Discuss

discuss@lists.surbl.org

1862 discussions

RE: [SURBL-Discuss] WS & DS FP?
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: David Hooton [mailto:david.hooton@gmail.com] >Sent: Tuesday, August 24, 2004 10:42 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] WS & DS FP? > > >On Tue, 24 Aug 2004 10:16:39 -0400, Chris Santerre ><csanterre(a)merchantsoverseas.com> wrote: >> I agree. But the legit companies were spamming. That was >what I was trying >> to say, although poorly :) Some of the NANAS posts have >legit companies in >> them, but are spam. Most likely they paid a company to >market them. Or they >> tried there hand at doing it themselves and purchased a >list. This looks >> like the main focus of yesmail/clickaction. A mass email >marketing company. >> SO they will get legit companies to pay them to >advertise/spam for them. >> >> They are a spammer for hier. I don't see them in ANY legit >mail other then >> this one single run with itworld. And that is because of a >seminar on how to >> use email for mass marketing! I may get overruled on this >one, but I'm >> sticking to my guns that they are spammers. > >I'm with Chris, string them up! > >How about a slightly more moderate approach, lets not whitelist them, >but lets remove them from the list for now. If they re-offend then we >list them until such time as they prove themselves as whitehat. > >This kind of domain is a very slippery one, it incredibly hard to put >them on either side of the FP fence. >-- >Regards, > >David Hooton Oh it gets even better according to our friend. Related domains! abii.com businesscreditusa.com businessusa.com clickaction.com databaseamerica.com dblink.com directoriesusa.com donnelleymarketing.com easymailers.org emailmarketing.com enterconnect.net infousa.com infousadomain.com infousagov.com infousaproductsupport.com insync-palm.com libraryusa.com listbazaar.com mysalesconnection.com myyesmail.com newleadsusa.com nomail.com p01.com p02.com p03.com p04.com pondmail.com postdirect.com salesgenie.net salesleadsusa.biz salesleadsusa.com yesmail-inc.com yesmail.com yesmail.net yesmail.org ym0.com ym0.net ymc0.com ymc0.net So what do you think of them now? --Chris

1 0

RE: [SURBL-Discuss] WS & DS FP?
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 9:48 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] WS & DS FP? > > >On Tuesday, August 24, 2004, 6:46:01 AM, Chris Santerre wrote: >> Sorry I just noticed yesmail.com is listed is SURBL. So >clickaction.net >> should be as well. They are one in the same. > >Listings should not necessarily be associative. The real test >remains as "how spammy are they?" Do these guys do anything >legitimate? The NANAS customers of clickaction looked pretty >legitimate to me, assuming they're really customers. > >Jeff C. > I agree. But the legit companies were spamming. That was what I was trying to say, although poorly :) Some of the NANAS posts have legit companies in them, but are spam. Most likely they paid a company to market them. Or they tried there hand at doing it themselves and purchased a list. This looks like the main focus of yesmail/clickaction. A mass email marketing company. SO they will get legit companies to pay them to advertise/spam for them. They are a spammer for hier. I don't see them in ANY legit mail other then this one single run with itworld. And that is because of a seminar on how to use email for mass marketing! I may get overruled on this one, but I'm sticking to my guns that they are spammers. --Chris

3 2

RE: [SURBL-Discuss] Improved name server status page
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Tuesday, August 24, 2004 9:39 AM >To: SURBL Discussion list >Subject: RE: [SURBL-Discuss] Improved name server status page > > >Hi! > >> >Currently I have the DNS timeout set to 10 seconds with two >> >retries. What kind of values are more typical or standard >> >for resolvers? > >> >I will use the scripts that generate the page to send >> >notifications (probably to myself at first) once things >> >stabilize. Since events don't happen very often, it's >> >probably not necessary to show a history on the page. > >> That is very cool! However do you think it is wise to make >public the IP's >> of the servers? > ><BOFH mode=on> > >No, indeed, lets hide them, it will only cause problems if we >list them ;) > ><BOFH mode=off> > >Chris, you paranoid DONKEY :) how do you think people should >lookup the >zones if we dont publish where to get them. DNS does the exact >same thing. > >; <<>> DiG 9.2.1 <<>> ns surbl.org >;; global options: printcmd >;; Got answer: >;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21524 >;; flags: qr rd ra; QUERY: 1, ANSWER: 12, AUTHORITY: 0, ADDITIONAL: 12 > >;; QUESTION SECTION: >;surbl.org. IN NS > >;; ANSWER SECTION: >surbl.org. 13466 IN NS ns9.surbl.org. >surbl.org. 13466 IN NS ns8.surbl.org. >surbl.org. 13466 IN NS ns7.surbl.org. >surbl.org. 13466 IN NS ns6.surbl.org. >surbl.org. 13466 IN NS ns5.surbl.org. >surbl.org. 13466 IN NS ns3.surbl.org. >surbl.org. 13466 IN NS ns2.surbl.org. >surbl.org. 13466 IN NS ns13.surbl.org. >surbl.org. 13466 IN NS ns12.surbl.org. >surbl.org. 13466 IN NS ns11.surbl.org. >surbl.org. 13466 IN NS ns10.surbl.org. >surbl.org. 13466 IN NS ns1.surbl.org. > >;; ADDITIONAL SECTION: >ns9.surbl.org. 14175 IN A 209.234.97.11 >ns8.surbl.org. 14175 IN A 66.59.111.182 >ns7.surbl.org. 14175 IN A 130.161.128.84 >ns6.surbl.org. 14175 IN A 128.255.17.20 >ns5.surbl.org. 14175 IN A 128.255.17.19 >ns3.surbl.org. 14175 IN A 139.130.4.5 >ns2.surbl.org. 14175 IN A 209.204.159.15 >ns13.surbl.org. 14175 IN A 66.170.2.60 >ns12.surbl.org. 14175 IN A 66.170.2.50 >ns11.surbl.org. 14175 IN A 64.21.208.212 >ns10.surbl.org. 14175 IN A 66.251.133.4 >ns1.surbl.org. 14175 IN A 208.201.249.238 > LOL, yeah I realise that, but let the spammers do that. Why make it easy for them. Most can't spell DNS. :) The more hoops they have to go thru the better. I'm sure we may see a DDOS attempt by first quarter next year. --Chris

3 2

RE: [SURBL-Discuss] Improved name server status page
by Chris Santerre 24 Aug '04

24 Aug '04

Almost perfect. You have to follow RFC standards and name them either star wars or Simpsons Characters. Not ns1, ns2, ...... :) --Chris >-----Original Message----- >From: William C. Devine II [mailto:william@devine.net] >Sent: Tuesday, August 24, 2004 10:00 AM >To: Jeff Chan; SURBL Discussion list >Subject: RE: [SURBL-Discuss] Improved name server status page > > >You could keep a generic list of nameservers such as 'Server >1', 'Server >2', etc, which correlates to 'ns1', 'ns2', etc. It'd just add a level >of obscurity and require just a little more of a monkey to figure out >though. > >william > >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 6:40 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Improved name server status page > > >On Tuesday, August 24, 2004, 6:32:44 AM, Chris Santerre wrote: >> That is very cool! However do you think it is wise to make public the >IP's >> of the servers? > >Yeah that kind of raised some flags for me too, but the servers >are easy enough to find, and the names of the servers are not >unique due to the round robin. > >For example e.surbl.org resolves to two different name servers. > >So the only thing unique and used for the subdomains are their >IP addresses. I suppose we could set up another set of aliases >for them, but kind of don't want another set to maintain. >(The old style ns1, ns2, etc. names remain but for BIND >type servers for the parent zone. They have already diverged >from the rbldnsd servers.) > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] whitelist rm04.net and rm02.net?
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 2:14 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] whitelist rm04.net and rm02.net? > > >On Monday, August 23, 2004, 6:12:57 PM, Jeff Chan wrote: >> We've had a request to whitelist rm04.net and rm02.net. > >> Does anyone know anything about them? They seem to belong to: > >>> SilverPOP Systems >>> (DOM-151479) >>> 200 Galleria Parkway >>> Suite 750 Atlanta >>> GA >>> 30339 US > >> And reportedly appeared in a newsletter belonging to: >> Altiris http://www.altiris.com > >Someone I trust told me SilverPOP is whitehat, so I've >whitelisted them: > >silverpop.com >rm01.net >rm02.net >rm03.net >rm04.net >rm05.net >rm06.net >rm07.net >rm08.net >rm09.net >rm10.net > > >Jeff C. > I have no comment on their spamminess. But here is the list of more silverpop domains, from a good source ;) adm02.com ecommercial.com mailsubs.com mindarrow.com mindarrow.net radicalmail.com rm01.net rm02.net rm03.net rm04.net rm06.net rm07.net rm08.net silverpop.com --Chris

2 1

RE: [SURBL-Discuss] Phish via "previewmysite.com"
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: David B Funk [mailto:dbfunk@engineering.uiowa.edu] >Sent: Monday, August 23, 2004 11:15 PM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] Phish via "previewmysite.com" > > >Found a citibank phish that used a redirect thru go.msn.com to >'zach.com.previewmysite.com' (see attached message). > >Is previewmysite.com guilty or an innocent open site that is being >exploited? My eyes! They see nothing! Help!!!!!! I think you forgot to attach it! Without even seeing it, I think they are being exploited, and they may need to start using SURBL to check their users. --Chris

1 0

RE: [SURBL-Discuss] Improved name server status page
by William C. Devine II 24 Aug '04

24 Aug '04

You could keep a generic list of nameservers such as 'Server 1', 'Server 2', etc, which correlates to 'ns1', 'ns2', etc. It'd just add a level of obscurity and require just a little more of a monkey to figure out though. william -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Tuesday, August 24, 2004 6:40 AM To: SURBL Discuss Subject: Re: [SURBL-Discuss] Improved name server status page On Tuesday, August 24, 2004, 6:32:44 AM, Chris Santerre wrote: > That is very cool! However do you think it is wise to make public the IP's > of the servers? Yeah that kind of raised some flags for me too, but the servers are easy enough to find, and the names of the servers are not unique due to the round robin. For example e.surbl.org resolves to two different name servers. So the only thing unique and used for the subdomains are their IP addresses. I suppose we could set up another set of aliases for them, but kind of don't want another set to maintain. (The old style ns1, ns2, etc. names remain but for BIND type servers for the parent zone. They have already diverged from the rbldnsd servers.) Jeff C. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: [SURBL-Discuss] WS & DS FP?
by Chris Santerre 24 Aug '04

24 Aug '04

Sorry I just noticed yesmail.com is listed is SURBL. So clickaction.net should be as well. They are one in the same. --Chris

2 1

RE: [SURBL-Discuss] WS & DS FP?
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 3:51 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] WS & DS FP? > > >On Tuesday, August 24, 2004, 12:27:22 AM, David Funk wrote: >> On Mon, 23 Aug 2004, Jeff Chan wrote: > >>> > <! click the link below or copy it into a web browser.> >>> > <! >>> > >https://secure.clickaction.MUNGEDnet/ClickAction?func=S_TurnOff >Html&partname=itworld&uid=MUNGED >>> > ========== >>> >>> > It was tagged by both WS and DS. Should this domain be >whitelisted and/or >>> > removed from these SURBLs? >>> >>> I'm going to assume that itworld.com would not put spammer >>> domains in their newsletter. Whitelisting: >>> >>> accelacommunications.com >>> itwpub1.com >>> itworld.com >>> clickaction.net >>> >>> If anyone knows anything about any of them, please speak >>> up. > >> FWIW, I've got "clickaction.net" spam in my archive and there's >> a couple hundred NANAS listings for them too. > >> It may be that that "secure.clickaction.net" is the clean side >> of their house but I have spam sent from the clickaction.net >> mail servers containing "www.clickaction.net" URLs. > >I took a look at some of the NANAS hits on clickaction.net and >most of them seem to be for legitimate businesses and >organizations. That leads me to think we should keep them off >the lists, though they do seem somewhat spammy. > >Anyone else know anything about them? > Good lord the deeper the rabbit hole goes, the spammier they look! They are yesmail, and yesmail is a spammer in my book! They are using itworld as a "Legitimizer" How does this quote of theirs sound to you? "Join Yesmail, Latham & Watkins, and Accela Communications to learn more about how you can mitigate risk to your company and continue to leverage the power of email communications in your marketing programs." With a quote like that, I would keep them listed in a heartbeat. And the more I look the more I say let them stay. You legit companies in NANAS still look like spam. The vermont teddy stuff looks like a run on a purchased mail list. I keep looking, and I keep seeing spammer! Someone show me a legit ham, that was optin, or asked for! --Chris

1 0

Improved name server status page
by Jeff Chan 24 Aug '04

24 Aug '04

I've set up a better SURBL name server status page at: http://www.surbl.org/nameservers-output.html which is also linked from the main page. It shows some latency in zone file propagation, and it also shows one of the name servers down. (Bjorn is that coming back eventually?) We may want to ask all the public name servers to rsync every 10 minutes.... Would that be OK Raymond? Currently I have the DNS timeout set to 10 seconds with two retries. What kind of values are more typical or standard for resolvers? I will use the scripts that generate the page to send notifications (probably to myself at first) once things stabilize. Since events don't happen very often, it's probably not necessary to show a history on the page. Comments? Jeff C.

2 3

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss