Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

Dell's open redirect try 2
by Fred 14 Apr '05

14 Apr '05

Too fast on my buttons, here's the link: http://landingstrip.dell.com/landingstrip/ls.asp?DURL=http://www.google.com/ Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400

1 0

Dell has an open redirector
by Fred 14 Apr '05

14 Apr '05

Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400

1 0

avsMUNGED-gold.com
by Lindsay Snider 14 Apr '05

14 Apr '05

I received a spam from avsMUNGED-gold.com. They are a porn site and all signs lead to blocking them except how long their domain has been around and the lack of information showing up in the tools I didn't block them. Comments? Lindsay

2 4

RE: [SURBL-Discuss] Capital One redirector
by List Mail User 14 Apr '05

14 Apr '05

>... >>-----Original Message----- >>From: List Mail User [mailto:track@plectere.com] >>Sent: Wednesday, April 13, 2005 11:03 PM >>To: maverick(a)capitalone.com; track(a)plectere.com >>Cc: legal(a)capitalone.com; discuss(a)lists.surbl.org >>Subject: RE: [SURBL-Discuss] Capital One redirector >> >> >> Worthless form letter - obviously no human ever read it. Also, >>I was initially wrong, postmaster(a)capitolone.com *does* >>bounce. The chances >>of my ever accepting a CapitolOne credit card offer have just >>gone to zero. >> >> Paul Shupak >> track(a)plectere.com > >Yeah I got the same junk from "Maverick". > >--Chris (Talk to me Goose!) >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Did you also notice that their mail server uses a HELO argument which doesn't resolve? Bad mail and web administration - How good a bank are they likely to be? All of us in the US know that their advertising budget is *very* large; Maybe they should divert some of that money to infrastructure maintainence. Paul Shupak track(a)plectere.com

1 0

RE: [SURBL-Discuss] Capital One redirector
by Chris Santerre 14 Apr '05

14 Apr '05

>-----Original Message----- >From: List Mail User [mailto:track@plectere.com] >Sent: Wednesday, April 13, 2005 11:03 PM >To: maverick(a)capitalone.com; track(a)plectere.com >Cc: legal(a)capitalone.com; discuss(a)lists.surbl.org >Subject: RE: [SURBL-Discuss] Capital One redirector > > > Worthless form letter - obviously no human ever read it. Also, >I was initially wrong, postmaster(a)capitolone.com *does* >bounce. The chances >of my ever accepting a CapitolOne credit card offer have just >gone to zero. > > Paul Shupak > track(a)plectere.com Yeah I got the same junk from "Maverick". --Chris (Talk to me Goose!)

1 0

Ten year registration limit (was Re: [SURBL-Discuss] Re: New redirector: www.nate.com)
by List Mail User 14 Apr '05

14 Apr '05

>... > >List Mail User wrote: > >> gabia.com-munged >> http://www.rfc-ignorant.org/tools/lookup.php?domain=gabia.com > >ACK, that's also the first time that I heard about any "ICANN >10 years limit" for the expiration of com-domains. And here >it's apparently the reason for a whois-RFCI-entry, which RfC >could that be ? Not RfC 1591 or RfC 1032 (looking for "exp"). > >> Its good to know people do read > >I'm a RFCI+SURBL+SPF-fan ;-) Bye, Frank > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Frank, Sorry it took me so long to get back - I've been busy; But I just found another violation of the same rule:) and it took a little more sigging than I expected (almost 20 minutes). The ten year rule can be found in the document at: http://www.internic.net/faqs/domain-names.html Under the heading "How long does a registration last? Can it be renewed?", about 1/3 of the way through the document. It applies to all domain registrations. Paul Shupak track(a)plectere.com P.S. The new violator is the NIC for ".nu" - i.e. nic.nu.

1 0

Abused Open ZDNet Redirector
by Spam Control 14 Apr '05

14 Apr '05

Hello Yahoo!, Several of our users receive your Yahoo! Alerts. This is a valuable service for our users. Included in your Yahoo! Alerts are links which frequently use a redirector at zdnet.com, such as: http://chkpt.zdnet.com/chkpt/siliconfeed/http://networks.silicon.com/teleco… Unfortunately, this is an "open" redirector, readily available for abuse, and readily, frequently, and repeatedly abused by spammers. zdnet.com has so far chosen to NOT close this redirector. Instead of limiting its use to valid commercial activity, registered in advance, they allow this redirector to be used for any purpose, valid or spam. Because of this, because of the amount of spam we have been receiving that uses this redirector, we have had to implement tests which identify http://chkpt.zdnet.com/chkpt as spam-sign. This may have the unfortunately side-effect of causing some of your Yahoo! Alerts to be mis-identified as spam. The anti-spam community has been unable to get zdnet.com to change their policy concerning this redirector. If you are able to get them to see the error of their ways, we will gladly remove these tests from our anti-spam system. Until then, all we can do is hope that it does not affect your Yahoo Alerts! too badly. Sincerely, SpamControl, Menschel.net

1 0

RE: [SURBL-Discuss] Capital One redirector
by List Mail User 14 Apr '05

14 Apr '05

Worthless form letter - obviously no human ever read it. Also, I was initially wrong, postmaster(a)capitolone.com *does* bounce. The chances of my ever accepting a CapitolOne credit card offer have just gone to zero. Paul Shupak track(a)plectere.com -------------------------------------------------------------------------------- >From maverick(a)capitalone.com Wed Apr 13 19:35:10 2005 >X-Server-Uuid: 80E87EA0-9936-41C1-8001-884D959F42CB >Date: Wed, 13 Apr 2005 14:23:27 -0400 >To: "List Mail User" <track(a)Plectere.com> >Subject: RE: [SURBL-Discuss] Capital One redirector >From: Maverick <maverick(a)capitalone.com> >MIME-Version: 1.0 >X-Mailer: Kana 6.0 >X-WSS-ID: 6E43BC13148132-24-01 >Content-Type: text/plain; > charset=us-ascii >Content-Transfer-Encoding: 8bit >X-MIME-Autoconverted: from quoted-printable to 8bit by Plectere.com id j3E2ZABh013550 > >Thank you for notifying us of this suspicious email. Please note that the >email was not originated by Capital One and you should not respond to it. >While this email has not compromised Capital One's systems in any way, we >take these incidents seriously and work with law enforcement agencies to >investigate them. > >In the future, you should respond to emails only sent from valid/secured >websites. Make sure you are responding to an email from Capital One by >typing in the url (or website address) and not clicking on a link. We >would encourage you to contact the company [or Capital One] if you receive >a questionable email to verify that it was sent from the company. To >verify that emails are sent from Capital One or not, please forward them to >Capital One at abuse(a)capitalone.com. Customer Relations representatives >will respond in writing. > >We do appreciate your concerns and if you have additional questions, please >do not hesitate to contact us. > >Sincerely, > >Capital One Services(R) > >Visit us online at http://www.capitalone.com, where you can access valuable >products and services. > > > >Original Message Follows: >------------------------- > >>... >>>-----Original Message----- >>>From: Craig Baird [mailto:craig@xpressweb.com] >>>Sent: Wednesday, April 13, 2005 11:58 AM >>>To: discuss(a)lists.surbl.org >>>Subject: [SURBL-Discuss] Capital One redirector >>> >>> >>>Wow! Look at this open Capital One redirector in a phishing >>>spam. Talk about >>>a phisher's dream come true! >> >>HOLY Shiznat!! You have got to be kidding me! WOW! >> >>What the hell are they thinking? >> >>--Chris > > Chris, > > Where's that list of redirectors? > > How do these large companies find such stupid people to do this >for them? Wouldn't you think any programmer would tell his boss why >these shouldn't exist? Or is there some book with an example every idiot >is copying from? > > Paul Shupak > track(a)plectere.com > >P.S. There seem to be no limits on where this one will take you, porn, >pills, >and penis gadgets, etc.. > > >http://www.capitalone.com/redirect.html?linkid=I_sell_drugs_any_kiddie_porn >&dest=http://www.google.com > > >

1 0

Re: [SURBL-Discuss] Capital One redirector
by List Mail User 14 Apr '05

14 Apr '05

>... > >On Wednesday, April 13, 2005, 8:57:49 AM, Craig Baird wrote: >> Wow! Look at this open Capital One redirector in a phishing spam. Talk about >> a phisher's dream come true! > >More importantly is anyone contacting Capital One? If not, >then please do. > >Jeff C. >-- >"If it appears in hams, then don't list it." > Jeff, On one of the first messages I "Cc" about four addresses at Capitol One; And Chris S. replied, leaving the "Cc"'s intact. Let's hope someone at abuse@, postmaster@ or any of their contact addresses reads email. (Cc: legal(a)capitalone.com, postmaster(a)capitalone.com, abuse(a)capitalone.com, hostmaster(a)capitalone.com - none bounced). Also, Joseph Burford, noted that he had sent them a message directly (didn't mention what address - possibly "spoof@"?). Paul Shupak track(a)plectere.com

1 0

Capital One redirector
by Craig Baird 14 Apr '05

14 Apr '05

Wow! Look at this open Capital One redirector in a phishing spam. Talk about a phisher's dream come true! Capital One is committed to maintaining a safe environment for its community of buyers and sellers. To protect the security of your account, Capital One Bank employs some of the most advanced security systems in the world and our anti-fraud teams regularly screen the Capital One Bank system for unusual activity. We recently have determined that different computers have logged onto your Capital One Banking account, and multiple password failures were present before the logons. We now need you to re-confirm your account information to us. If this is not completed by April 14, 2006, we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes. We thank you for your cooperation in this manner. In order to confirm your Online Bank records, we may require some specific information from you. Click below to verify your account http://www.capitalone.com/redirect.html? linkid=SECURITY+VALIDATION&dest=http://24.232.117.142/bin/capitalone.com/ Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account. We apologize for any inconvenience. If you choose to ignore our request, you leave us no choice but to temporaly suspend your account. Thank you for using Capital One Bank! ---------------------- It looks like the website has been taken down, but the redirector is still open. -- Craig

4 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss