Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

Re: [SURBL-Discuss] More spams with Zdnet redirector
by List Mail User 07 Apr '05

07 Apr '05

>... > >On Wednesday, April 6, 2005, 11:54:56 AM, Patrik Nilsson wrote: >> At 01:26 2005-04-06 -0700, Jeff Chan wrote: >>>Raymond, Paul and others, please LART them. >>> >>>We're not going to blacklist zdnet. > >> It's not zdnet, it's chkpt.zdnet.com. > >> Does chkpt.zdnet.com show up in ham? > >> http://groups-beta.google.com/groups?q=%22chkpt.zdnet.com%22&start=10&scori… > >> Are we still 100% opposed to trying to find a way to include sub-domains in >> surbls? > >> Patrik > >It's possible to list subdomains, but this one chkpt.zdnet.com >would still probably not be appropriate since it probably has >legitimate uses. Also subdomains may not be checked by SURBL >applications. > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > It is actually worse than a subdomain. If it were a simple "static" name, maybe you could list the IP. But it is a CNAME with a five minute TTL, and it *does* seem to change regularly! % dig chkpt.zdnet.com any @ns.cnet.com ; <<>> DiG 9.3.0 <<>> chkpt.zdnet.com any @ns.cnet.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18416 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3 ;; QUESTION SECTION: ;chkpt.zdnet.com. IN ANY ;; ANSWER SECTION: chkpt.zdnet.com. 300 IN CNAME c10-dw-xw-lb.cnet.com. ;; AUTHORITY SECTION: zdnet.com. 86400 IN NS ns.cnet.com. zdnet.com. 86400 IN NS ns2.cnet.com. zdnet.com. 86400 IN NS ns3.cnet.com. ;; ADDITIONAL SECTION: ns.cnet.com. 86400 IN A 216.239.126.10 ns2.cnet.com. 86400 IN A 206.16.0.71 ns3.cnet.com. 86400 IN A 216.239.120.69 ;; Query time: 19 msec ;; SERVER: 216.239.126.10#53(ns.cnet.com) ;; WHEN: Thu Apr 7 07:58:20 2005 ;; MSG SIZE rcvd: 166 % dig c10-dw-xw-lb.cnet.com any @ns.cnet.com ; <<>> DiG 9.3.0 <<>> c10-dw-xw-lb.cnet.com any @ns.cnet.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46613 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3 ;; QUESTION SECTION: ;c10-dw-xw-lb.cnet.com. IN ANY ;; ANSWER SECTION: c10-dw-xw-lb.cnet.com. 300 IN A 216.239.115.143 ;; AUTHORITY SECTION: cnet.com. 86400 IN NS ns.cnet.com. cnet.com. 86400 IN NS ns2.cnet.com. cnet.com. 86400 IN NS ns3.cnet.com. ;; ADDITIONAL SECTION: ns.cnet.com. 86400 IN A 216.239.126.10 ns2.cnet.com. 86400 IN A 206.16.0.71 ns3.cnet.com. 86400 IN A 216.239.120.69 ;; Query time: 20 msec ;; SERVER: 216.239.126.10#53(ns.cnet.com) ;; WHEN: Thu Apr 7 07:58:51 2005 ;; MSG SIZE rcvd: 156 Yesterday (or the day before), it pointed at a different IP. I still think the only effective LART is a short message, and forward the problem email to the CNet editors (but maybe someone else can find a person at CNet to listen - I can't). Meanwhile, If they don't do something soon - I promise when I own cnet.com and zdnet.com, there will not be any redirectors:) Paul Shupak track(a)plectere.com

2 1

Re: [SURBL-Discuss] More spams with Zdnet redirector
by List Mail User 07 Apr '05

07 Apr '05

>From discuss-bounces(a)lists.surbl.org Wed Apr 6 01:34:26 2005 >Date: Wed, 6 Apr 2005 01:26:12 -0700 >From: Jeff Chan <jeffc(a)surbl.org> >X-Mailer: The Bat! (v1.62q) Personal >Organization: SURBL >X-Priority: 3 (Normal) >To: Raymond Dijkxhoorn <raymond(a)surbl.org> >Subject: Re: [SURBL-Discuss] More spams with Zdnet redirector >... >Cc: SURBL Discussion list <discuss(a)lists.surbl.org> >... > >Raymond, Paul and others, please LART them. > >We're not going to blacklist zdnet. > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > I spent over an hour today trying to speak to anyone on the editorial staff. I managed to leave two messages, and spoke to two people who were to "much" too busy to talk (they had been expecting other calls). The "Editor", Jeff Pelline, said if I sent him an email, he would "try" to get to it tomorrow; After, well over an hour - I gave up. They had moved buildings and disconnected their old telephone numbers about a year ago, so ten minutes later I "wdprs"'d and "rfci.whois"'d about 8 of their domains - that only took about 7 minutes of my time - now they can spend a few hours cleaning up and maybe then they will "have time" to talk (Note: they already had some listings for bouncing abuse@ & postmaster@ emails - seem they have a history of an overly aggressive "spam" filter" that bounces what appear to be innocuous messages - so I doubt you can discuss "spam" with them by email; And while they have cleared a few entries, they just ignore some of the others). I seriously doubt there is anyone to send a LART to (most of their domains bounce either abuse@, postmaster@ or both or even worse, show the accounts as being over-quota - i.e. nobody reads them). We'll see if the people I left messages for actually return my calls. I've given up on them - they are of the general apparent belief "my time is more valuable than yours". Someone else can burn a few hours on it. I like Raymond's rule - maybe I'll just block them outright - I don't get anything from them commonly, certainly not often (it has been many years since I found the news.com digests to have any value). Paul Shupak track(a)plectere.com P.S. The telephone numbers are "hidden", but anyone who wants to try is welcome: http://news.com.com/2040-1096_3-0.html?tag=ne.ft.si.con All their listed registration contact data is invalid (this is an Internet company)!? P.P.S. The sales department answered consistantly, but them transfered me into an endless hold pattern which seems to hang up after about ten minutes. P.P.P.S. The "Editor-at-large", Michael Kanellos, is the person who writes most often and most recently about spam, but his voice mailbox was full!

3 2

next redir?
by Alex Broens 07 Apr '05

07 Apr '05

Is this new? http://g.msn.com/0MNBUS00/1?http://www.true-offers.com/dip/ Alex

2 1

RE: [SURBL-Discuss] Re: Leaving SURBL
by Chris Santerre 06 Apr '05

06 Apr '05

>-----Original Message----- >From: Frank Ellermann [mailto:nobody@xyzzy.claranet.de] >Sent: Wednesday, April 06, 2005 3:55 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] Re: Leaving SURBL > > >Chris Santerre wrote: > >> As of today, I am leaving SURBL for private reasons. > >That's sad, why not do your own thing with your own zone, >but otherwise stay here (= SURBL ML) and share your ideas ? Yeah, I'm going to stay on this mailing list as well. Someones got to bring the funny! > >> they will not be affiliated with SURBL > >If you have an idea which doesn't fit into multi.* you could >still use the existing infrastruture in a cs.surbl.org zone, >in theory. In practice you apparently came to the conclusion >that that's not what you want... Without draggin out the details, I would have liked to work under the surbl.org zone. but ..... > (or that Jeff hates the idea). *cough* --Chris (He said it! I didn't!) :)

1 0

Re: [SURBL-Discuss] More spams with Zdnet redirector
by List Mail User 06 Apr '05

06 Apr '05

>... > >Replying to my own mail, Zdnet finally seems to have taken care of its >redirector. The link >"http://chkpt.zdnet.com/chkpt/howbad/rdx56.info/p/yo" that appeared in >the spam is now not being redirected it shows a message > >"Forbidden to relay request through this server" > >finally they seem to have taken care of this. > > >Rakesh wrote: > >> Guys >> >> Seems Zdnet doesn't bothers about its open redirectors as yet. This is >> a spam that I trapped just 5 mins back. Spammers are enjoying using >> these openredirectors. >> >> Can any one send a reminder to Zdnet of this redirector. >> >> The Spam ....... >> >> Hi, >> >> Wanna get up 4 times in one night, well we've got the answer for you, >> check >> us out at http://chkpt.zdnet.com/chkpt/howbad/rdx56.info/p/yo >> >> > > >-- >Regards, >Rakesh B. Pal >Emergic CleanMail Team. >Netcore Solutions Pvt. Ltd. > >-- >Revolutions do not require corporate support. > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > I have to repeat, send copies of your spam to the editors They are now applying an proprietary spam filter to the redirector. Try http://chkpt.zdnet.com/chkpt/howbad/www.google.com/ or for the more daring Try http://chkpt.zdnet.com/chkpt/howbad/www.wiurrc.mfdi.beeiturmoi.com/ (drug spam - no porn - no pictures -- but "kiddie porn" at Yahoo! works also) and watch it work. They have stated that they "are providing a service". Until we all trust that their spam filtering is as good as any that anyone of us might do, they are basically an open relay and should be treated as such! Jeff, please reconsider and list them until it is REALLY fixed. As far as I can tell, they only block the sites which they have received specific complaints about. This policy SUCKS. Paul Shupak track(a)plectere.com Closing the door after the animals are already free *does not* count!

1 0

Re: [SURBL-Discuss] More spams with Zdnet redirector
by List Mail User 06 Apr '05

06 Apr '05

>... > >On Tuesday, April 5, 2005, 10:19:27 AM, List User wrote: >> I hate to repeat myself, but... > >> Please, just forward any spam arriving in this fashion to a list of >> the various editors at Cnet. Then, and only then will the problem be addressed. >> Right now they consider this to be a "service" that they offer! > > >> Paul Shupak >> track(a)plectere.com > >I don't think it's right to spam other people. Report them to >their abuse address, the media, slashdot, etc. > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Jeff, In general, I agree with your statement. Maybe I should have said to send a note, and append the spam. This is I feel a special case, because CNet *is* the media! Sending mail to abuse@, slashdot, etc. will likely be ignored as long as they consider this a service (from a telephone call to them - a low level tech. who "asked" a supervisor, and didn't want to forward me - seem quite bothered by the whole process and left a bad taste in my mouth). It seems that the editors are *exactly* the people to send copies to. I did originally note that I left off the list the names and email addresses of executives as they did not seem appropriate (corporate types are neither the "media" or technical staff - so here we agree on at least part). Beside, if you add a note, you are not spamming them, but merely "informing the media" just as you recommend:) I'll give this more though (I have only gotten one so far). Bye, Paul Shupak track(a)plectere.com

1 0

RE: [SURBL-Discuss] More spams with Zdnet redirector
by List Mail User 06 Apr '05

06 Apr '05

>... > >I thought they fixed this????? > >--Chris > >>-----Original Message----- >>From: Rakesh [mailto:rakesh@netcore.co.in] >>Sent: Tuesday, April 05, 2005 9:19 AM >>To: SURBL Discussion list >>Subject: [SURBL-Discuss] More spams with Zdnet redirector >> >> >>Guys >> >>Seems Zdnet doesn't bothers about its open redirectors as yet. >>This is a >>spam that I trapped just 5 mins back. Spammers are enjoying >>using these >>openredirectors. >> >>Can any one send a reminder to Zdnet of this redirector. >> >>... I hate to repeat myself, but... Please, just forward any spam arriving in this fashion to a list of the various editors at Cnet. Then, and only then will the problem be addressed. Right now they consider this to be a "service" that they offer! Paul Shupak track(a)plectere.com

2 1

RE: [SURBL-Discuss] More spams with Zdnet redirector
by Chris Santerre 05 Apr '05

05 Apr '05

I thought they fixed this????? --Chris >-----Original Message----- >From: Rakesh [mailto:rakesh@netcore.co.in] >Sent: Tuesday, April 05, 2005 9:19 AM >To: SURBL Discussion list >Subject: [SURBL-Discuss] More spams with Zdnet redirector > > >Guys > >Seems Zdnet doesn't bothers about its open redirectors as yet. >This is a >spam that I trapped just 5 mins back. Spammers are enjoying >using these >openredirectors. > >Can any one send a reminder to Zdnet of this redirector. > >The Spam ....... > >Hi, > >Wanna get up 4 times in one night, well we've got the answer >for you, check >us out at http://chkpt.zdnet.com/chkpt/howbad/rdx56.info/p/yo > > >-- >Regards, >Rakesh B. Pal >Emergic CleanMail Team. >Netcore Solutions Pvt. Ltd. > >-- >Revolutions do not require corporate support. > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

Yet another redirector
by Alex Broens 29 Mar '05

29 Mar '05

Good Morning! New redir? ------ For more information or to have a broker contact you please visit: http://g.msn.com/0MNBUS00/1?http://ok-ref-now.com No future contact: http://g.msn.com/0MNBUS00/1?http://ok-ref-now.com/gone.asp -- Does anybody know soemone @msn? mailing abuse is like... forget it thanks Alex // Pls bare my mood - I'm wearing a Nicotin patch //

3 3

use of caching proxy's data
by Alain 26 Mar '05

26 Mar '05

Hi Have you thought about using the logdata from caching proxy's to check against this data and the other SURBL lists? The caching proxy's logfiles contain a very good view on which domains are used while surfing. While not all domains that are used are legit, I would be surprised if active spam domains were frequently visited over a period in the past. Those frequently surfed to domains shouldn't be whitelisted by default, but it could be a trigger to have a closer look before placing them on a list. A very nice thing about this data is that it has a long period of usefulness even data from a few months ago will be very usefull, if not more usefull than the data of today or from the past week. A caching proxy could also make good use from the surbl lists. Not caching spammers domains or even adding a delay of several seconds (or even adding a warning page) before returning the page could be usefull. Especially in non ISP use (organisations, companies,etc...) where there are less problems with blocking content. Alain

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss