- Discuss - Mailman 3

Re: RFC: Adding SpamBouncer phishing data to ph.surbl.org
by Frank Ellermann 31 Jul '05

31 Jul '05

Jeff Chan wrote: > Catherine's data come from antiphishing.org plus her own Sometimes I use antiphishing.org for "manual" reports in addition to SC. > Does anyone have comments on adding these to the PH list? Sounds good, bye, Frank

1 0

Please test sc2.surbl.org (and xs.surbl.org)
by Jeff Chan 29 Jul '05

29 Jul '05

sc2.surbl.org, the improved version of the SpamCop SURBL list, is ready for testing. So is the new version of xs.surbl.org, which is now more accurate, has far fewer FPs, etc. sc2 adds resolved IP checks, meaning sites hosted on the same networks are detected immediately upon the first report. It also means that folks should continue to use SpamCop reporting if they want to contribute to a very powerful SURBL list. Your SpamCop reports now have even more power in sc2. In cases of the worst spammers, SpamCop reporting leads to essentially immediate listing in sc2. sc2 is on about 15 public nameservers and xs is on 22. That's probably not enough for running large production servers on, but it should be plenty for corpus checks and mail servers with small to medium message volumes. If you have rsync access to the SURBL zone files you can also mirror the files locally for testing of course. The sc2 and xs zones are currently available via rsync. (If you have a large volume mail server, please apply for rsync access so that you can mirror the zone files locally: http://www3.surbl.org/rsync-signup.html and offload the public nameservers.) After sc2 is tested for a while we will turn it into the production sc.surbl.org list, assuming it has better performance than the current list, which seems quite likely. At that point sc2 will go away, since it will have become sc. xs may go into the 128th bit of multi.surbl.org if it tests well. Please test sc2 and the revised xs and let us know how they perform for you. Those with large spam and ham corpora (such as the SpamAssassin developers) are encouraged to test and please let us know. Here are SpamAssassin 3.0.1 and later configs for using these two lists: urirhsbl URIBL_SC2_SURBL sc2.surbl.org. body URIBL_SC2_SURBL eval:check_uridnsbl('URIBL_SC2_SURBL') describe URIBL_SC2_SURBL Has URI in SC2 at http://www.surbl.org/lists.html tflags URIBL_SC2_SURBL net score URIBL_SC2_SURBL 3.0 urirhsbl URIBL_XS_SURBL xs.surbl.org. body URIBL_XS_SURBL eval:check_uridnsbl('URIBL_XS_SURBL') describe URIBL_XS_SURBL Has URI in XS - Testing tflags URIBL_XS_SURBL net score URIBL_XS_SURBL 2.0 SpamAssassin 2.64 rules and scores using SpamCopURI 0.22 or later look like this: uri SC2_URI_RBL eval:check_spamcop_uri_rbl('sc2.surbl.org','127.0.0.2') describe SC2_URI_RBL Has URI in SC2 at http://www.surbl.org/lists.html tflags SC2_URI_RBL net score SC2_URI_RBL 3.0 uri XS_URI_RBL eval:check_spamcop_uri_rbl('xs.surbl.org','127.0.0.2') describe XS_URI_RBL Has URI in XS - Testing tflags XS_URI_RBL net score XS_URI_RBL 2.0 Jeff C. -- Don't harm innocent bystanders.

5 8

Re: [SURBL-Discuss] Joe Wein has a new friend?
by List Mail User 25 Jul '05

25 Jul '05

>> FWIW Joe's getting jobbed: > >Hi Jeff, > >I had three joe jobs against me between December 2003 and February 2004. >Since then it had been quiet, but I must say I wasn't entirely surprized >that it continued, especially after a PayPal joe job less than two months >ago. > >> Return-Path: <bouteille(a)kinki-kids.com> >> Received: from dbzmail.com ([61.85.57.209]) >> by smtp1.supranet.net (8.12.10/8.12.10) with SMTP id >j6P3ZTlx009677 >> for <x>; Sun, 24 Jul 2005 22:35:30 -0500 (CDT) >> Received: from kinki-kids.com (kinki-kids-com-bk.mr.outblaze.com >[64.62.181.92]) >> by dbzmail.com (Postfix) with ESMTP id E5A841602F >> for <x>; Sun, 24 Jul 2005 00:39:14 -0500 >> From: "Ambulance U. Descant" <bouteille(a)kinki-kids.com> > >This seems to be a bulkmailer that inserts fake Outblaze references into the >headers to obscure the broadband hosts that are the real sources (or >proxies). I've seen other examples with other bogus Outblaze maildomains for >the fake sender. According to one admin who monitored the Joe job sources >from their site the hosts are running something called "DMS Revolution proxy >spam engine". > >Joe > >>... DMS is Alexey Panov's bulk mailer product. That and porn sites are his main stock in trade see the Spamhaus listings (currently #6, down for #5 since Kuvayev made #3). More info on Panov available is you ask. So now we know who you pissed off - and why it "looks" like a porn site. Paul Shupak track(a)plectere.com

1 0

Joe Wein has a new friend?
by Jeff Chan 25 Jul '05

25 Jul '05

FWIW Joe's getting jobbed: __ Return-Path: <bouteille(a)kinki-kids.com> Received: from dbzmail.com ([61.85.57.209]) by smtp1.supranet.net (8.12.10/8.12.10) with SMTP id j6P3ZTlx009677 for <x>; Sun, 24 Jul 2005 22:35:30 -0500 (CDT) Received: from kinki-kids.com (kinki-kids-com-bk.mr.outblaze.com [64.62.181.92]) by dbzmail.com (Postfix) with ESMTP id E5A841602F for <x>; Sun, 24 Jul 2005 00:39:14 -0500 From: "Ambulance U. Descant" <bouteille(a)kinki-kids.com> To: Info <x> Subject: Hi dear Date: Sun, 24 Jul 2005 00:39:14 -0500 Message-ID: <100101c59012$879febec$06412c2e(a)kinki-kids.com> MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2605 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1123 X-GMX-Antivirus: 0 (no virus found) X-UIDL: K,H!!c%?"!Fde!!XT9"! Hi Try jwSpamSpy, our spam filter for POP3 mailboxes. We use it to track spammers and scammers. Free full featured 30 day evaluation version available! http://www.joewein.de/ -- Don't harm innocent bystanders.

5 6

Re: [SURBL-Discuss] Joe Wein has a new friend?
by List Mail User 25 Jul '05

25 Jul '05

>... > >FWIW Joe's getting jobbed: >__ > >Return-Path: <bouteille(a)kinki-kids.com> >Received: from dbzmail.com ([61.85.57.209]) > by smtp1.supranet.net (8.12.10/8.12.10) with SMTP id j6P3ZTlx009677 > for <x>; Sun, 24 Jul 2005 22:35:30 -0500 (CDT) >Received: from kinki-kids.com (kinki-kids-com-bk.mr.outblaze.com [64.62.181.92]) > by dbzmail.com (Postfix) with ESMTP id E5A841602F > for <x>; Sun, 24 Jul 2005 00:39:14 -0500 >From: "Ambulance U. Descant" <bouteille(a)kinki-kids.com> >To: Info <x> >Subject: Hi dear >Date: Sun, 24 Jul 2005 00:39:14 -0500 >Message-ID: <100101c59012$879febec$06412c2e(a)kinki-kids.com> >MIME-Version: 1.0 >Content-Type: text/plain >Content-Transfer-Encoding: 7bit >X-Priority: 3 (Normal) >X-MSMail-Priority: Normal >X-Mailer: Microsoft Outlook, Build 10.0.2605 >Importance: Normal >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1123 >X-GMX-Antivirus: 0 (no virus found) >X-UIDL: K,H!!c%?"!Fde!!XT9"! > >Hi >Try jwSpamSpy, our spam filter for POP3 mailboxes. >We use it to track spammers and scammers. >Free full featured 30 day evaluation version available! > >http://www.joewein.de/ > >... kinki-kids.com is actually a quite legitimate Outblaze customer. Every forgery or it I have seen is for CP or at least "std." pornography. So maybe Joe can guess at who he pissed off. The sender's IP 61.85.57.209 seems to be a comprimised Windows box on DSL at Kornet - Dynamic address too. The IP is only listed at five-ten, SORBS, NOMOREFUNN, and NJABL; In other words, not really listed or listable (except as dynamic or for full Korean blockage). If it is still the same machine connected at that IP, the entrance was probably the wide open UPnP port or the IIS running. Backdoor installed on port 123 (ntp) UDP - machine is "0wn3d". Also, the routing takes an "interesting" side trip by way fo Kornet -> TONEK (China) the back -> Kornet. Maybe a very good hack at the router level (AS4766 to AS17431 back to AS4766) - Not many people capable of that. I doubt many people running any BLs would list Joe. Paul Shupak track(a)plectere.com

1 0

GoDaddy's take on Google patent (fwd)
by Justin Mason 24 Jul '05

24 Jul '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 not sure how useful this may be, but fyi... - --j. - ------- Forwarded Message > Date: Fri, 22 Jul 2005 22:11:13 -0600 > From: Marcia Blake > > This comes to us fresh from the July GoDaddy.com newsletter (naturally, > in a bit trying to sell longer domain registration terms on > GuessWhere): > > Google recently filed United States Patent Application 20050071741. As > part of that application, Google made apparent its efforts to wipe out > search engine spam, stating: > > "Valuable (legitimate) domains are often paid for several years in > advance, while doorway (illegitimate) domains rarely are used for more > than a year. Therefore, the date when a domain expires in the future > can be used as a factor in predicting the legitimacy of a domain and, > thus, the documents associated therewith." > > Domains registered for longer periods give the indication, true or > not, that their owner is legitimate. Google uses a domain's length of > registration when indexing and ranking a Web site for inclusion in > their organic search results. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) Comment: Exmh CVS iD8DBQFC4pFrMJF5cimLx9ARAt0CAJ0Rjjd7Owx/ba4AhZzZc1NdmQI6xACeI0L9 FVY5zV+kY5cQuVH/VpEEYrQ= =w9zn -----END PGP SIGNATURE-----

3 3

Help checking domains
by Jeff Chan 20 Jul '05

20 Jul '05

Some of these were blacklisted recently, but perhaps shouldn't be. Do you have any information about these domains? tim.com.br 7 year old domain, but I can't read Portugese. What do they do? Is it possibly legitimate? callin.net Korean tech site of some kind. 5.5 years old. ivyro.net Korean, 2.5 years old. drugstorebestbuys.com Sells prescription drugs. Obviously very high spam potential, but has been around for about 4 years. bgreetings.com Greeting cards. Also potentially spammy, but more than 4 years old. Jeff C. -- Don't harm innocent bystanders.

2 1

[off-topic] Help with AOL Postmaster Problem
by Kevin A. McGrail 17 Jul '05

17 Jul '05

Hi All: Apologies in advance for off-topic post but it is for a good cause and if anyone will know an answer, it's most likely to come from the Anti-SPAM community. My company is pro bono handling the website and donating all the time to handle mailing list, web design, paypal coordination, and more for Susan Torres, a pregnant woman who collapsed from an aneurysm and is brain dead from a cancer. However, with her wishes and her families support they are trying to save her unborn child. The site is http://www.susantorresfund.org/ if you want to know more. However, on the more technical side, we have thousands and thousands of subscribers to the mailing list but AOL started rate limiting us on Thursday. We are vigilant anti-spammers and run a tight ship so we are not blacklisted or BUT we aren't whitelisted either. This is causing heavy queuing and complaints from customers all around. I have spoken at length to AOL's Postmaster Help Desk but they are telling me 5 days to 3 weeks to process the whitelist request which we placed on Friday. In the meantime, our customers are getting mad about their email, our servers are filling up on deferred emails and there is also major news expected on Monday the 18th which will make the issue much worse. The AOL Postmaster Case # is 155527142. The Ticket is 995445. The IP that needs whitelisting is 209.225.49.10. Anyone who has any contacts that can help escalate and resolve this issue as soon as possible (and hopefully before the 18th) would be greatly appreciated. Thanks in advance, Kevin A. McGrail aka KAM Chairman Peregrine Computer Consultants Corporation 3927 Old Lee Hwy, Suite 102-C Fairfax City, VA 22030-2422 http://www.pccc.com/ 800-823-8402 - 703-359-8451 Fax kmcgrail(a)pccc.com

2 2

Testing new versions of SC and XS
by Jeff Chan 14 Jul '05

14 Jul '05

The new SURBL data engine is ready enough to start testing. The external lists such as WS, JP, OB, AB, PH have essentially the same content as before, but the SC and XS lists are significantly updated. The new XS list is twice as large at about 1000 records and the inclusion is a lot more selective to get more spammers and far fewer FPs. The new SC list has about the same 500 or so records based on report counts, but adds nearly 4000 domains based on their IP resolutions into the most spammy networks. That's in addition to my manual blacklist which is also several thousand records now, but the manual blacklist applies to both old and new lists, so it's the bad IP domains that are the main change. By design, they're very spammy; they're pretty much the most spammy of those reported to SpamCop. I'd like us to start testing these now. We can simply change XS over to the new data at some point, but for SC, we should set up a temporary new domain like sc2.surbl.org so it can be tested independently of sc. The new lists should be significant improvements over the old lists, but naturally we should test the new SC list before putting it into production since sc is currently live. Would anyone with a public nameserver like to carry sc2 for testing? It is a temporary zone and will go away after testing. Please reply off list if you can serve it up. Perhaps we'll cut over XS when we have SC2 set up so the changes are more or less simultaneous. Might make testing/stats simpler to keep track of that way. Note: please don't start testing sc2 in a major way until we have several name servers set up. Even then the name servers probably won't handle large production loads, so it should be tested on smaller mail servers, test corpora, etc. We'll mention here when it's ok to start testing. Comments? Jeff C. -- Don't harm innocent bystanders.

1 0

Re: Discuss Digest, Vol 16, Issue 5
by J. Fowler 09 Jul '05

09 Jul '05

>On Friday, July 8, 2005, 4:55:18 PM, Jeff Chan wrote: > > >>On Thursday, July 7, 2005, 5:23:53 PM, Jeff Chan wrote: >> >> >>>On Thursday, July 7, 2005, 3:15:18 PM, Frank Ellermann wrote: >>> >>> >>>>Jeff Chan wrote in >>>><http://mid.gmane.org/41160649.20050707074952@surbl.org> >>>> >>>> > > > >>>>>Does anyone know of a new application doing queries against >>>>>multi.surbl.org by using dnsstuff's web site, as in: >>>>> >>>>> > >>FWIW Scott has traced the lookups to a very poorly implemented >>web site checker (probably looking for phishing sites) for Firefox. >>I'm asking him for more details. >> >> > >Here is the borkenware: > > https://addons.mozilla.org/extensions/moreinfo.php?application=firefox&id=9… > >Due to Scott's actions it is no longer functional as written. >I am leaving a comment on the board there: > > > I saw that addon and came across this: http://forums.mozillazine.org/viewtopic.php?t=283545 I'm not sure how an auto-update feature would work, perhaps if the ISP did it for their subscribers, but could this concept be a benifical extension to mozilla?

1 0

New application querying dnsstuff?
by Jeff Chan 09 Jul '05

09 Jul '05

Does anyone know of a new application doing queries against multi.surbl.org by using dnsstuff's web site, as in: http://www.DNSstuff.com/tools/lookup.ch?domain=example.com.multi.surbl.org If so, would you please let them know this is not the right way to query our SURBL lists. It's possibly malware, but more likely some new misbehaving application being run on end user client machines (dsl lines, etc.). Jeff C. -- Don't harm innocent bystanders.

3 6

RE: [SURBL-Discuss] FP report: theaimsgroup.com
by Chris Santerre 09 Jul '05

09 Jul '05

I show it whitelisted. --Chris >-----Original Message----- >From: jm(a)jmason.org [mailto:jm@jmason.org] >Sent: Friday, July 08, 2005 3:08 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] FP report: theaimsgroup.com > > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >in SC, JP? > >- --j. > >- ------- Forwarded Message >> Date: Fri, 08 Jul 2005 00:37:03 -0500 >> From: Antonio Gallardo <antonio(a)apache.org> >> To: Justin Mason <jm(a)jmason.org> >> Subject: The aimsgroup is a spam source? >> >> Hi Justin: >> >> I am sorry to bother you. I am not subscribed to any SA >list. This is >> why I sent this to you directly. The problem is that >theaimsgroup.com is >> started to be in SURBL. I wonder why. This is one of the >most consulted >> archives in the ASF. I think they are not spamming at all, >but you are >> more expert than me in this area. ;-) >> >> The mail contains some links to theaimsgroup.com. >> >> X-Spam-Level: ***** >> X-Spam-Status: Yes, score=5.4 required=5.0 tests=URIBL_JP_SURBL, >> URIBL_SC_SURBL autolearn=no version=3.0.4 >> X-Spam-Report: >> * 1.5 URIBL_JP_SURBL Contains an URL listed in the JP >SURBL blocklist >> * [URIs: theaimsgroup.com] >> * 3.9 URIBL_SC_SURBL Contains an URL listed in the SC >SURBL blocklist >> * [URIs: theaimsgroup.com] >> >> I hope you can send this to the right direction. ;-) >> >> Best Regards, >> >> Antonio Gallardo. >> >> ****************** FULL MAIL HEADER ************************* >> >> Return-Path: ><pmc-return-476-apmail-antonio=apache.org(a)forrest.apache.org> >> Received: from minotaur.apache.org (minotaur.apache.org >[209.237.227.194]) >> by ags01.agsoftware.dnsalias.com (8.13.1/8.13.1) with >SMTP id j685Mucc0 >> 19822 >> for <agallardo(a)agssa.net>; Fri, 8 Jul 2005 00:23:02 -0500 >> Received: (qmail 13192 invoked by uid 1746); 8 Jul 2005 >05:22:54 -0000 >> Delivered-To: antonio(a)locus.apache.org >> Received: (qmail 13149 invoked from network); 8 Jul 2005 >05:22:54 -0000 >> Received: from hermes.apache.org (HELO mail.apache.org) >(209.237.227.199) >> by minotaur.apache.org with SMTP; 8 Jul 2005 05:22:54 -0000 >> Received: (qmail 50553 invoked by uid 500); 8 Jul 2005 05:22:53 -0000 >> Delivered-To: apmail-antonio(a)apache.org >> Received: (qmail 50520 invoked by uid 500); 8 Jul 2005 05:22:53 -0000 >> Mailing-List: contact pmc-help(a)forrest.apache.org; run by ezmlm >> Precedence: bulk >> list-help: <mailto:pmc-help@forrest.apache.org> >> list-unsubscribe: <mailto:pmc-unsubscribe@forrest.apache.org> >> List-Post: <mailto:pmc@forrest.apache.org> >> Reply-To: "Forrest PMC List" <pmc(a)forrest.apache.org> >> List-Id: <pmc.forrest.apache.org> >> Delivered-To: mailing list pmc(a)forrest.apache.org >> Received: (qmail 50506 invoked by uid 99); 8 Jul 2005 05:22:52 -0000 >> Received: from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49) >> by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 07 Jul >2005 22:22:52 -0700 >> X-ASF-Spam-Status: No, hits=0.0 required.0 >> testsReceived-SPF: pass (asf.osuosl.org: local policy) >> Received: from [165.98.153.184] (HELO >ags01.agsoftware.dnsalias.com) (165.98.15 >> 3.184) >> by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 07 Jul >2005 22:22:51 -0700 >> Received: from [10.0.0.7] (apoyo.agsoftware.dnsalias.com [10.0.0.7]) >> by ags01.agsoftware.dnsalias.com (8.13.1/8.13.1) with >ESMTP id j685MdPi >> 019819 >> (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits%6 verify=NO) >> for <pmc(a)forrest.apache.org>; Fri, 8 Jul 2005 00:22:44 -0500 >> Message-ID: <42CE0D9F.9020505(a)agssa.net> >> Date: Fri, 08 Jul 2005 00:22:39 -0500 >> From: Antonio Gallardo <agallardo(a)agssa.net> >> Organization: AG Software, S. A. >> User-Agent: Mozilla Thunderbird 1.0.2-6 (X11/20050513) >> X-Accept-Language: en-us, en >> MIME-Version: 1.0 >> To: Forrest PMC List <pmc(a)forrest.apache.org> >> Subject: [SPAM] Re: Preferred list for Commiter Votes >> References: <20050529160659.57878.qmail(a)minotaur.apache.org> ><42C6FCAF.4000205@ >> Golux.Com> <200507030943.18618.niclas(a)hedhman.org> ><8b3ce379050706034241a46d74@ >> mail.gmail.com> <8ee0eeb0ed7be5045a3c8f836f6aec60(a)gbiv.com> ><42CD5C5B.1030908@G >> olux.Com> <20050708034055.GA23390(a)igg.indexgeo.com.au> >> In-Reply-To: <20050708034055.GA23390(a)igg.indexgeo.com.au> >> Content-Type: text/plain; charset=ISO-8859-1; format=flowed >> Content-Transfer-Encoding: 7bit >> X-Virus-Checked: Checked by ClamAV on apache.org >> X-Spam-Prev-Subject: Re: Preferred list for Commiter Votes >> X-Spam-Flag: YES >> X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on >> ags01.agsoftware.dnsalias.com >> X-Spam-Level: ***** >> X-Spam-Status: Yes, score=5.4 required=5.0 tests=URIBL_JP_SURBL, >> URIBL_SC_SURBL autolearn=no version=3.0.4 >> X-Spam-Report: >> * 1.5 URIBL_JP_SURBL Contains an URL listed in the JP >SURBL blocklist >> * [URIs: theaimsgroup.com] >> * 3.9 URIBL_SC_SURBL Contains an URL listed in the SC >SURBL blocklist >> * [URIs: theaimsgroup.com] >> Content-Length: 573 >> Status: O >> X-UID: 328 >> X-Keywords: >> >> >*************************************************************** >************ >> >> ------- End of Forwarded Message >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.2.5 (GNU/Linux) >Comment: Exmh CVS > >iD8DBQFCzs8sMJF5cimLx9ARAhibAJ42U4cNgE7bHixmzIJ5KmbZHlV+4gCgiiN9 >LsxJk98jU9N0TyWd0b+QUa4= >=xrGM >-----END PGP SIGNATURE----- > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

3 2

FP report: theaimsgroup.com
by jm＠jmason.org 08 Jul '05

08 Jul '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 in SC, JP? - --j. - ------- Forwarded Message > Date: Fri, 08 Jul 2005 00:37:03 -0500 > From: Antonio Gallardo <antonio(a)apache.org> > To: Justin Mason <jm(a)jmason.org> > Subject: The aimsgroup is a spam source? > > Hi Justin: > > I am sorry to bother you. I am not subscribed to any SA list. This is > why I sent this to you directly. The problem is that theaimsgroup.com is > started to be in SURBL. I wonder why. This is one of the most consulted > archives in the ASF. I think they are not spamming at all, but you are > more expert than me in this area. ;-) > > The mail contains some links to theaimsgroup.com. > > X-Spam-Level: ***** > X-Spam-Status: Yes, score=5.4 required=5.0 tests=URIBL_JP_SURBL, > URIBL_SC_SURBL autolearn=no version=3.0.4 > X-Spam-Report: > * 1.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist > * [URIs: theaimsgroup.com] > * 3.9 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist > * [URIs: theaimsgroup.com] > > I hope you can send this to the right direction. ;-) > > Best Regards, > > Antonio Gallardo. > > ****************** FULL MAIL HEADER ************************* > > Return-Path: <pmc-return-476-apmail-antonio=apache.org(a)forrest.apache.org> > Received: from minotaur.apache.org (minotaur.apache.org [209.237.227.194]) > by ags01.agsoftware.dnsalias.com (8.13.1/8.13.1) with SMTP id j685Mucc0 > 19822 > for <agallardo(a)agssa.net>; Fri, 8 Jul 2005 00:23:02 -0500 > Received: (qmail 13192 invoked by uid 1746); 8 Jul 2005 05:22:54 -0000 > Delivered-To: antonio(a)locus.apache.org > Received: (qmail 13149 invoked from network); 8 Jul 2005 05:22:54 -0000 > Received: from hermes.apache.org (HELO mail.apache.org) (209.237.227.199) > by minotaur.apache.org with SMTP; 8 Jul 2005 05:22:54 -0000 > Received: (qmail 50553 invoked by uid 500); 8 Jul 2005 05:22:53 -0000 > Delivered-To: apmail-antonio(a)apache.org > Received: (qmail 50520 invoked by uid 500); 8 Jul 2005 05:22:53 -0000 > Mailing-List: contact pmc-help(a)forrest.apache.org; run by ezmlm > Precedence: bulk > list-help: <mailto:pmc-help@forrest.apache.org> > list-unsubscribe: <mailto:pmc-unsubscribe@forrest.apache.org> > List-Post: <mailto:pmc@forrest.apache.org> > Reply-To: "Forrest PMC List" <pmc(a)forrest.apache.org> > List-Id: <pmc.forrest.apache.org> > Delivered-To: mailing list pmc(a)forrest.apache.org > Received: (qmail 50506 invoked by uid 99); 8 Jul 2005 05:22:52 -0000 > Received: from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49) > by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 07 Jul 2005 22:22:52 -0700 > X-ASF-Spam-Status: No, hits=0.0 required.0 > testsReceived-SPF: pass (asf.osuosl.org: local policy) > Received: from [165.98.153.184] (HELO ags01.agsoftware.dnsalias.com) (165.98.15 > 3.184) > by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 07 Jul 2005 22:22:51 -0700 > Received: from [10.0.0.7] (apoyo.agsoftware.dnsalias.com [10.0.0.7]) > by ags01.agsoftware.dnsalias.com (8.13.1/8.13.1) with ESMTP id j685MdPi > 019819 > (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits%6 verify=NO) > for <pmc(a)forrest.apache.org>; Fri, 8 Jul 2005 00:22:44 -0500 > Message-ID: <42CE0D9F.9020505(a)agssa.net> > Date: Fri, 08 Jul 2005 00:22:39 -0500 > From: Antonio Gallardo <agallardo(a)agssa.net> > Organization: AG Software, S. A. > User-Agent: Mozilla Thunderbird 1.0.2-6 (X11/20050513) > X-Accept-Language: en-us, en > MIME-Version: 1.0 > To: Forrest PMC List <pmc(a)forrest.apache.org> > Subject: [SPAM] Re: Preferred list for Commiter Votes > References: <20050529160659.57878.qmail(a)minotaur.apache.org> <42C6FCAF.4000205@ > Golux.Com> <200507030943.18618.niclas(a)hedhman.org> <8b3ce379050706034241a46d74@ > mail.gmail.com> <8ee0eeb0ed7be5045a3c8f836f6aec60(a)gbiv.com> <42CD5C5B.1030908@G > olux.Com> <20050708034055.GA23390(a)igg.indexgeo.com.au> > In-Reply-To: <20050708034055.GA23390(a)igg.indexgeo.com.au> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > Content-Transfer-Encoding: 7bit > X-Virus-Checked: Checked by ClamAV on apache.org > X-Spam-Prev-Subject: Re: Preferred list for Commiter Votes > X-Spam-Flag: YES > X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on > ags01.agsoftware.dnsalias.com > X-Spam-Level: ***** > X-Spam-Status: Yes, score=5.4 required=5.0 tests=URIBL_JP_SURBL, > URIBL_SC_SURBL autolearn=no version=3.0.4 > X-Spam-Report: > * 1.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist > * [URIs: theaimsgroup.com] > * 3.9 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist > * [URIs: theaimsgroup.com] > Content-Length: 573 > Status: O > X-UID: 328 > X-Keywords: > > *************************************************************************** > > ------- End of Forwarded Message -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) Comment: Exmh CVS iD8DBQFCzs8sMJF5cimLx9ARAhibAJ42U4cNgE7bHixmzIJ5KmbZHlV+4gCgiiN9 LsxJk98jU9N0TyWd0b+QUa4= =xrGM -----END PGP SIGNATURE-----

1 0

RE: [SURBL-Discuss] Re: New application querying dnsstuff?
by Chris Santerre 08 Jul '05

08 Jul '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, July 07, 2005 8:24 PM >To: Frank Ellermann >Cc: info(a)www.dnsstuff.com; discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] Re: New application querying dnsstuff? > > >On Thursday, July 7, 2005, 3:15:18 PM, Frank Ellermann wrote: >> Jeff Chan wrote in >> <http://mid.gmane.org/41160649.20050707074952@surbl.org> > >>> Does anyone know of a new application doing queries against >>> multi.surbl.org by using dnsstuff's web site, as in: > >> No. I just tested it (1), read Bill's reply, tested it again >> (2), and then I tried the "for details click here link" (3). > >> That resulted in an error page about rate limiting. So they >> do have "something" to limit queries. I can't check it, I'm >> now blocked - maybe an unnecessary "pragma nocache" caused it. > >> Bye, Frank > >Scott's deliberately rate limiting queries to try to track back >the source of them. He's hoping someone will notice their poorly >written application is breaking and will contact him. > >Jeff C. LOL I need to read my mail faster. I just traded off emails with Scott. Yup, he says it was a "Phish Blocking" plugin for firefox that was causing it. He unblocked me. I can't remember who I email these days, or what the subjects are. I blame lack of sleep ;) --Chris (Sony, I hate you and your 1.51 firmware!!!!)

1 0

Fw: [SURBL-Discuss] 20050615 embedded image spam
by Sean Sowell 08 Jul '05

08 Jul '05

>From an older thread, on Thursday, June 16, 2005 2152: > > >> >20050615-1132 inphonic.com [my original report] ... > Please take no action on this domain until I get back to the group. Please add inphonic.com to the SURBLs. Thank you. I've written to Tripp Donnelly at InPhonic several times and extended my deadline twice. My final deadline expired at 2:00 pm Eastern time today with no further response. They appear unwilling to take substantive action at my request to resolve this matter. InPhonic has forwarded me two brief emails, indicating that their "marketing partner" for the June 15th spam above is Rudy or Rootbert Smith. See Spamhaus Block List 14726 and SBL14683. Regarding 'Clearcut', see SBL20212. Also, regarding FreeDinnerPass, TheUseful and ExpertSavings, please see SBL19390 and SBL26183. My research indicates these spammers have cooperated with each other in the past. They may still be covering for each other today. Rudy Smith falsely claimed that I agreed to this and other spams because I signed up for an Olive Garden coupon last August. Unfortunately for him, I keep track of my web surfing. I have proof that I never gave my direct consent to be spammed by FreeDinnerPass, 'Clearcut' or anyone else to whom FreeDinnerPass provided my address. Again, please add inphonic.com to the SURBLs. Thanks again, Sean Sowell

1 0

RE: [SURBL-Discuss] local whitelists
by Chris Santerre 04 Jul '05

04 Jul '05

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Saturday, July 02, 2005 12:14 AM > To: SURBL Discuss > Subject: [SURBL-Discuss] local whitelists > > > Within the past week or so some developer or administrator of > anti-spam software said that they had a large installation or > userbase that recently started using SURBLs, but only after they > were able to locally whitelist some FPs. I can't find that > message currently. Does anyone recall anything like that being > said recently somewhere? (Seems I'm on too many mailing lists to > keep track of....) > > I would like to ask them to share their whitelist entries with > us so we can prevent FPs more broadly. > > Does anyone recall a conversation like that recently? If so can > you point me to where? > > TIA, > > Jeff C. Do you mean Catherine at spambouncer.org? She had a new version release. --Chris

1 0

local whitelists
by Jeff Chan 02 Jul '05

02 Jul '05

Within the past week or so some developer or administrator of anti-spam software said that they had a large installation or userbase that recently started using SURBLs, but only after they were able to locally whitelist some FPs. I can't find that message currently. Does anyone recall anything like that being said recently somewhere? (Seems I'm on too many mailing lists to keep track of....) I would like to ask them to share their whitelist entries with us so we can prevent FPs more broadly. Does anyone recall a conversation like that recently? If so can you point me to where? TIA, Jeff C. -- Don't harm innocent bystanders.

1 0

New redirector crap
by Raymond Dijkxhoorn 30 Jun '05

30 Jun '05

Hi! There is a new redirector thats been abused heavilly by spammers: <a href=http://redir.internet.com/rss/click/rsv%2e%72%65co%72c%6fmp%61%6ei%2ec… target=_blank>C1icck here to 0rder interest</a> Its pointing towards a pillspammer. Meanwhile, while we are contacting internet.com you could add this ruleset to your SA configs: uri PROLO_REDIR_INET_CHECK1 /^http:\/\/redir\.internet\.com\/rss\// score PROLO_REDIR_INET_CHECK1 8.0 describe PROLO_REDIR_INET_CHECK1 PROLO_REDIR-INET CHECK, Body Bye, Raymond.

2 1

What ever happened to "Louisville CO 80027" spam?
by Rob McEwen 25 Jun '05

25 Jun '05

What ever happened to "Louisville CO 80027" spam? Did they change their scheme? Get Prosecuted? Rob McEwen PowerView Systems

1 0

False positive in WS
by Rakesh 23 Jun '05

23 Jun '05

Hi For the first time I have recieved false positive on URI checks. I have subscribed for the "Word of the day" from dictionary.com which had a link to the the SaintLeo university website. However their domain was list in ws.surbl.org SaintLeo.com.multi.surbl.org Can body please take care of this false positive. -- Regards, Rakesh B. Pal Netcore Solutions Pvt. Ltd. ======================================================== Success is how high you reach after you hit the bottom. ======================================================== ---------------------------------------------------------- Netcore Solutions Pvt. Ltd. Website: http://www.netcore.co.in Spamtraps: http://cleanmail.netcore.co.in/directory.html ----------------------------------------------------------

4 6

RE: [SURBL-Discuss] Blog comment spam and SURBL
by Chris Santerre 21 Jun '05

21 Jun '05

>-----Original Message----- >From: Duncan Hill [mailto:dhill+surbl@cricalix.net] >Sent: Monday, June 20, 2005 11:05 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] Blog comment spam and SURBL > > >I've noticed that the poker comment spammers have found my >blog (which is >configured to run in moderation mode). Is there any point in >reporting the >reports WordPress sends me into the SURBL submission process? >The biggest >benefit I can see is for anyone who uses SA tied into WP's >comment queue - >auto spam tagging. Jeff has always liked to keep a seperation between Blog and Mail spammers. If he doesn't want them, (He might), we will take them at URIBL.com. We figure there is no difference between the two. --Chris

3 2

Blog comment spam and SURBL
by Duncan Hill 20 Jun '05

20 Jun '05

I've noticed that the poker comment spammers have found my blog (which is configured to run in moderation mode). Is there any point in reporting the reports WordPress sends me into the SURBL submission process? The biggest benefit I can see is for anyone who uses SA tied into WP's comment queue - auto spam tagging. -- My mind not only wanders, it sometimes leaves completely.

1 0

Re: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 17 Jun '05

17 Jun '05

I went back through old archives, and... I found a case of affiliate abuse involving inphonic. The email came to a non-existant account, not the one I use with inphonic and it was very similar to the one you got (i.e. links to inphonic pages, but redirects to the affiliate). This is old (Aug. 2003), but after I had been a customer, and the domains are all still valid (and look bad). Only one is currently listed in SURBLs (noted alongside of it). The involved domains were: myobdeals.com greatoffers.us homebasedbusinessclub.com [jp] imarketoffers.com I also check, all "real" inphonic emails have come from servers in their own domain with working rDNS and FCrDNS. I had never noticed this one, because it was to an obvious "bad" account (a misspelling of an account which I sometime post with, so it had both been "scraped" and typo'd - It got on a CD over a year ago, and now is one of the few accounts I outright refuse, instead of just piping down the automatic spam-reporting machinery - too much "mom&pop" operation spam to it). Anyway, it was two years ago, and I got just one - but it shows they have had past problem (but with just one vs. your > 10, my case was probably cleared up quickly). Paul Shupak track(a)plectere.com

2 1

Re: Fw: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 17 Jun '05

17 Jun '05

Having seen what you sent, I would immediately agree with listing all the "CLEARCUT" domains, including at the least, CLEARCUTSAVINGS. COM, ccs44. com, peakedig. com, peakedigital. com and all the others you had previously listed. It does look like a pretty clear case of "affiliate" abuse, and I'm still willing to give inphonic the benefit of the doubt. I would send an email (with copies of everything) to affiliates(a)inphonic.com and see what kind of response you get - if they don't drop clearcut/peakedigital et. al., I will stop buying from them and recommending them (I just sent them somebody on Friday, who bought two phones for $270 less than the local Cingular Store wanted for the same Cingular package - they were about $90 under Amazon). InPhonic is big, not Fortune 500, but *very* large. They do have "emarketing", but as I have said - I've never gotten anything from them despite the fact that they have a valid email address (unique, so I also know it has never been sold or "rented"). The 800 number on the web pages will eventually get someone who will have a "real" manager (but still in "sales") call back - Corporate Communications is (202) 333-0001, and from their own Sprint press release (also on their pages), the V.P. for Corporate Communications is "Tripp Donnelly", email tdonnelly(a)inphonic.com. I have had *such* good dealings with them that I would expect some quick response - copy him as well as the affiliate address above. Right now, I say inphonic looks clean, but is implicated by bad management of their affiliate program. The clearcut/peakedigital people are using at least two "spam friendly" hosting providers and should be listed right away (i.e. at least one is the same as the one Ralsky used for the emails that got Verizon to sue him - clearcut is using Yikes for both "unsubscribe" and a 1by1 pixel marker in the spam copy you sent). Please tell me/us whatever you get back from InPhonic. It will certainly affect my sending them customers (I'm normally a quite loyal customer when I find a company with good service - though admittedly their "free extras" are junk). Bye, Paul Shupak track(a)plectere.com

1 0

Re: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 17 Jun '05

17 Jun '05

>... > >Paul Shupak noted on Thursday, June 16, 2005 0943: > >> >... >> >20050615-1132 inphonic.com >> >... >> Most of your list is recognizable spammers, but I've actually bought >> from inphonic and can recommend them. Not only are they often the least >> expensive (re. the largest rebate on free cell phones) place to get most >> US carriers' cell phones (Amazon comes in as, surprising to me, a close >> second place usually), but their service is very good, and they have never >> sent me any email except a single follow-up after each transaction. >> >> Are you certain the user didn't call one of their telephone numbers? >> They use *many* company names and many domains - with different and *hidden* >> pricing structures. It is tricky to find the best price from them (they may >> have a half dozen different prices for the same thing, depending on the path >> you take and the cookies you accept to get to a page - very disingenuous, but >> legal - I often tell people to just use Amazon, whose pricing is easier to >> deal with - and far simpler). Once you deal with any of the "front" companies >> everything later comes from the parent - inphonic.com (and even worst - they >> seem to have "affiliates" who do re-directs and mirror pages). >> >> It also seems unlikely to be an "affiliate" spam case, since all >> the affilaites I have seen use a different domain to start, then mark your >> session with one or more cookies (it is far cheaper to go direct, don't walk >> the tree and accept no cookies - then you usually get offered the lowest of >> the available prices). Also, I think they are the single largest reseller >> for both Cingular and T-Mobile (and they were for AT&T, pre-merger). >> > >Yes Paul, unfortunately it appears that InPhonic has decided to take >spamvertising for a whirl, with or without Sprint PCS' blessing. > >My small network consists of my family here at home. We have never had any >prior business relationship with InPhonic. We've never bought anything from >InPhonic or Sprint PCS, and we have not been in the market for any cell phones >for at least two years. I hadn't heard of InPhonic until receiving this spam. > >InPhonic apparently hired a well-known spammer (Spamhaus Block List #20212 at >http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20212) to inflict their message >on the rest of us. They operate with the following domains that I know about, >and almost certainly others: > >clearcutsavings.com >ccs44.com >clearcutsav.com >clrctsvg.com >goccutsav.com >nyclearcut.com > >Since 5/19 "Clearcut", for lack of a better name, has sent me 18 spams. 17 were >false negatives; SA caught the other one. Time for me to up my SURBL scoring, >huh? ;) > >Anyway, here's the relevant spam text: > >"Phone free after instant rebate. This offer is fulfilled by InPhonic inc., an >authorized dealer for Sprint. Offer subject to credit approval or deposit, and >is available to customers activating a new line of service on a two-year >contract with Sprint. Not all US markets are served by Sprint. If you are not in >a Sprint area you will receive another great offer from another major wireless >company. Other restrictions apply, see full offer for details. Offer Expires >soon. Offer may vary." > >And, below is the text from the embedded image: > >"If you no longer wish to receive offers fulfilled from InPhonic, Inc., click >here or write to InPhonic, Inc., ATTN: Customer Relations-compliance 9301 >Peppercorn Place, Largo MD 20774. This is an email ad." > >Of course, clicking on that GIF won't take you to InPhonic, it'll send you to >Clearcut. Here's the code: > ><a href="http://g.clearcutsavings.com/ryhig.aspx?m=[munge]&w=[munge]/"><img >src="http://mirror.clearcutsavings.com/images/ap/spo02.gif" border=0></a> > >My vote for InPhonic is still black. I have no axe to grind though. Whatever >the more experienced among you think, I'm willing to live with it. > >I've sent the spample in various forms to Paul off-list for his review. If >anyone else wants the zip file, please let me know and I'll send it right over. > >TTYL, > >Sean > > I agree - this looks damning enough for me. Do note that clearcut seems to be an "affiliate" - They are in Texas, inphonic is in Maryland (and in NY). I am now entirely certain that "clearcut" is guilty - If an email or telephone call to inphonic doesn't get any response, I'd list them too (it does look like "affiliate" abuse though, since you say that clicking does not take you to inphonic). I did say that they have "strange" (at best) pricing options and a very sophisticated (and not in a good way) web site. BTW. The reason I like inphonic, is that they tend to payout 60-80% of the commision to the customer - so rarely is the phone "free", usually you get paid $150 to $250 to take it (e.g. I got paid $500 for my last two phones). If clearcut is *only* offering "free", that is unusual, even for the affiliates. Paul Shupak track(a)plectere.com P.S. They have an 800 number, mostly staffed by peons, but ask for a manager and somebody will actually call back the next day (my experiences) - I didn't want to give out a Social Security number (and didn't).

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss