Discuss

discuss@lists.surbl.org

1862 discussions

Re: [SURBL-Discuss] Capital One redirector
by List Mail User 14 Apr '05

14 Apr '05

>... > >On Wednesday, April 13, 2005, 8:57:49 AM, Craig Baird wrote: >> Wow! Look at this open Capital One redirector in a phishing spam. Talk about >> a phisher's dream come true! > >More importantly is anyone contacting Capital One? If not, >then please do. > >Jeff C. >-- >"If it appears in hams, then don't list it." > Jeff, On one of the first messages I "Cc" about four addresses at Capitol One; And Chris S. replied, leaving the "Cc"'s intact. Let's hope someone at abuse@, postmaster@ or any of their contact addresses reads email. (Cc: legal(a)capitalone.com, postmaster(a)capitalone.com, abuse(a)capitalone.com, hostmaster(a)capitalone.com - none bounced). Also, Joseph Burford, noted that he had sent them a message directly (didn't mention what address - possibly "spoof@"?). Paul Shupak track(a)plectere.com

1 0

Capital One redirector
by Craig Baird 14 Apr '05

14 Apr '05

Wow! Look at this open Capital One redirector in a phishing spam. Talk about a phisher's dream come true! Capital One is committed to maintaining a safe environment for its community of buyers and sellers. To protect the security of your account, Capital One Bank employs some of the most advanced security systems in the world and our anti-fraud teams regularly screen the Capital One Bank system for unusual activity. We recently have determined that different computers have logged onto your Capital One Banking account, and multiple password failures were present before the logons. We now need you to re-confirm your account information to us. If this is not completed by April 14, 2006, we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes. We thank you for your cooperation in this manner. In order to confirm your Online Bank records, we may require some specific information from you. Click below to verify your account http://www.capitalone.com/redirect.html? linkid=SECURITY+VALIDATION&dest=http://24.232.117.142/bin/capitalone.com/ Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account. We apologize for any inconvenience. If you choose to ignore our request, you leave us no choice but to temporaly suspend your account. Thank you for using Capital One Bank! ---------------------- It looks like the website has been taken down, but the redirector is still open. -- Craig

4 3

RE: [SURBL-Discuss] Capital One redirector
by Matthew.van.Eerde＠hbinc.com 13 Apr '05

13 Apr '05

Craig Baird wrote: > Wow! Look at this open Capital One redirector in a phishing spam. > Talk about a phisher's dream come true! > http://www.capitalone.com/redirect.html?linkid=SECURITY+VALIDATION&dest=htt… EBay had one of these recently... actually it took you to a login page, and redirected you once you logged in. Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer perl -e"map{y/a-z/l-za-k/;print}shift" "Jjhi pcdiwtg Ptga wprztg,"

1 0

RE: [SURBL-Discuss] Capital One redirector
by Chris Santerre 13 Apr '05

13 Apr '05

>-----Original Message----- >From: List Mail User [mailto:track@plectere.com] >Sent: Wednesday, April 13, 2005 1:49 PM >To: discuss(a)lists.surbl.org >Cc: legal(a)capitalone.com; postmaster(a)capitalone.com; >abuse(a)capitalone.com; hostmaster(a)capitalone.com >Subject: RE: [SURBL-Discuss] Capital One redirector > > >>... >>>-----Original Message----- >>>From: Craig Baird [mailto:craig@xpressweb.com] >>>Sent: Wednesday, April 13, 2005 11:58 AM >>>To: discuss(a)lists.surbl.org >>>Subject: [SURBL-Discuss] Capital One redirector >>> >>> >>>Wow! Look at this open Capital One redirector in a phishing >>>spam. Talk about >>>a phisher's dream come true! >> >>HOLY Shiznat!! You have got to be kidding me! WOW! >> >>What the hell are they thinking? >> >>--Chris > > Chris, > > Where's that list of redirectors? > > How do these large companies find such stupid people to do this >for them? Wouldn't you think any programmer would tell his boss why >these shouldn't exist? Or is there some book with an example >every idiot >is copying from? > > Paul Shupak All open redirs are going to be listed on our gray uribl list. We are still finishing up the infrastructure now. Already have a bunch of mirrors. So as soon as its up, I'm sure a lot of these guys will sit up and take notice at their emails being blocked. Our list will consider ANY open redirector to be in the same category as an open mail relay. I've already started looking for more of these open redirs. --Chris

1 0

RE: [SURBL-Discuss] Capital One redirector
by List Mail User 13 Apr '05

13 Apr '05

>... >>-----Original Message----- >>From: Craig Baird [mailto:craig@xpressweb.com] >>Sent: Wednesday, April 13, 2005 11:58 AM >>To: discuss(a)lists.surbl.org >>Subject: [SURBL-Discuss] Capital One redirector >> >> >>Wow! Look at this open Capital One redirector in a phishing >>spam. Talk about >>a phisher's dream come true! > >HOLY Shiznat!! You have got to be kidding me! WOW! > >What the hell are they thinking? > >--Chris Chris, Where's that list of redirectors? How do these large companies find such stupid people to do this for them? Wouldn't you think any programmer would tell his boss why these shouldn't exist? Or is there some book with an example every idiot is copying from? Paul Shupak track(a)plectere.com P.S. There seem to be no limits on where this one will take you, porn, pills, and penis gadgets, etc.. http://www.capitalone.com/redirect.html?linkid=I_sell_drugs_any_kiddie_porn…

1 0

RE: [SURBL-Discuss] Capital One redirector
by Chris Santerre 13 Apr '05

13 Apr '05

>-----Original Message----- >From: Craig Baird [mailto:craig@xpressweb.com] >Sent: Wednesday, April 13, 2005 11:58 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] Capital One redirector > > >Wow! Look at this open Capital One redirector in a phishing >spam. Talk about >a phisher's dream come true! HOLY Shiznat!! You have got to be kidding me! WOW! What the hell are they thinking? --Chris

2 1

Re: [SURBL-Discuss] avsMUNGED-gold.com
by List Mail User 12 Apr '05

12 Apr '05

Jeff, Look again, dtag. de is listed at rfci for whois, postmaster, and abuse! Paul Shupak track(a)plectere.com

1 0

Re: [SURBL-Discuss] avsMUNGED-gold.com
by List Mail User 12 Apr '05

12 Apr '05

>... > >I received a spam from avsMUNGED-gold.com. They are a porn site and all signs >lead to blocking them except how long their domain has been around and the >lack of information showing up in the tools I didn't block them. >Comments? > >Lindsay >_______________________________________________ >... > % jwhois avs-gold.com [Querying whois.internic. net] [Redirected to whois.registrar.telekom. de] [Querying whois.registrar.telekom. de] [whois.registrar.telekom. de] [whois.registrar.telekom. de] % Copyright (c)2003 by Deutsche Telekom AG % % Restricted rights. % % % Except for agreed Internet operational purposes, no part of this % information may be reproduced, stored in a retrieval system, or % transmitted, in any form or by any means, electronic, mechanical, % recording, or otherwise, without prior permission of the Deutsche Telekom AG % on behalf of itself and/or the copyright holders. Any use of this % material to target advertising or similar activities are explicitly % forbidden and will be prosecuted. The Deutsche Telekom AG requests % to be notified of any such activities or suspicions thereof. domain: avs-gold.com registrant-hdl: RDT-H70 admin-c: RDT-AM174 tech-c: RDT-UH124 zone-c: RDT-HM3 nserver: pns.dtag. de nserver: secondary000.dtag. net. status: connected changed: 2004-01-14 source: DEUTSCHE TELEKOM AG % jwhois -h whois.registrar.telekom. de ha RDT-AM174 [Querying whois.registrar.telekom. de] [whois.registrar.telekom. de] [whois.registrar.telekom. de] % Copyright (c)2003 by Deutsche Telekom AG % % Restricted rights. % % % Except for agreed Internet operational purposes, no part of this % information may be reproduced, stored in a retrieval system, or % transmitted, in any form or by any means, electronic, mechanical, % recording, or otherwise, without prior permission of the Deutsche Telekom AG % on behalf of itself and/or the copyright holders. Any use of this % material to target advertising or similar activities are explicitly % forbidden and will be prosecuted. The Deutsche Telekom AG requests % to be notified of any such activities or suspicions thereof. nic-hdl: RDT-AM174 type: person firstname: Achim lastname: Maier address: Rosengarten 14 pcode: D-80805 city: Muenchen country: DE e-mail: A-Maier22@gmx. de phone: +49 899945687 fax-no: changed: 2002-08-05 source: DEUTSCHE TELEKOM AG The adminitrative contact appears to have an invalid telephone number; Too few digits for the prefix code of +49:89. If rfci accepts it (the person who actually checks is likely to be German), then I'll wdprs it. Paul Shupak track(a)plectere.com P.S. Note, the name servers are listed at rfci already (trivial, but real).

1 0

RE: [SURBL-Discuss] avsMUNGED-gold.com
by Chris Santerre 12 Apr '05

12 Apr '05

>-----Original Message----- >From: Lindsay Snider [mailto:lindsay@pa.net] >Sent: Tuesday, April 12, 2005 10:39 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] avsMUNGED-gold.com > > >I received a spam from avsMUNGED-gold.com. They are a porn >site and all signs >lead to blocking them except how long their domain has been >around and the >lack of information showing up in the tools I didn't block them. >Comments? > >Lindsay If they sent you a spam you didn't subscribe for...then whats the question? 62.159.229.68 - IP hosts 39 Total Domains ... Showing 1 - 39 out of 39 Domain Name 1 ALTE-GEILE-WEIBER.COM. 2 AMATEUR-MUSCHI.COM. 3 AVS-GOLD.COM. 4 BILDER-KOSTENLOS.COM. 5 ECHT-GRATIS.COM. 6 EDELHUREN.ORG. 7 GEIL-ONANIEREN.COM. 8 GEILE-OSTFRAUEN.COM. 9 GEILE-RUBENSFRAUEN.COM. 10 GEILE-SELBSTBEFRIEDIGUNG.COM. 11 GRATIS-BILDER.COM. 12 GRATISFOTO.COM. 13 GRATISWICHSER.COM. 14 GRATISWIXER.COM. 15 GROSSE-GEILE-TITTEN.COM. 16 HOBBYHURE-ZUM-FICKEN.COM. 17 KLEINE-TITTEN.ORG. 18 KOSTENLOS-FICKEN.ORG. 19 LECKEN-BLASEN-FICKEN.COM. 20 MEGA-HAENGETITTEN.COM. 21 PRIVAT-FICKEN.COM. 22 PRIVATCAM.ORG. 23 PRIVATE-WEBCAM.ORG. 24 RASIERTE-HURE.COM. 25 RASIERTE.ORG. 26 RIESENTITTEN.ORG. 27 ROTHAARIGE.ORG. 28 RUBENSFRAUEN.ORG. 29 SCHLAMPENBILDER.ORG. 30 SCHWANGERE-FRAUEN.NET. 31 SCHWULE-SEITE.COM. 32 SEX-ADRESSEN.ORG. 33 SEX-HURE.COM. 34 SEX-KONTAKT.ORG. 35 SEX-UMSONST.ORG. 36 VOYEURNETZ.ORG. 37 WE-PRIVATE.COM. 38 WEBCAM-PRIVAT.COM. 39 WIXPICS.COM. HTH, --Chris

1 0

Re: [SURBL-Discuss] More spams with Zdnet redirector
by List Mail User 10 Apr '05

10 Apr '05

>... >Date: Sat, 9 Apr 2005 10:56:10 +0200 (CEST) >From: Raymond Dijkxhoorn <raymond(a)surbl.org> >X-X-Sender: raymond(a)mailbox.prolocation.net >To: "Kevin A. McGrail" <kmcgrail(a)pccc.com> >Subject: Re: [SURBL-Discuss] More spams with Zdnet redirector >... > >Hi! > >> Why the use of the full test rather than the uri test? >> Regards, > >>> full PROLO_REDIR_ZDNET_CHECK_1 /http:\/\/.*chkpt.zdnet.com\/chkpt/ >>> score PROLO_REDIR_ZDNET_CHECK_1 8.0 >>> describe PROLO_REDIR_ZDNET_CHECK_1 PROLO_REDIR-ZDNET CHECK_1_2_3, Body > >URI tests are done on the toplevel domain, i dont want to block whole >zdnet... > >If you have something else that can do it, thats also fine, i mean, this >works for us <tm> > >Bye, >Raymond. >... I've begun sending them to shs(a)cnet.com - no bounce, but no response either. Starting tomorrow, *all* the CNet editors get a copy. Todays below. Paul Shupak track(a)plectere.com P.S. The messages was blocked, but only because of local rules (in particular, that zdnet is now in rfci.whois, and the forged headers said netscape.net which is in rfci.abuse and rfci.postmaster), which put the message at .05 poiints above the account's threshold for spam. I need to type in Raymond's rule - probably in the next hour. -------------------------------------------------------------------------------- --- spam body ------------------------------------------------------------------ -------------------------------------------------------------------------------- Is this what you asked for, I searched high and low for this. According to my findings, this one place has the stuff you asked for to help with your mood swings. I've used them them before so has a bunch of our friends, so don't worry. Here's there new location http://chkpt.zdnet.com/chkpt/wk/univcs.info/p/yo1 Please, contact me if you got any further questions Jason Trade between India and Pakistan is less than 1 percent of their combined total exports. Per capita income stood at $470 in India in 2002 and $420 in Pakistan, the World Bank says. "The task of finishing off the black plague of terrorism is a nagging necessity that cannot be delayed," he said. Holding the civil ceremony at Windsor Guildhall instead of the castle? Who cares. Having your future mother- and father-in-law boycott the actual wedding? Boo-hoo. Like you'll miss them.

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss