >false negatives; SA caught the other one. Time for me to up my SURBL scoring, >huh? ;) > >Anyway, here's the relevant spam text: > >"Phone free after instant rebate. This offer is fulfilled by InPhonic inc., an >authorized dealer for Sprint. Offer subject to credit approval or deposit, and >is available to customers activating a new line of service on a two-year >contract with Sprint. Not all US markets are served by Sprint. If you are not in >a Sprint area you will receive another great offer from another major wireless >company. Other restrictions apply, see full offer for details. Offer Expires >soon. Offer may vary." > >And, below is the text from the embedded image: > >"If you no longer wish to receive offers fulfilled from InPhonic, Inc., click >here or write to InPhonic, Inc., ATTN: Customer Relations-compliance 9301 >Peppercorn Place, Largo MD 20774. This is an email ad." > >Of course, clicking on that GIF won't take you to InPhonic, it'll send you to >Clearcut. Here's the code: > ><a href="http://g.clearcutsavings.com/ryhig.aspx?m=[munge]&w=[munge]/"><img >src="http://mirror.clearcutsavings.com/images/ap/spo02.gif" border=0></a> > >My vote for InPhonic is still black. I have no axe to grind though. Whatever >the more experienced among you think, I'm willing to live with it. > >I've sent the spample in various forms to Paul off-list for his review. If >anyone else wants the zip file, please let me know and I'll send it right over. > >TTYL, > >Sean > > I agree - this looks damning enough for me. Do note that clearcut seems to be an "affiliate" - They are in Texas, inphonic is in Maryland (and in NY). I am now entirely certain that "clearcut" is guilty - If an email or telephone call to inphonic doesn't get any response, I'd list them too (it does look like "affiliate" abuse though, since you say that clicking does not take you to inphonic). I did say that they have "strange" (at best) pricing options and a very sophisticated (and not in a good way) web site. BTW. The reason I like inphonic, is that they tend to payout 60-80% of the commision to the customer - so rarely is the phone "free", usually you get paid $150 to $250 to take it (e.g. I got paid $500 for my last two phones). If clearcut is *only* offering "free", that is unusual, even for the affiliates. Paul Shupak track(a)plectere.com P.S. They have an 800 number, mostly staffed by peons, but ask for a manager and somebody will actually call back the next day (my experiences) - I didn't want to give out a Social Security number (and didn't).

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss