Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

More on gfi.com (Re: Delivery Status Notification (Failure))
by List Mail User 08 Apr '05

08 Apr '05

A *really* good anti-spam/email company - an open relay and they bounce mail to both abuse@ and postmaster@. They are also listed in L2 of SPEWS. -------------------------------------------------------------------------------- >From MAILER-DAEMON Thu Apr 7 22:46:12 2005 From: postmaster(a)gfimalta.com To: track(a)Plectere.com Date: Fri, 8 Apr 2005 07:44:13 +0200 MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="9B095B5ADSN=_01C53B8BE76FEABE00007F02MAILFAXSRV.gfima" X-DSNContext: 335a7efd - 4523 - 00000001 - 80040546 Subject: Delivery Status Notification (Failure) X-OriginalArrivalTime: 08 Apr 2005 05:48:27.0402 (UTC) FILETIME=[95FC9EA0:01C53BFE] This is a MIME-formatted message. Portions of this message may be unreadable without a MIME-capable mail program. --9B095B5ADSN=_01C53B8BE76FEABE00007F02MAILFAXSRV.gfima Content-Type: text/plain; charset=unicode-1-1-utf-7 This is an automatically generated Delivery Status Notification. Delivery to the following recipients failed. postmaster(a)gfi.com abuse(a)gfi.com --9B095B5ADSN=_01C53B8BE76FEABE00007F02MAILFAXSRV.gfima Content-Type: message/delivery-status Reporting-MTA: dns;MAILFAXSRV.gfimalta.com Received-From-MTA: dns;mailgate_old.gfi.com Arrival-Date: Fri, 8 Apr 2005 07:44:13 +0200 Final-Recipient: rfc822;postmaster(a)gfi.com Action: failed Status: 5.1.1 Final-Recipient: rfc822;abuse(a)gfi.com Action: failed Status: 5.1.1 --9B095B5ADSN=_01C53B8BE76FEABE00007F02MAILFAXSRV.gfima Content-Type: message/rfc822 -------------------------------------------------------------------------------- [snipped] Paul Shupak track(a)plectere.com

1 0

More on gfi.com
by List Mail User 08 Apr '05

08 Apr '05

Their SPF/TXT record lists a bunch of addresses including several from Rackspace (the same people who run the domain spamhaus.net), a few really from Malta, and a few from germany. The emails came from Vodaphone in Malta. Paul Shupak track(a)plectere.com

1 0

Forge SURBL mail from gfi.com, just minutes ago.
by List Mail User 08 Apr '05

08 Apr '05

Did anyone else just see forged mail with a "From:" line of "discuss-bounces(a)lists.surbl.org" coming from the IP 80.85.99.13, machine host name mailgate.gfi.com and using a HELO of "passthrough"? Paul Shupak track(a)plectere.com P.S. I refused it, so I don't know what it was. I do know the domain registration is false; There is no city named "San Gwann" in the country of Malta.

2 1

Re: More spams with Zdnet redirector
by J. Fowler 08 Apr '05

08 Apr '05

I posted to the CNET financial message boards on Yahoo and got this response: http://finance.yahoo.com/q/mb?s=CNET ==== Re: CNet supporting spammers NOT* *Folks, We're aware of the abuse, and are shutting down the URLs as we learn of them. We are NOT supporting spammers or phishers. Stephen Howard-Sarin VP, ZDNet.com ===

2 2

Re: [SURBL-Discuss] Re: More spams with Zdnet redirector
by List Mail User 08 Apr '05

08 Apr '05

>... > >On Thursday, April 7, 2005, 1:11:26 PM, J. Fowler wrote: >> I posted to the CNET financial message boards on Yahoo and got this response: > >> http://finance.yahoo.com/q/mb?s=CNET > >> ==== >> Re: CNet supporting spammers NOT* >> *Folks, > >> We're aware of the abuse, and are shutting down the URLs as we learn of them. We are NOT supporting spammers or phishers. > >> Stephen Howard-Sarin >> VP, ZDNet.com >> === > >Can you LART him with: > > http://www3.surbl.org/redirect.html > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Old email: Stephen Howard-Sarin <shs(a)cnet.com> Paul Shupak track(a)plectere.com

1 0

Re: [SURBL-Discuss] Re: More spams with Zdnet redirector
by List Mail User 08 Apr '05

08 Apr '05

>... > >I posted to the CNET financial message boards on Yahoo and got this response: > >http://finance.yahoo.com/q/mb?s=CNET > >==== >Re: CNet supporting spammers NOT* >*Folks, > >We're aware of the abuse, and are shutting down the URLs as we learn of them. We are NOT supporting spammers or phishers. > >Stephen Howard-Sarin >VP, ZDNet.com >=== > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > That sounds a lot like "after the first million or so emails are sent we block the redirector for that URL". It seems to be exactly the same as running an open relay and cutting off access *after* someone complains. Now, of course the same spammer can use the site again tomorrow, with a new domain and a $10 investment. The only safe way to operate a redirector is exactly like running a mail server - Only those clients/domains listed *in advance* can be allowed: Anything else is "supporting spammers"! How many of you would run an open SMTP relay and only blacklist a machine or domain *after* you learn about it sending "abusive" emails? (That's probably why he's a VP, not an engineer.) Paul Shupak track(a)plectere.com

1 0

ZDNet spamity calamity
by Matthew Wilson 08 Apr '05

08 Apr '05

See www.oct17.com and www.october17.com for his contact information. > -----Original Message----- > From: discuss-bounces(a)lists.surbl.org > [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan > Sent: Thursday, April 07, 2005 8:40 PM > To: J. Fowler > Cc: discuss(a)lists.surbl.org > Subject: Re: [SURBL-Discuss] Re: More spams with Zdnet redirector > > On Thursday, April 7, 2005, 1:11:26 PM, J. Fowler wrote: > > I posted to the CNET financial message boards on Yahoo and > got this response: > > > http://finance.yahoo.com/q/mb?s=CNET > > > ==== > > Re: CNet supporting spammers NOT* > > *Folks, > > > We're aware of the abuse, and are shutting down the URLs as > we learn of them. We are NOT supporting spammers or phishers. > > > Stephen Howard-Sarin > > VP, ZDNet.com > > === > > Can you LART him with: > > http://www3.surbl.org/redirect.html > > Jeff C. > -- > "If it appears in hams, then don't list it." > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss > > >

2 1

RE: [SURBL-Discuss] Re: More spams with Zdnet redirector
by Chris Santerre 08 Apr '05

08 Apr '05

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@surbl.org] >Sent: Thursday, April 07, 2005 4:33 PM >To: SURBL Discussion list >Subject: RE: [SURBL-Discuss] Re: More spams with Zdnet redirector > > >Hi! > >>> We're aware of the abuse, and are shutting down the URLs as we >>> learn of them. We are NOT supporting spammers or phishers. > >> If that is the method they want, maybe we could forward them >a few 100k >> domains for them to blacklist? >> >> They will fight a losing battle with this method. > >They could start using SURBL, then its all the same ;) > I believe Jeff had asked them that already. --Chris

2 1

RE: [SURBL-Discuss] Re: More spams with Zdnet redirector
by Chris Santerre 08 Apr '05

08 Apr '05

>-----Original Message----- >From: J. Fowler [mailto:spamtrap@cvip.net] >Sent: Thursday, April 07, 2005 4:11 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] Re: More spams with Zdnet redirector > > >I posted to the CNET financial message boards on Yahoo and got >this response: > >http://finance.yahoo.com/q/mb?s=CNET > >==== >Re: CNet supporting spammers NOT* >*Folks, > >We're aware of the abuse, and are shutting down the URLs as we >learn of them. We are NOT supporting spammers or phishers. If that is the method they want, maybe we could forward them a few 100k domains for them to blacklist? They will fight a losing battle with this method. --Chris

3 2

Leaving SURBL
by Chris Santerre 08 Apr '05

08 Apr '05

Greetings Everyone, As of today, I am leaving SURBL for private reasons. SURBL continues to be one of the best antispam measures. I will be forming my own public URI lists. One black and one gray. But they will not be affiliated with SURBL. (So I'll most likely be begging for mirrors later!) I'll continue to be part of the whitelist group for a while, in case my old submissions need explanation. Consider the new black list to be more aggressive then WS, but striving for the same zero FP rate as WS. Also all domains manually checked. The gray list will be for mainsleeze, and will cause FPs. I'll post more info about the lists after I get some mirrors. Did I mention I need mirrors? :) Thanks, Chris (Needs mirrors) Santerre System Admin and SARE Ninja http://www.rulesemporium.com

5 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss