Discuss

discuss@lists.surbl.org

1862 discussions

Nullsoft .com FP?
by Chris_Barton＠McAfee.com 03 Dec '04

03 Dec '04

Hi, I just noticed nullsoft .com was listed in the sc list. They are the people behind WinAmp Etc & Now owned by AOL. Could one of you review it please? Registered in 1997 and not updated for almost a year. I have a sample showing it was used as link fodder in a cheap s/w spam. Chris.

2 1

Discuss: WAS: SURBL+ Checker Submission
by Chris Santerre 03 Dec '04

03 Dec '04

I stripped the header for this discussion. Is this a spam domain or an attempt to poison SURBL. It is obviously a spam, but is domain bogus? >-----Original Message----- >Subject: SURBL+ Checker Submission > > >Date: Fri Nov 26 02:45:48 2004 > >Applicable List: URIBL:ws.surbl.org >Reported URI/IP: com.info >Rating: Black - 100% spam > >Email Source: >---------------------------------------- > *SNIP* > by ra093.prone.absorptive.skeptic.yahoo.com > (InterMail vB.5.%RNDDIGIT2.%RNDDIGIT2.%RNDDIGIT2 >369-%RNDDIGIT15-9-%RNDDIGIT15-%RNDDIGIT15-%RNDDIGIT510) with ESMTP > id ><%RNDDIGIT515.%RNDUCCHAR355029.ny29-mail.nail.date.net.cable.ro >gers.com@autism> > for <export(a)blnotts.com>; Thu, 25 Nov 2004 20:24:06 -0500 >Message-ID: ><04710%RNDLCCHAR15%RNDDIGIT15%RNDLCCHAR15$%RNDDIGIT17535jf702$% >RNDDIGIT15ms53hme10@bask> >Reply-To: "privacy" <tvwghz(a)yahoo.com> >From: "privacy" <tvwghz(a)yahoo.com> >To: <export(a)blnotts.com> >Subject: cure for anxioty, for the pr1ce of a newspaper a day. >Date: Fri, 26 Nov 2004 05:24:06 +0400 >MIME-Version: 1.0 >Content-Type: multipart/alternative; > boundary="--65897551847182532" > >----65897551847182532 >Content-Type: text/html; >Content-Transfer-Encoding: quoted-printable > ><html> ><body text=3Dblack bgcolor=3Dwhite link=3Dblue alink=3Dblue >vlink=3Dblue> ><center> >Wanted to try Cialis but thought it was >way too expe= >nsive >for you? >You can do that now! Cialis at only $1.90 per dose. >Your best deals are <a >href=3D"http://hesatosser.com.info/?wid=3D100005">H= >ERE</a> > >You have enjoyed Viagra and wish for a >longer effect= >? >Cialis can make it happen. >UNBELIEVABLE! CIALIS AT ONLY $1.90 PER DOSE > >Say NO! to planning sex for hours in advance and your disappointment >after "a missed dose". You don't have to be content with a four hour >action of an regular pill. Get CIALIS now to ensure the whole day of >joyful sexual intimacy for you and your partner. > >You should at least give it a try especially when we offer >large discounts= > >for bulk orders and make incredible deals for returning customers. > > ><a href=3D"http://hesatosser.com.info/?wid=3D100005"> >Get it now > ></a> > > > size=3D"1"><a= > href=3D"http://http://hesatosser.com.com/nomore.html">Go >here</a> to stop= > this from being delivered ></body></html> > >----65897551847182532-- > > >---------------------------------------- >

3 2

RE: [SURBL-Discuss] Discuss: WAS: SURBL+ Checker Submission
by Chris Santerre 02 Dec '04

02 Dec '04

>-----Original Message----- >From: David B Funk [mailto:dbfunk@engineering.uiowa.edu] >Sent: Thursday, December 02, 2004 5:10 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Discuss: WAS: SURBL+ Checker Submission > > >On Thu, 2 Dec 2004, Chris Santerre wrote: > >> I stripped the header for this discussion. Is this a spam >domain or an >> attempt to poison SURBL. It is obviously a spam, but is domain bogus? >> >> >-----Original Message----- >> *SNIP* >> >[snip..] >> >href=3D"http://hesatosser.com.info/?wid=3D100005">H= >> >ERE</a> >[snip..] >> ><a href=3D"http://hesatosser.com.info/?wid=3D100005"> >> >Get it now >[snip..] >> > href=3D"http://http://hesatosser.com.com/nomore.html">Go >> >here</a> to stop= > >Neither, it's broken spam-ware. The actual pill-spam-site >is "hesatosser .com" (which is listed in SURBL ;). > >"*.com.com" is a valid domain name, belongs to CNet, clearly >not spam. "*.com.info" isn't even a valid domain at all. > Thanks dave, that is what I thought. Helped to hear it from someone else :) --Chris

1 0

RE: What is up with surbl.org?
by Chris Santerre 02 Dec '04

02 Dec '04

>-----Original Message----- >From: Mark [mailto:admin@asarian-host.net] >Sent: Thursday, December 02, 2004 3:43 PM >To: users(a)spamassassin.apache.org >Subject: What is up with surbl.org? > > >How come surbl.org has a "Bad" status at rating.cloudmark.com? (see >below). This is not good. > Jealousy? :) Maybe they are related to that fifth dentist? Perhaps Jeff should contact them with a "What up, dude?" email? --Chris (Why won't this javalin lock on target!!!!!) NOTE: I think we should make everyone who uses SURBL buy a copy of Joint Operations and play with us ;) Halo is for small thinking people!

2 1

MISC: Is this why google is looking to hire antispam people?
by Chris Santerre 02 Dec '04

02 Dec '04

Cnet article: http://tinyurl.com/3mgxd Perhaps google should look into using SURBL? Maybe just the phishing part of it? Anyone have a google contact? " Phishers lie in wait for Google searchers Traditionally, phishing scammers have lured their victims to fraudulent Web sites by sending official-looking e-mails that are ostensibly from well-known companies asking users to 'verify' their user names and passwords. Now many are setting up legitimate looking e-commerce sites that disguise links to malicious software as pictures of goods on sale, CyberGuard said Wednesday. Paul Henry, a senior vice president at CyberGuard, said that when Web shoppers search the Internet looking for products they want to buy, they could be directed to a plausible e-commerce site that instructs them to "Click here to download images" of the product. Henry said that instead of linking to pictures of the advertised product, the links point to a self-extracting ZIP file that installs a Trojan horse on the victim's computer. The program could then steal personal and financial information. ......... ... " Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

RE: [SURBL-Discuss] What are the chances of FP on Newsletters and Order Confs.
by Paul Schwarz 02 Dec '04

02 Dec '04

I don't use SA, I use XWall for Exchange and can't set the score of a SURBL... So I only have the choice to mark the subject or just send a DSN. Right now I send a DSN b/c it's useless to forward the spams to the individuals IMHO. I'm not sure what you mean about "Confirmation emails would contain links to your own domain." Actually I'm a spam killer ninja (jr that is) Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100 -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Chris Santerre Sent: Thursday, December 02, 2004 10:59 AM To: 'SURBL Discussion list' Subject: RE: [SURBL-Discuss] What are the chances of FP on Newsletters and Order Confs. >-----Original Message----- >From: Paul Schwarz [mailto:Paul.Schwarz@starktruss.com] >Sent: Thursday, December 02, 2004 10:12 AM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] What are the chances of FP on Newsletters and >Order Confs. > > >Hi Guys, just wondered if using SURBL will block IT Dept, HR Dept and >such >newsletters that people get. We get a lot of those in our depts. > >Also what are the chances of blocking a confirmation emails for >something >someone orders, etc And also Airlines > >Just feeling a little leery of using SURBL for a risk of false >positives. >Seems like a lot of newsletters outsource to companies that could look >like spammers. > >I know it won't block and person to person email but can you help me >feel more comfortable about SURBL ? > Greetings Paul, SURBL should block NONE of these. (Well we don't block anything, we flag, but you know what I mean.) We whitelist airlines. Confirmation emails would contina links to your own domain. You are not a spammer, are you? If you aren't, you won't get listed. If it is an order from to your company it is the same. You can always lower the score of SURBL and try it out if you are worried. But you will be VERY happy with it. 4 out of 5 Dentists approve of SURBL. But we don't count the fifth one, because his parents were cousins ;) Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: [SURBL-Discuss] What are the chances of FP on Newsletters and Order Confs.
by Chris Santerre 02 Dec '04

02 Dec '04

>-----Original Message----- >From: Paul Schwarz [mailto:Paul.Schwarz@starktruss.com] >Sent: Thursday, December 02, 2004 10:12 AM >To: 'SURBL Discussion list' >Subject: [SURBL-Discuss] What are the chances of FP on Newsletters and >Order Confs. > > >Hi Guys, just wondered if using SURBL will block IT Dept, HR >Dept and such >newsletters that people get. We get a lot of those in our depts. > >Also what are the chances of blocking a confirmation emails >for something >someone orders, etc And also Airlines > >Just feeling a little leery of using SURBL for a risk of false >positives. >Seems like a lot of newsletters outsource to companies that >could look like >spammers. > >I know it won't block and person to person email but can you >help me feel >more comfortable about SURBL ? > Greetings Paul, SURBL should block NONE of these. (Well we don't block anything, we flag, but you know what I mean.) We whitelist airlines. Confirmation emails would contina links to your own domain. You are not a spammer, are you? If you aren't, you won't get listed. If it is an order from to your company it is the same. You can always lower the score of SURBL and try it out if you are worried. But you will be VERY happy with it. 4 out of 5 Dentists approve of SURBL. But we don't count the fifth one, because his parents were cousins ;) Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

list of TLDs
by Daniel Quinlan 02 Dec '04

02 Dec '04

I got a long list of TLDs from John Levine, he made no promises about accuracy (quite the opposite), so I suspect there are some mistakes, but I yield it to you. Please let us know if any TLDs should be added to the SpamAssassin URIBL module, though. ;-)

4 3

using local cache?
by Ronan 02 Dec '04

02 Dec '04

hi i posted a mail similar to this on the spamassassin list but its more appropriate to this list... how do i check that my local multi.surbl.org bind file that i put into our DNS is the one being checked when doing SURIBLs lookups? Is there anyway to check who is checking DNS records? I do a spamassassin --lint -D and there is no mention of which DNS server its querying... any other hints?? ronan -- Regards Ronan McGlue ============== Analyst/Programmer Information Services Queens University Belfast BT7 1NN

1 0

RE: [SURBL-Discuss] FP: rgc3.net
by Chris Santerre 02 Dec '04

02 Dec '04

>-----Original Message----- >From: Rob McEwen (PowerView Systems) [mailto:rob@powerviewsystems.com] >Sent: Wednesday, December 01, 2004 2:19 PM >To: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] FP: rgc3.net > > >RE: rgc3.net > >After looking into this some more, I also found it in the >header of a legitimate OfficeDepot newsletter > 1) Its in the header, so don't worry. 2) Total scumbags! http://spews.org/html/S975.html 3) OfficeDepot should be notified. 4) I think this was discussed on Spam-L, that they were fooling legit companies. 5) You will see om-xxxxx.rgcx.net in many headers of spam. 6) If you need more, I'd ask the Spam-L guys. RSK could educate you ;) I believe Playboy actually used them until they found out they were scum. --Chris

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss