- Discuss - Mailman 3

[way off-topic] Email Cartoon
by Kevin A. McGrail 01 Jun '05

01 Jun '05

Perhaps you've seen, perhaps you haven't but here is some SPAM humor to pass the time. Sorry if you aren't interested but as my office has taken to referring to me as a SPAM junkie, I totally related to this cartoon and thought some of the others would too. WARNING: This cartoon could be considered offensive and should not be viewed by anyone. http://www.pccc.com/downloads/junk/cool/email_cartoon.mpg <shun>flames</shun> Regards, KAM

1 0

RE: [SURBL-Discuss] Re: embedded image spams
by List Mail User 01 Jun '05

01 Jun '05

thouljthou1. com - multitrade group, now omnicorporation New name and address though. Paul Shupak track(a)plectere.com

1 0

Re: embedded image spams
by Sean Sowell 31 May '05

31 May '05

On Tuesday, May 31, 2005 1030, I wrote: >>> Yes, please, if you could mention the ones over the past couple >>> days we'll look into them. Some of the ones you mentioned >>> earlier are already blacklisted, so we'd like to analyze the >>> unlisted recent ones to see how we can list them sooner. >> By the way, just to sanity check things, these are the domains in >> message body URIs and not headers, right? I ask because it's >> somewhat unusual to have two sets of domains in a given spam, >> and SURBLs are meant to operate on message body URIs and not >> headers. > Yes, in the body only. Frequently, these things include an image of a text > disclaimer/opt-out notice at the bottom. Rolling over the image shows the > hyperlinked URI, but the text within the image itself shows a different > domain. OK, here is the updated list. Thanks again: Sun, 29 May 2005 12:22:12 -0700 dayepencilseof.com and myfreecomputer.net Sun, 29 May 2005 20:44:52 GMT yourexclusivesource.com and exclusivesforyou.com Sun, 29 May 2005 20:47:52 GMT airinsider.com and insideroffers.com Sun, 29 May 2005 22:49:59 GMT smartshoppings.com and shoppingsmarts.net Sun, 29 May 2005 22:49:59 GMT smartsclub.com and shoppingsmarts.net Sun, 29 May 2005 23:55:15 -0700 travelocityofhelp.com and consumersurveygroup.com Mon, 30 May 2005 02:06:55 -0700 planetandsunshine.com Mon, 30 May 2005 02:40:41 -0500 undershow.com 30 May 2005 09:49:13 -0400 farcommail.com Mon, 30 May 2005 08:09:57 -0700 travelocityofhelp.com and consumersurveygroup.com Mon, 30 May 2005 21:32:54 +0400 (MSD) eanum.biz Mon, 30 May 2005 10:09:21 -0700 clearcutsavings.com and nyclearcut.com Mon, 30 May 2005 20:47:06 GMT ccgpc.com Mon, 30 May 2005 21:17:05 GMT iasem.com and yourgiftcards.com Mon, 30 May 2005 14:11:10 -0500 undershow.com Mon, 30 May 2005 21:46:58 GMT prcmx.com Mon, 30 May 2005 23:22:10 GMT aiear.com Tue, 31 May 2005 05:56:39 +0400 (MSD) marketingtherightway.com Mon, 30 May 2005 19:41:12 -0700 padlernestedman.com and producttestpanel.com Mon, 30 May 2005 17:26:07 -0700 clrctsvg.com and tickle.com 31 May 2005 03:42:49 -0400 besaway.com and esioffers.com Tue, 31 May 2005 00:58:17 -0500 undershow.com Tue, 31 May 2005 01:40:10 -0700 datdir.com and emarketresearchgroup.com and rocketoffers.com Tue, 31 May 2005 08:44:20 +0000 (GMT) globalsucess.com and zzinc.info Tue, 31 May 2005 08:46:01 +0000 (GMT) globalsucess.com and zzinc.info Tue, 31 May 2005 06:16:26 -0700 datdir.com and fcdsoft.com and rocketoffers.com Tue, 31 May 2005 14:43:27 GMT ibringbargains.com and everyfreegift.com and bringonbargains.com Tue, 31 May 2005 14:45:26 GMT activeselfshopper.com and americanplatinum.com

1 0

RE: [SURBL-Discuss] Re: embedded image spams
by Bjurstrom, Eric 31 May '05

31 May '05

pardon me if this has already been posted, but I am getting some embedded ones through that appear to take advantage of some IE "features" <font></font><A href="ht tp:/ /qeepluq.com&ljeabfhtqemxctry4ts73e%2E tho uljth ou1%2Ecom/"> If I have firefox up, this link goes nowhere. IE will actually turn the %2E to a "." and load it up. I have both the exim perl plugin by erik mugele and spamassassin plugin and neither catch it. -----Original Message----- From: Sean Sowell [mailto:sean@twin-dad.com] Sent: Tuesday, May 31, 2005 1:31 PM To: discuss(a)lists.surbl.org Subject: [SURBL-Discuss] Re: embedded image spams On Tuesday, May 31, 2005 0300, Jeff C. wrote: >> Yes, please, if you could mention the ones over the past couple >> days we'll look into them. Some of the ones you mentioned >> earlier are already blacklisted, so we'd like to analyze the >> unlisted recent ones to see how we can list them sooner. > By the way, just to sanity check things, these are the domains in > message body URIs and not headers, right? I ask because it's > somewhat unusual to have two sets of domains in a given spam, > and SURBLs are meant to operate on message body URIs and not > headers. Yes, in the body only. Frequently, these things include an image of a text disclaimer/opt-out notice at the bottom. Rolling over the image shows the hyperlinked URI, but the text within the image itself shows a different domain. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

Re: embedded image spams
by Sean Sowell 31 May '05

31 May '05

On Tuesday, May 31, 2005 0300, Jeff C. wrote: >> Yes, please, if you could mention the ones over the past couple >> days we'll look into them. Some of the ones you mentioned >> earlier are already blacklisted, so we'd like to analyze the >> unlisted recent ones to see how we can list them sooner. > By the way, just to sanity check things, these are the domains in > message body URIs and not headers, right? I ask because it's > somewhat unusual to have two sets of domains in a given spam, > and SURBLs are meant to operate on message body URIs and not > headers. Yes, in the body only. Frequently, these things include an image of a text disclaimer/opt-out notice at the bottom. Rolling over the image shows the hyperlinked URI, but the text within the image itself shows a different domain.

1 0

RE: Blogger attacks SURBL
by Chris Santerre 31 May '05

31 May '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, May 30, 2005 8:57 PM >To: SURBL Discuss; SpamAssassin Users >Subject: Blogger attacks SURBL > > >Pardon the dramatic title, but hopefully it got your attention. > >This guy's domain got listed by Outblaze, we removed it, and as >thanks this guy paints us as irresponsible. Please help us >straighten him out, gently: > >http://blog.holtz.com/index.php/weblog/comments/blacklisting_blogs/ > >I gave it my shot. > >Jeff C. Thanks for the link. I shot him a 'nice' reply. Some people just don't understand. --Chris (Yeah I thought abuot listing his site just for fun ;)

1 0

Blogger attacks SURBL
by Jeff Chan 31 May '05

31 May '05

Pardon the dramatic title, but hopefully it got your attention. This guy's domain got listed by Outblaze, we removed it, and as thanks this guy paints us as irresponsible. Please help us straighten him out, gently: http://blog.holtz.com/index.php/weblog/comments/blacklisting_blogs/ I gave it my shot. Jeff C. -- Don't harm innocent bystanders.

4 4

Re: embedded image spams
by Sean Sowell 31 May '05

31 May '05

Rakesh Pal wrote: > I have been bugged a lot by embedded image spams recently, although some > of these spams got trapped due URI checks, some managed to pass as well > as the url wasn't yet blocked in the SURBLs. and Jeff Chan wrote: > Please provide the URI and the timestamp it was first seen. > We can use that information to see if we can get them into SURBLs > sooner. Hello --- I've been diligently sending full message sources of similar spam to submit.[code](a)spam.spamcop.net these past several days. My account there is set up as a mole to minimze the chance of being joe-jobbed. My understanding is that spamcop adds a point for that URI in spamcop's database, until it exceeds the threshold needed for inclusion in sc.surbl. Then, by way of the URIBL_SC_SURBL rule in SA 3.0.3, more of these things will be caught as spam, since SA assigns >= 3.8 points to each such spam. Am new to these tools, so I hope I've understood the docs and faq pages correctly ... Jeff, I can send you a zip file with a bunch of these recent message sources (my email client is OE6). Or, do you just need a bunch of Date: / Message-ID: / Content-ID: triplets? Sean S. www.twin-dad.com

2 8

belgischelotto.be
by Jeff Chan 31 May '05

31 May '05

belgischelotto.be appeared in a 419 scam. Anyone (especially in Europe) know if this is a legitimate domain? Jeff C. -- Don't harm innocent bystanders.

2 1

Re: Blogger attacks SURBL
by List Mail User 31 May '05

31 May '05

>... > >Jeff Chan wrote: > >> Pardon the dramatic title, but hopefully it got your attention. >> >> This guy's domain got listed by Outblaze, we removed it, and as >> thanks this guy paints us as irresponsible. Please help us >> straighten him out, gently: >> >> http://blog.holtz.com/index.php/weblog/comments/blacklisting_blogs/ >> >> I gave it my shot. >> >> Jeff C. >> -- >> Don't harm innocent bystanders. > >The way I read his response is that he stands against >SPAM and in favor of anti SPAM measures ... > >*provided* he is not inconvenienced. > > I guess its a good thing he didn't try my servers - Seems we have another user of midphase. com (i.e. his FORIMMEDIATERELEASE. BIZ domain), and since midphase seems to condone spamming - he would never had made it through my servers anyway. Also, while he is unlikely a "criminal" spammer, his "newletters", if uninvited, contain lots of questionable commercial hype. SURBL or not, my machines won't accept his email newletter. Seems consistant - if you use midphase, you just don't "get it". If he doesn't understand that he doesn't even "own" the domain, he probably can't understand any explaination either. Paul Shupak track(a)plectere.com P.S. For anyone who cares, www.openrbl.org is back up as of a few hours ago.

1 0

Help please - SA 3.0.2 and surbl
by roger-surbl-discuss＠rope.net 27 May '05

27 May '05

I am trying to use SURBL with spamassassin 3.0.2 but, even though there seems to be an otherwise unusual length of time to process a message, it is definitely not picking up the http://surbl-org-permanent-test-point.com/ or http://127.0.0.2/ test URLs that I put into a test message. I use a local caching nameserver (djbdns). I invoke spamd with "-d -m5 -s local4 -u smtpd -x" and I have restarted the daemon. My /etc/mail/spamassassin/init.pre contains this line: loadplugin Mail::SpamAssassin::Plugin::URIDNSBL My /etc/mail/spamassassin/local.cf contains the following, with explanations afterwards: ========================================================================= required_score 12 # new #fold_headers 0 allow_user_rules 0 report_safe 0 use_auto_whitelist 0 auto_whitelist_factor 0 use_dcc 0 use_pyzor 0 use_razor2 0 use_bayes 0 use_bayes_rules 0 bayes_auto_learn 0 skip_rbl_checks 0 # normally 1 check_mx_attempts 0 dns_available yes # normally no # URIDNSBL - We don't want the standard URIDNSBLs to be used ifplugin Mail::SpamAssassin::Plugin::URIDNSBL score URIBL_AB_SURBL 13 score URIBL_OB_SURBL 13 score URIBL_PH_SURBL 13 score URIBL_SBL 13 score URIBL_SC_SURBL 13 score URIBL_WS_SURBL 13 #uridnsbl URIBL_MULTI multi-surbl.org. TXT #body URIBL_MULTI eval:check_uridnsbl('URIBL_MULTI') #describe URIBL_MULTI Contains URL In MULTI Blocklist #tflags URIBL_MULTI net #score URIBL_MULTI 13 endif # Mail::SpamAssassin::Plugin::URIDNSBL ========================================================================= Explanation: I am not using any of the features in the first part of the list as you can tell by the "0". In addition, I normally do not use any of the network features, so I have explicitly turned off all of the DNSBL checks by setting the scores to "0" for each of them. All I want to do is run SURBL and do some specific filtering. I have tried the URIDNSBL stuff two different ways. First, I had set the included tests to score "0" and used my own definition, then I changed it to what you see now, to use the stock definitions. Questions: Do I have something defined incorrectly? Have I missed a definition? Anything else? Thanks for any help.

6 17

embedded image spams
by Rakesh 27 May '05

27 May '05

Hi I have been bugged a lot by embedded image spams recently, although some of these spams got trapped due URI checks, some managed to pass as well as the url wasn't yet blocked in the SURBLs. I probably found something tht i wanted to share with u guys and try and see if we can trap those spams further on the basis of tht. I have classified those embedded image spams into two classes. Class 1 of image of fulllist of viagra and other meds and Class 2 of image of one liner information on cheap softwares or viagra. I was thinking of if possibly we can understand a common pattern and try and make a ruleset on top of tht so tht we dont have to wait for updates at URIbl, then it would be really some thing good. These image only spams apparently have a prob tht we can trap on :). The loophole is in most of the cases the message id of the mail and the content id or cid of the embedded image is exactly same. For e.g. Message-ID: <1066724820.2422(a)boschkitchencentre.com> Content-ID: <1066724820.2422(a)boschkitchencentre.com> some variations also had something like this Message-ID: <1064962549.5961(a)cal.cybersurf.net> Content-ID: <sivjxu_onzvh_dzdohvo> But thts applicable to class1 of the spams and in class 2 which are just images containing oneliners has some variations. In some cases the content id is smartly tampered but again there is a loophole and here is an example of tht Message-ID: <525F074E3524$72BF31B3$02605c3b(a)comcast.net> Content-ID: <e102605c3b(a)comcast.net> the message id and the content id both contain the domain name of the sending server. And a valid mail that had embedded image in it but was sent from outlook had details something like this From Outlook Message-ID: <002101c55c2f$b3f540a0$bdc809c0@cg> Content-ID: <image001.jpg(a)01C55C5D.CB204210> Frankly I haven't seen how content id appears when images are embedded using other valid email clients like netscape or thunderbird. But if we compare the above set of patterns, what appears is tht if a image is embedded using a client like outlook then "@" appears in the content id of the attachment but the latter part of @ is not the domain name, but has the name of the attachment itself and the messageid is different from the content id, whereas incase of the spammers content ids that appear are either exactly same to tht of the message id, or doesnt have a @ or has the domain name of the server as a latter part of the @ in content id. So my question is can we have rulesets in spamassassin that can compare the sending host domain with the latter part of @ of content id or look for @ in the content id. Any suggestions ? comments ? -- Regards, Rakesh B. Pal Project Leader Emergic CleanMail Team. Netcore Solutions Pvt. Ltd. ======================================================== Success is how high you reach after you hit the bottom. ======================================================== ---------------------------------------------------------- Netcore Solutions Pvt. Ltd. Website: http://www.netcore.co.in Spamtraps: http://cleanmail.netcore.co.in/directory.html ----------------------------------------------------------

2 1

Re: [SURBL-Discuss] Job Recruiter SPAMmers
by List Mail User 25 May '05

25 May '05

>... >Give this a try: > >> http://openrbl.org/ > > >It worked for me this morning. > >Dan Zachary > > >>(BTW my favorite rbl checker openrbl.org seems gone. :-( ) >>... Worked last night, but not now. The domain is in good standing, as is the "feeder" domain orbl.net. But the DNS records show a change as of yesterday (serial number date encoding method vs. the seconds since epoch that SURBL uses), and the 'A' record is gone. Most of the listed name servers seem down also. They alway had a problem with timeouts, but I used them a lot too. Current DNS appended (note the use of an unlisted name server to get anything). Paul Shupak track(a)plectere.com -------------------------------------------------------------------------------- % dig openrbl.org any @y.orbl.net ; <<>> DiG 9.3.0 <<>> openrbl.org any @y.orbl.net ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60077 ;; flags: qr aa rd; QUERY: 1, ANSWER: 12, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;openrbl.org. IN ANY ;; ANSWER SECTION: openrbl.org. 43200 IN NS a.orbl.net. openrbl.org. 43200 IN NS b.orbl.net. openrbl.org. 43200 IN NS c.orbl.net. openrbl.org. 43200 IN NS d.orbl.net. openrbl.org. 43200 IN NS e.orbl.net. openrbl.org. 43200 IN NS f.orbl.net. openrbl.org. 43200 IN NS g.orbl.net. openrbl.org. 43200 IN NS h.orbl.net. openrbl.org. 43200 IN NS i.orbl.net. openrbl.org. 43200 IN NS j.orbl.net. openrbl.org. 2700 IN MX 999 relay.serv.ch. openrbl.org. 3600 IN SOA g.orbl.net. openrbl.org. 2005052422 2400 600 2419200 300 ;; Query time: 190 msec ;; SERVER: 80.190.246.92#53(y.orbl.net) ;; WHEN: Wed May 25 13:41:00 2005 ;; MSG SIZE rcvd: 262

2 1

Job Recruiter SPAMmers
by Kevin A. McGrail 25 May '05

25 May '05

As a job recruiter, I am intimately familiar with posting a job and then getting hammered with SPAM from companies and recruiting firms. In the past 5 minutes, I've gotten two. One from BobAJobs-munged.com and one from http://ad1.geowebsv48a-munged.com/recruiting_service.html. How would these type of spam's be viewed for addition to SURBL? Regards, KAM

4 5

RE: [SURBL-Discuss] Job Recruiter SPAMmers
by Chris Santerre 24 May '05

24 May '05

> -----Original Message----- > From: Kevin A. McGrail [mailto:kmcgrail@pccc.com] > Sent: Tuesday, May 24, 2005 2:55 PM > To: discuss(a)lists.surbl.org > Cc: daniel.swartz(a)thoughtworthy.com > Subject: [SURBL-Discuss] Job Recruiter SPAMmers > > > As a job recruiter, I am intimately familiar with posting a > job and then > getting hammered with SPAM from companies and recruiting firms. > > In the past 5 minutes, I've gotten two. One from > BobAJobs-munged.com and > one from http://ad1.geowebsv48a-munged.com/recruiting_service.html. > > How would these type of spam's be viewed for addition to SURBL? > > Regards, > KAM I add them to black.uribl.com I can't stand these guys. The whole ihirexxxxxxxxx.com have already been added. --Chris

1 0

Subject: Re[2]: [SURBL-Discuss] whitelist: accuradio.com
by Robert Menschel 24 May '05

24 May '05

> Message: 4 > Date: Mon, 23 May 2005 05:17:31 +0200 (CEST) > From: Raymond Dijkxhoorn <raymond(a)surbl.org> > Subject: Re[2]: [SURBL-Discuss] whitelist: accuradio.com > To: SURBL Discussion list <discuss(a)lists.surbl.org> > Hi bob, >>>> Reviewing this week's emails looking for candidates for my SA >>>> whitelist.cf, I saw that an email from accuradio.com, with a URI to >>>> www.accuradio.com, had hit URIBL_OB_SURBL. ... >> >>>> Submitting the whitelist now. >> > Care to share? Perhaps more listed that that we should look into ? > Bye, > Raymond. Sure: # Domains I personally guarantee do not send spam: menschel.net robert.menschel.name choctaw-crafts.org xeper.org xeper.net templeofset.org setian.org balanone.info contractorswarehouse.com cwbo.com cwikship.com # Trusted domains jeld-wen.com pythagoras.org trapezoid.org # domain that looks like it might be spammy, but a user has intentionally flagged email as NOT being spam. freelanceworkexchange.com # Added May 22 2005 AccuRadio.com Bob Menschel

2 1

whitelist: accuradio.com
by sare＠menschel.net 24 May '05

24 May '05

Just a quick note: Reviewing this week's emails looking for candidates for my SA whitelist.cf, I saw that an email from accuradio.com, with a URI to www.accuradio.com, had hit URIBL_OB_SURBL. I just did a SURBL check, and it's not there now, so I'm guessing it was a temporary fluke. However, since in three years I've received emails from accuradio only to the specific email address I supplied them, not to any other, and have not receiving any emails from anyone else to that address, I believe this domain worth whitelisting to avoid future similar events. Submitting the whitelist now. Bob Menschel

4 7

Re: name-services.com (was: Re: [SURBL-Discuss] whitelist: accuradio.com)
by List Mail User 24 May '05

24 May '05

>... > >What about the WDRP spam apparently from them? Is that possibly >legitimate looking? > >From: "WDRP Compliance" <wdrp(a)name-services.com> >To: Domains(a)Menschel.net > >thetrueslf.com May 25, 2004 > View Contact Data: <http://wdrp.name-services.com/whois.asp?key=FC4464C8F2A> > >etc. > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > I thought I had made clear my beliefs about the "competence" of eNom's procedures and personnel:-) Anyway, this is clearly not spam, but a misdirected - yet valid communication for domain registration data checking. Clearly sent to the wrong person, but it isn't selling anything - it doesn't even link to any other page except ICANN's rules about data verification. It is downright well behaved - no links to their own services, no pleas to extend the registration period - one of the best I've seen of all that I've gotten from any registrar I've used. Just in typical fashion, they sent it to the wrong place:-) Do note that it is also typical eNom in that it functions by a "negative" option - do nothing and they say they will assume all the data is good; I suspect that this is *not* acceptable to ICANN (since if the contact data were false, the notice would likely be ignored and hence no checking actually performed) - but it fits perfectly the eNom model of let the customer be responsible for reporting and fixing all errors. Most people I've played golf with "cheat" - some knowingly, some accidentally - I long ago got used to people telling me that I should be adding penalties to my own score for "mistakes". This is sort of like the French justice system in reverse (instead of the police having to prove a defendant is innocent - let the defendant be responsible to show that he is guilty). Anyway, just go to the link - No "spam" - innocent, but incompetent. Paul Shupak track(a)plectere.com P.S. Now somebody should check if the data is actually valid for that domain; It appears that at least there i a technical violation in that the listed fax line goes unanswered during business hours! I'd even guess that Donovan Rittenbach doesn't even live there or have that telephone number anymore. He has at least two other domains at the same address and telephone number. The telephone number is unlisted (not normal for a business).

2 1

Re: Discuss Digest, Vol 14, Issue 23
by Robert Menschel 24 May '05

24 May '05

> Message: 2 > Date: Mon, 23 May 2005 09:01:36 -0700 (PDT) > From: List Mail User <track(a)Plectere.com> > Subject: name-services.com (was: Re: [SURBL-Discuss] whitelist: accuradio.com) > To: discuss(a)lists.surbl.org > Cc: jeffc(a)surbl.com, track(a)Plectere.com > Message-ID: <200505231601.j4NG1aYt025267(a)Plectere.com> > I've been watching this discussion without speaking up for > a couple of days now. the domain name-services is very popular with > spammers (they seem to be lax in throwing them off), but it has *at > least* 20x as many legitimate customers as "bad guys"; That said, I > do always double-check when I see it turn up in a domain I'm already > looking at - It is a good sign if you already have another reason for > checking a domain, but they themselves are mostly extremely clean. The > big problem is the domain is operated by eNom for others, and we all > probably are aware of the standard eNom procedure for complaints (i.e. > forward it to the spammer and ask him to "fix" it) - this makes them > look disproportionately bad. > The domain name-services.com itself doesn't belong on any SURBLs > (though it does exist within lots of Spamhaus and SPEWS records) or even > on URIBL's greylist (though maybe SPEWS should L2 them and eNom itself). > They have far, far too many legitimate customers. > Just my opinion/experience. But convincing to me. I've uploaded an update to my blacklist file, with this domain removed. Jeff -- by the same reasoning, it should be whitelisted? Bob Menschel

1 0

name-services.com (was: Re: [SURBL-Discuss] whitelist: accuradio.com)
by List Mail User 23 May '05

23 May '05

>... > >Hello Jeff, > >(sent one copy without attachment, and from not-listed address; that >copy can be deleted without forwarding to list. sorry) > >Monday, May 23, 2005, 3:00:09 AM, you wrote: > >JC> Message: 7 >JC> Date: Mon, 23 May 2005 00:57:48 -0700 >JC> From: Jeff Chan <jeffc(a)surbl.org> >JC> Subject: Re: [SURBL-Discuss] whitelist: accuradio.com >JC> To: Joseph Burford <josephb(a)gmail.com> >JC> Cc: SURBL Discussion list <discuss(a)lists.surbl.org> >JC> Message-ID: <127069243.20050523005748(a)surbl.org> >JC> Content-Type: text/plain; charset=us-ascii > >JC> On Sunday, May 22, 2005, 11:39:05 PM, Joseph Burford wrote: >>>> Since you say they're whitehats, I'll go ahead and whitelist them in >>>> SURBLs. Of minor interest one of their nameservers is on SORBS: >>>> >>>> 212.118.243.118 dns5.name-services.com >>>> >>>> http://www.sorbs.net/lookup.shtml?212.118.243.118 > >>> name-services.com is used by Register.com / Namebargain.com for their >>> customer DNS services. > >>> Regards, Hi, I've been watching this discussion without speaking up for a couple of days now. the domain name-services is very popular with spammers (they seem to be lax in throwing them off), but it has *at least* 20x as many legitimate customers as "bad guys"; That said, I do always double-check when I see it turn up in a domain I'm already looking at - It is a good sign if you already have another reason for checking a domain, but they themselves are mostly extremely clean. The big problem is the domain is operated by eNom for others, and we all probably are aware of the standard eNom procedure for complaints (i.e. forward it to the spammer and ask him to "fix" it) - this makes them look disproportionately bad. The domain name-services.com itself doesn't belong on any SURBLs (though it does exist within lots of Spamhaus and SPEWS records) or even on URIBL's greylist (though maybe SPEWS should L2 them and eNom itself). They have far, far too many legitimate customers. Just my opinion/experience. Paul Shupak track(a)plectere.com

2 1

Re: [SURBL-Discuss] whitelist: accuradio.com
by Robert Menschel 23 May '05

23 May '05

Hello Jeff, (sent one copy without attachment, and from not-listed address; that copy can be deleted without forwarding to list. sorry) Monday, May 23, 2005, 3:00:09 AM, you wrote: JC> Message: 7 JC> Date: Mon, 23 May 2005 00:57:48 -0700 JC> From: Jeff Chan <jeffc(a)surbl.org> JC> Subject: Re: [SURBL-Discuss] whitelist: accuradio.com JC> To: Joseph Burford <josephb(a)gmail.com> JC> Cc: SURBL Discussion list <discuss(a)lists.surbl.org> JC> Message-ID: <127069243.20050523005748(a)surbl.org> JC> Content-Type: text/plain; charset=us-ascii JC> On Sunday, May 22, 2005, 11:39:05 PM, Joseph Burford wrote: >>> Since you say they're whitehats, I'll go ahead and whitelist them in >>> SURBLs. Of minor interest one of their nameservers is on SORBS: >>> >>> 212.118.243.118 dns5.name-services.com >>> >>> http://www.sorbs.net/lookup.shtml?212.118.243.118 >> name-services.com is used by Register.com / Namebargain.com for their >> customer DNS services. >> Regards, >> Joseph JC> Hmm, then it probably should not be blacklisted: JC> black-rmenschel-200504:name-services.com JC> Bob Menschel, JC> Can you comment further on this listing of yours on sa-blacklist/ JC> ws.surbl.org? Spam is attached. I agree that as DNS, name-services.com shouldn't be blocked, nor as received, since other viable emails come through them. The only emails I've ever received /from/ name-services.com, and the only emails I've ever received with URI links to name-services.com, are like the attached. As far as I know, this is a scam. I've never done any business with name-services.com, and never looked at obtaining any of their services. I don't remember the exact steps I used April 27 to review this, but searching for their domain I found plenty of evidence of spam/scam, and no evidence that these people also sent out ham. If they themselves are a registry, and do send ham to domain registrants that they haven't already scammed, then yes, I should remove them from my blacklist file. If they are primarily DNS services and do not send emails other than spam/scam, then they should remain. Bob Menschel

1 0

Re: [SURBL-Discuss] LInk to add to SURBL
by List Mail User 21 May '05

21 May '05

>On Wed, 18 May 2005, Jeff Chan wrote: > >> On Wednesday, May 18, 2005, 6:44:05 AM, Spam Admin wrote: >> > spam link. >> >> > http://www.kexmt.move.fresh-deals.net/go/g/31/2869/1/?3495564 >> >> > Dan Zachary >> >> Hi Dan, >> This is a recently registered domain (a couple weeks ago) >> but it doesn't seem to resolve into spaces that are known >> to be spammy. That may just mean spammers have moved into >> a new network space, etc. >> >> However there are a number of odd things about this domain >> from the registration, to the host's registration, etc. >> And it doesn't seem to resolve currently. >> >> Is anyone else seeing this in spams? >> >> Jeff C. > >Jeff, >I've been getting spam containing that URL and other 'sisters' >(such as "dealstoday.net"). > >They have major spam-sign hallmarks: > >The payload is a few lines of HTML that reference images with the >ad "message" and then massive amounts of "Bayes poison" hidden by >HTML comments or CSS tricks (style="visibility:hidden"), bogus HTML >(large amounts of text after the closing </HTML> tag), >as well as being sent to stale local addresses. > >Examples available upon request. ;) > >-- >Dave Funk University of Iowa ><dbfunk (at) engineering.uiowa.edu> College of Engineering >319/335-5751 FAX: 319/384-0549 1256 Seamans Center >Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 >#include <std_disclaimer.h> >Better is not better, 'standard' is better. B{ >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Jeff, Now you have your answer about how "spammy" GMB is. (This is them also - check the name servers, and rDNS - also, look around the net-block for other nearby GMB sites). Also, another partial hidden "private" registration (i.e. dealstoday.net). Paul Shupak track(a)plectere.com

3 2

Question about scoring in SA3
by Kevin A. McGrail 21 May '05

21 May '05

I've been very pleased with SURBL in SA3 and I'd like to increase the scores. However, I don't understand how the default scores like this work: rules/50_scores.cf:score URIBL_AB_SURBL 0 2.007 0 0.417 rules/50_scores.cf:score URIBL_OB_SURBL 0 1.996 0 3.213 rules/50_scores.cf:score URIBL_PH_SURBL 0 0.839 0 2.000 rules/50_scores.cf:score URIBL_SC_SURBL 0 3.897 0 4.263 rules/50_scores.cf:score URIBL_WS_SURBL 0 0.539 0 1.462 I feel SA is being too conservative with the resource that SURBL provides. Can anyone give me their recommendations for my local configuration file for replacement scores that will be more effective? And since I couldn't find it referenced, can anyone tell me what the four numbers after the score mean? Regards, KAM

5 11

Reporting phishing-spams?
by Martin 20 May '05

20 May '05

Where is the best place to report phishing-spam? Thanks / Martin

2 2

some urls tht missed this morning
by Rakesh 20 May '05

20 May '05

Hi these three urls weren't listed in multi.surbl.org at 5:00 AM GMT. wonderfulcompressorwell.com bobtangofunny.com wonderfulcomplimentwell.com -- Regards, Rakesh B. Pal Project Leader Emergic CleanMail Team. Netcore Solutions Pvt. Ltd. ======================================================== Success is how high you reach after you hit the bottom. ========================================================

6 10

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss