Discuss

discuss@lists.surbl.org

1 participants
1864 discussions

Re: spam from Cricket Liu via postsnet/campaigner (FW: Webinar: Active Directory Best Practices for DNS)
by Steven Champeon 10 Jun '05

10 Jun '05

on Fri, Jun 10, 2005 at 10:55:36AM -0700, Tim O'Reilly wrote: > I don't know anything about this. I'll look into it. Thanks, Tim. I appreciate it. -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us! http://hesketh.com/about/careers/account_manager.html join us!

1 0

spam from Cricket Liu via postsnet/campaigner (FW: Webinar: Active Directory Best Practices for DNS)
by Steven Champeon 10 Jun '05

10 Jun '05

FYI - there's been some question about postsnet and campaigner lately on the SURBL whitelist list. Well, I was just subscribed to a postsnet list, managed by campaigner. If you go to the URL to unsub, including the final '.', you get a silly Javascript popup saying "Your work has been saved to date however your session has timed out and you must re-login", hit ok, get redirected to gotmarketing.com thence to campaigner.com. Note that they explicitly say "we bought the list" below. I'm surprised to see Cricket Liu spamming. Guess I'll never buy another edition of _DNS and BIND_. I've Cc:'d Cricket as well as Tim O'Reilly, the publisher for Cricket's book(s). My question is simple: Why did you subscribe me to this list without my permission? If you feel that you have permission from me to subscribe me to this list, may I ask where you think you got it? Is ORA cognizant/accepting of such stupid and/or risky practices by their authors? Steve (ORA author/editor and owner of every edition of DNS and BIND except the next one, if this crap continues...) ----- Forwarded message from Cricket Liu <cricket(a)infoblox.com> ----- X-EL-User-Policy: ASK X-Received-From: Cricket_Liu_gzgrgz(a)postsnet.com X-Delivered-To: <schampeo(a)hesketh.com> X-Originating-IP: [69.28.223.137] Received: from mta11br.postsnet.com (mta11br.postsnet.com [69.28.223.137]) by habanero.hesketh.net (8.13.4/8.13.4/20050406) with SMTP id j59M1gCt012350 for <schampeo(a)hesketh.com>; Thu, 9 Jun 2005 18:02:10 -0400 X-EL-Offwhitelist: sent via mta11br.postsnet.com, occasional spam source Message-ID: <13755331.1118354497825.KadaSegment.82.1(a)mta11br.postsnet.com> Date: Thu, 9 Jun 2005 18:01:37 -0400 (EDT) From: Cricket Liu <cricket(a)infoblox.com> Reply-To: "Cricket Liu" <Cricket_Liu_gzgrgz(a)postsnet.com> To: schampeo(a)hesketh.com Subject: Webinar: Active Directory Best Practices for DNS Errors-To: Cricket_Liu_gzgrgz(a)postsnet.com Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_574142_26711400.1118354497825" Bounces-To: Cricket_Liu_gzgrgz(a)postsnet.com X-Campaign: 494785.494149.458053786 X-Folder: Default Content-Length: 16651 Lines: 386 WEBINAR: DNS BEST PRACTICES FOR BUILDING RESILIENT ACTIVE DIRECTORY INFRASTRUCTURE Tuesday, June 28, 9:00 AM and 4:00 PM (PDT) Register now... http://postsnet.com/r.html?c=494785&r=494149&t=458053786&l=1&d=86127770&u=h… Steve - In our continuing Identity Experts Series, I'm pleased to announce that Infoblox is hosting a free webinar with NetPro, one of the industry's leading experts in Active Directory infrastructure management and a Microsoft Gold Certified Partner. Microsoft's Active Directory is increasingly important to most enterprise networks. As such, it's critical to design and maintain AD system with maximum reliability in mind. A key component of a resilient AD infrastructure is an effective approach to deploying, maintaining, and monitoring DNS. In this informative session, we will explore practical examples of modern DNS best practices that support nonstop AD services in the network. DATES AND REGISTRATION We will hold two sessions on Tuesday, June 28, at 9:00 am and 4:00 pm Pacific. To register for this event, please go to: http://postsnet.com/r.html?c=494785&r=494149&t=458053786&l=1&d=86127770&u=h… (Space is limited, so reserve your seat as soon as possible.) PARTICIPANTS * Gil Kirkpatrick, Chief Technical Officer, NetPro, and author of MacMillan USA's Active Directory Programming, is a renowned expert on enterprise directories and is a 2005 recipient of Microsoft's MVP Award. * Cricket Liu, VP of Architecture, Infoblox, and author of O'Reilly & Associates' DNS and BIND, DNS & BIND Cookbook, and DNS On Windows Server 2003, is an expert on Domain Name System architecture, services, and deployment. * Rick Kagan, VP of Marketing, Infoblox, is an industry expert on securing business networks and developing network identity infrastructure. I hope you can join us! If you have any questions, please contact us at events(a)infoblox.com. Thanks, Cricket Register now... http://postsnet.com/r.html?c=494785&r=494149&t=458053786&l=1&d=86127770&u=h… You are receiving this email because you have requested information from us in the past, have requested information from one of our trusted partners, or are a member of a list that we have purchased. If you would like to change your communications preferences or no longer recieve mailings from Infoblox, please contact us at mailings(a)infoblox.com or write us at Infoblox, 475 Potrero Ave., Sunnyvale, CA 94085 USA. You are subscribed as schampeo(a)hesketh.com. To unsubscribe please click here: http://postsnet.com/r.html?c=494785&r=494149&t=458053786&l=6&ea=schampeo@he…. ----- End forwarded message ----- -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us! http://hesketh.com/about/careers/account_manager.html join us!

1 0

Re: [SURBL-Discuss] [question] my own surbl list?
by List Mail User 09 Jun '05

09 Jun '05

>... >Hello, all. > >I have operated SA 3.0.x with surbl.SURBL is best for me. >and I would like to make my own surbl list for some reason. > >So I added zone below. but it seems that this doesn't work. > > zone "my.surbl.org" { > type master; > file "surbl/my.surbl.org.bind"; > }; > >and added like below at 25_uribl.cf. > >urirhssub URIBL_MY_SURBL my.surbl.org. A 32 >body URIBL_MY_SURBL eval:check_uridnsbl('URIBL_MY_SURBL') >describe URIBL_MY_SURBL Contains an URL listed in the MY SURBL >blocklist >tflags URIBL_MY_SURBL net > > >What's the problem? > >Thanks in advance. > >What's > >_________________________________________________________________ >ºžŽÙ ºüž£°í ºž±â ÆíÇÑ Žºœº. ¿ÀŽÃÀÇ ÈÁŠŽÂ MSN Žºœº¿¡Œ È®ÀÎÇÏŒŒ¿ä. >http://www.msn.co.kr/news/ > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Two problems that probably won't answer your question. 1) You should not try to be authoritative for a subdomain of someone else's domain (i.e. surbl.org) unless they delegate it to you. In other words, pick a domain like mybl.domain.tld where you control domain.tld *or* if you don't control a domain of your own, then choose an invalid tld (e.g. "xyz" or "localdomain") and use a name like "bl.xyz" for your blacklist's domain. 2) Don't add it to "25_uribl.cf" where it will be overwritten by any upgrade; Instead put it in your local.cf (it will function the same way). Finally some advice that might help: Make sure that both you are using the DNS server you have configured the new domain on, and check that it is actually serving the new domain (e.g. "dig new_domain any @my_dns_server" and assuming *nix, that "my_dns_server" is the first listed in resolv.conf). It is probably more likely that you have an error in your zone file or name server config files than in the snippet of SA config above. Good luck, Paul Shupak track(a)plectere.com

1 0

How about uribl.com?
by Monty Ree 08 Jun '05

08 Jun '05

Hello,all. I have found that this site similar to SURBL. http://www.uribl.com/ Anyone who use this BL? How about this URIBL? Thanks in advance. _________________________________________________________________ 고.. 감.. 도.. 사.. 랑.. 만.. 들.. 기.. MSN 러브 http://www.msn.co.kr/love/

3 2

RE: [SURBL-Discuss] How about uribl.com?
by Chris Santerre 08 Jun '05

08 Jun '05

>-----Original Message----- >From: Bret Miller [mailto:bret.miller@wcg.org] >Sent: Wednesday, June 08, 2005 11:24 AM >To: SURBL Discussion list >Subject: RE: [SURBL-Discuss] How about uribl.com? > > >> I have found that this site similar to SURBL. >> >> http://www.uribl.com/ >> >> Anyone who use this BL? >> How about this URIBL? > >I hesitate to respond to this... URIBL is a good list like SURBL is a >good list. SURBL policies strive for a zero-false-positive list so it >can be used blindly to block e-mail. URIBL policies strive for a >zero-false-positive "black" list plus a sends-a-lot-of-spam but may hit >ham "grey" list. These are combined in a multi list so you >shouldn't use >multi to block e-mail. > >In addition, URIBL is really kind of in BETA stage right now. They are >working out the front-end details and I'm sure will soon announce their >existence and be included in a future version of SA. > >Bret LOL, I'm not saying anything. I was going to, but figured I'd wait to see what Jeff said. But since he has already replied to other thread, I guess he chooses to ignore this one ;) I love you Jeff. ;) --Chris

1 0

[question] my own surbl list?
by Monty Ree 08 Jun '05

08 Jun '05

Hello, all. I have operated SA 3.0.x with surbl.SURBL is best for me. and I would like to make my own surbl list for some reason. So I added zone below. but it seems that this doesn't work. zone "my.surbl.org" { type master; file "surbl/my.surbl.org.bind"; }; and added like below at 25_uribl.cf. urirhssub URIBL_MY_SURBL my.surbl.org. A 32 body URIBL_MY_SURBL eval:check_uridnsbl('URIBL_MY_SURBL') describe URIBL_MY_SURBL Contains an URL listed in the MY SURBL blocklist tflags URIBL_MY_SURBL net What's the problem? Thanks in advance. What's _________________________________________________________________ 보다 빠르고 보기 편한 뉴스. 오늘의 화제는 MSN 뉴스에서 확인하세요. http://www.msn.co.kr/news/

2 1

20050605 embedded image spam
by Sean Sowell 05 Jun '05

05 Jun '05

Hello SURBL folks --- Thanks again for your help. Embedded image false negatives continue to drop. Below is a fresh list of dates and domains. I cleaned up the formatting and put each domain on a line. All times are Pacific (now GMT - 7). Will also begin uploading to the URIBL_BLACK and _GREY lists in a few moments (thank you Chris!). Kind regards, Sean S. PS: I keep .eml and .pdf copies of each of these if you need any. ===== 20050601-2349 saverzforyou2.info 20050602-1734 mediagroup.com 20050602-1734 searsappistream.com 20050602-1734 yourbillspaid.com 20050602-1816 consumersurveygroup.com 20050602-1816 internetsmartshopping.com 20050602-1816 shoppingsmarts.net 20050603-0116 consumerresearchcorporation.com 20050603-0116 mediagroup.com 20050603-0116 producttestpanel.com 20050603-0116 roastorianthembers.com 20050603-0155 golfshore.com 20050603-0346 consumerresearchcorporation.com 20050603-0346 mediagroup.com 20050603-0346 palpsenseateddy.com 20050603-0346 producttestpanel.com 20050603-0844 selfshopper.com 20050603-0844 techselfshopper.com 20050603-0903 thedealstouchdown.com 20050603-0903 touchdowndeals.com 20050603-1133 fortuneloungeplayersclub.com 20050603-1133 platinumplay.com 20050603-1133 saverzforyou2.info 20050603-1150 golfshore.com 20050603-1236 calmra.com 20050603-1239 besaway.com 20050603-1340 benderrickshawning.com 20050603-1340 mediagroup.com 20050603-1420 freehandbags.com 20050603-1420 qalba.com 20050603-1420 technologyengagement.com 20050603-1528 consumerresearchcorporation.com 20050603-1528 dicellostereopen.com 20050603-1528 mediagroup.com 20050603-1528 producttestpanel.com 20050603-1556 eahge.com 20050603-1556 eaifo.com 20050603-1556 igetnocredit.com 20050603-1556 implusemg.com 20050603-1625 clickbuyhappiness.com 20050603-1625 teqia.com 20050603-1714 consumerresearchcorporation.com 20050603-1714 mediagroup.com 20050603-1714 penternesternway.com 20050603-1714 producttestpanel.com 20050603-1745 jestersettlending.com 20050603-1745 maxmoolah.com 20050603-1745 mediagroup.com 20050603-1745 winhundred.com 20050603-2025 ptrak.com 20050603-2056 undershow.com 20050603-2150 ptrak.com 20050604-0852 undershow.com 20050604-0944 saverzforyou2.info 20050604-0944 superbrewards.com 20050604-1235 dentalismallergic.com 20050604-1235 mediagroup.com 20050604-1352 eaobs.com 20050604-1352 intelligencebarometer.com 20050604-1352 prizedistributors.com 20050604-1421 eatnh.com 20050604-1421 fcgdirect9.com 20050604-1421 justinthenick.com 20050604-1557 eaaun.com 20050604-1557 farfarawayplaces.com 20050604-1557 implusemg.com 20050604-1627 actmc.com 20050604-1627 kuaea.com 20050604-1627 readyforgoodtimes.com 20050604-1816 creditmethis.com 20050604-1816 dwnow.com 20050604-1816 yourgiftcards.com 20050604-1821 fortuneloungeplayersclub.com 20050604-1821 platinumplay.com 20050604-1821 saverzforyou2.info 20050604-1824 striveforsavings.com 20050604-1824 striveforsavingsnet.com 20050604-1831 overselfshopper.com 20050604-1831 selfshopper.com 20050605-0139 datdir.com 20050605-0139 rocketoffers.com

1 0

RE: [SURBL-Discuss] Blogger attacks SURBL
by Chris Santerre 03 Jun '05

03 Jun '05

>-----Original Message----- >From: Michele Neylon :: Blacknight Solutions >[mailto:michele@blacknight.ie] >Sent: Tuesday, May 31, 2005 5:05 AM >To: 'Jeff Chan'; 'SURBL Discussion list'; 'SpamAssassin Users' >Subject: RE: [SURBL-Discuss] Blogger attacks SURBL > > >discuss-bounces(a)lists.surbl.org wrote: >> Pardon the dramatic title, but hopefully it got your attention. >> >> This guy's domain got listed by Outblaze, we removed it, and >> as thanks this guy paints us as irresponsible. Please help >> us straighten him out, gently: >> >> http://blog.holtz.com/index.php/weblog/comments/blacklisting_blogs/ >> >> I gave it my shot. >> >> Jeff C. > >I love the way his blogging software leaves the email >addresses "naked" > >Mr Michele Neylon Actually they are encrypted in the web code, but decrypted for human readers. To me, thats about as secure as locking the door but leaving the windows open. --Chris

1 0

RE: [SURBL-Discuss] PayPal Joe-job
by Chris Santerre 03 Jun '05

03 Jun '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, June 01, 2005 7:57 PM >To: Joe Wein >Cc: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] PayPal Joe-job > > >On Wednesday, June 1, 2005, 8:19:20 AM, Joe Wein wrote: >> Since I list a lot of fake company domains in >money-forwarding scams on my >> website (a data source of JP on multi.surbl.org), I seem to >have offended a >> few people. > >> Yesterday someone made 4 PayPal payments to my account, two >from the US, one >> from France and one from Australia. PayPal caught it or was >alerted and >> reversed all transfers, as well as suspending my account pending >> investigation. > >Hmm, I just got a paypal donation (first in months it seems) from >someone who has apparently never posted to any of the many spam >lists I'm on. Should I be concerned? Only if the amount ended in .37 cents :) --Chris

1 0

Strange Bounce [Was: Undelivered Mail Returned to Sender]
by Martin G. Diehl 03 Jun '05

03 Jun '05

Why would someone (for example, mailto:nico.prenzel@pn-systeme.de ) signup to an eMail list ... and then require authentication? Just curious ... IMO, if you don't want eMail, don't signup to an active eMail list. -------- Message With Full Headers -------- From: - Tue May 31 07:28:42 2005 X-UIDL: 1117523571.M110438P38333.mx6.oct X-Mozilla-Status: 0001 X-Mozilla-Status2: 10000000 Return-Path: <> Delivered-To: mdiehl(a)nac.net Received: (qmail 38071 invoked by uid 0); 31 May 2005 07:12:36 -0000 Received: from 81.169.145.166 by mx6.oct (envelope-from <>, uid 0) with qmail-scanner-1.25 (clamuko: 0.72. Clear:RC:0(81.169.145.166):. Processed in 0.244881 secs); 31 May 2005 07:12:36 -0000 X-Qmail-Scanner-Mail-From: via mx6.oct X-Qmail-Scanner: 1.25 (Clear:RC:0(81.169.145.166):. Processed in 0.244881 secs) Received: from unknown (HELO natnoddy.rzone.de) (81.169.145.166) by rbl-mx6.oct.nac.net with SMTP; 31 May 2005 07:12:35 -0000 Received: from szpn0002 (p213.54.179.94.tisdip.tiscali.de [213.54.179.94]) by post.webmailer.de (8.13.1/8.13.1) with ESMTP id j4V7CXPC014589 for <mdiehl(a)nac.net>; Tue, 31 May 2005 09:12:34 +0200 (MEST) Received: by szpn0002 (Postfix) id 996CE474E0; Tue, 31 May 2005 09:05:26 +0200 (CEST) Date: Tue, 31 May 2005 09:05:26 +0200 (CEST) From: MAILER-DAEMON(a)szpn0002.pn-systeme.de (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: mdiehl(a)nac.net MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="04F23A26C6.1117523126/szpn0002" Message-Id: <20050531070526.996CE474E0@szpn0002> X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on spamd2.oct X-Spam-Level: *** X-Spam-PrefsFile: nac.net/mdiehl X-Spam-Status: No, score=3.6 required=4.7 tests=RAZOR2_CF_RANGE_51_100, RAZOR2_CHECK autolearn=disabled version=3.0.2 Subject: Undelivered Mail Returned to Sender Date: Tue, 31 May 2005 09:05:26 +0200 (CEST) From: MAILER-DAEMON(a)szpn0002.pn-systeme.de (Mail Delivery System) To: mdiehl(a)nac.net This is the Postfix program at host szpn0002. I'm sorry to have to inform you that your message could not be be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program <nico.prenzel(a)pn-systeme.de>: host 192.168.101.1[192.168.101.1] said: 530 Authentication required (in reply to MAIL FROM command) Reporting-MTA: dns; szpn0002 X-Postfix-Queue-ID: 04F23A26C6 X-Postfix-Sender: rfc822; mdiehl(a)nac.net Arrival-Date: Tue, 31 May 2005 07:59:06 +0200 (CEST) Final-Recipient: rfc822; nico.prenzel(a)pn-systeme.de Action: failed Status: 5.0.0 Diagnostic-Code: X-Postfix; host 192.168.101.1[192.168.101.1] said: 530 Authentication required (in reply to MAIL FROM command) Subject: Re: Blogger attacks SURBL From: "Martin G. Diehl" <mdiehl(a)nac.net> Date: Tue, 31 May 2005 02:02:20 -0400 To: Jeff Chan <jeffc(a)surbl.org> CC: SURBL Discuss <discuss(a)lists.surbl.org>, SpamAssassin Users <users(a)spamassassin.apache.org> Jeff Chan wrote: > Pardon the dramatic title, but hopefully it got your attention. > > This guy's domain got listed by Outblaze, we removed it, and as > thanks this guy paints us as irresponsible. Please help us > straighten him out, gently: > > http://blog.holtz.com/index.php/weblog/comments/blacklisting_blogs/ > > I gave it my shot. > > Jeff C. > -- > Don't harm innocent bystanders. The way I read his response is that he stands against SPAM and in favor of anti SPAM measures ... *provided* he is not inconvenienced. -- Martin

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss