- Discuss - Mailman 3

RE: [SURBL-Discuss] RE: Dell's open redirect try 2
by Matthew Wilson 14 Apr '05

14 Apr '05

Just a bit of google "hacking". redirect.cgi, redir.cgi, redirect.asp are all great terms with which you can use Google's "inurl:" operator. > Keep them coming Fred and Matt. How did you guys find these? cache: If you include other words in the query, Google will highlight those words within the cached document. For instance, [cache:www.google.com web] will show the cached content with the word "web" highlighted. This functionality is also accessible by clicking on the "Cached" link on Google's main results page. The query [cache:] will show the version of the web page that Google has in its cache. For instance, [cache:www.google.com] will show Google's cache of the Google homepage. Note there can be no space between the "cache:" and the web page url. link: The query [link:] will list webpages that have links to the specified webpage. For instance, [link:www.google.com] will list webpages that have links pointing to the Google homepage. Note there can be no space between the "link:" and the web page url. This functionality is also accessible from the Advanced Search page, under Page Specific Search > Links. related: The query [related:] will list web pages that are "similar" to a specified web page. For instance, [related:www.google.com] will list web pages that are similar to the Google homepage. Note there can be no space between the "related:" and the web page url. This functionality is also accessible by clicking on the "Similar Pages" link on Google's main results page, and from the Advanced Search page, under Page Specific Search > Similar. info: The query [info:] will present some information that Google has about that web page. For instance, [info:www.google.com] will show information about the Google homepage. Note there can be no space between the "info:" and the web page url. This functionality is also accessible by typing the web page url directly into a Google search box. Other information needs define: The query [define:] will provide a definition of the words you enter after it, gathered from various online sources. The definition will be for the entire phrase entered (i.e., it will include all the words in the exact order you typed them). stocks: If you begin a query with the [stocks:] operator, Google will treat the rest of the query terms as stock ticker symbols, and will link to a page showing stock information for those symbols. For instance, [stocks: intc yhoo] will show information about Intel and Yahoo. (Note you must type the ticker symbols, not the company name.) This functionality is also available if you search just on the stock symbols (e.g. [ intc yhoo ]) and then click on the "Show stock quotes" link on the results page. Query modifiers site: If you include [site:] in your query, Google will restrict the results to those websites in the given domain. For instance, [help site:www.google.com] will find pages about help within www.google.com. [help site:com] will find pages about help within .com urls. Note there can be no space between the "site:" and the domain. This functionality is also available through Advanced Search page, under Advanced Web Search > Domains. allintitle: If you start a query with [allintitle:], Google will restrict the results to those with all of the query words in the title. For instance, [allintitle: google search] will return only documents that have both "google" and "search" in the title. This functionality is also available through Advanced Search page, under Advanced Web Search > Occurrences. v intitle: If you include [intitle:] in your query, Google will restrict the results to documents containing that word in the title. For instance, [intitle:google search] will return documents that mention the word "google" in their title, and mention the word "search" anywhere in the document (title or no). Note there can be no space between the "intitle:" and the following word. Putting [intitle:] in front of every word in your query is equivalent to putting [allintitle:] at the front of your query: [intitle:google intitle:search] is the same as [allintitle: google search]. allinurl: If you start a query with [allinurl:], Google will restrict the results to those with all of the query words in the url. For instance, [allinurl: google search] will return only documents that have both "google" and "search" in the url. Note that [allinurl:] works on words, not url components. In particular, it ignores punctuation. Thus, [allinurl: foo/bar] will restrict the results to page with the words "foo" and "bar" in the url, but won't require that they be separated by a slash within that url, that they be adjacent, or that they be in that particular word order. There is currently no way to enforce these constraints. This functionality is also available through Advanced Search page, under Advanced Web Search > Occurrences. inurl: If you include [inurl:] in your query, Google will restrict the results to documents containing that word in the url. For instance, [inurl:google search] will return documents that mention the word "google" in their url, and mention the word "search" anywhere in the document (url or no). Note there can be no space between the "inurl:" and the following word. Putting "inurl:" in front of every word in your query is equivalent to putting "allinurl:" at the front of your query: [inurl:google inurl:search] is the same as [allinurl: google search].

1 0

Open redirect at Harvard
by Matthew Wilson 14 Apr '05

14 Apr '05

http://minerva.dce.harvard.edu/cgi-bin/redirect.cgi?url=http://www.surbl .org

1 0

Open redirect on webmasterworld
by Matthew Wilson 14 Apr '05

14 Apr '05

http://www.webmasterworld.com/ra.cgi?url=http://www.SURBL.org

1 0

FULL open redirect on google
by Matthew Wilson 14 Apr '05

14 Apr '05

http://www.google.com/url?sa=U&start=1&q=http://www.SURBL.org&e

1 0

Dell's open redirect try 2
by Fred 14 Apr '05

14 Apr '05

Too fast on my buttons, here's the link: http://landingstrip.dell.com/landingstrip/ls.asp?DURL=http://www.google.com/ Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400

1 0

Dell has an open redirector
by Fred 14 Apr '05

14 Apr '05

Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400

1 0

avsMUNGED-gold.com
by Lindsay Snider 14 Apr '05

14 Apr '05

I received a spam from avsMUNGED-gold.com. They are a porn site and all signs lead to blocking them except how long their domain has been around and the lack of information showing up in the tools I didn't block them. Comments? Lindsay

2 4

RE: [SURBL-Discuss] Capital One redirector
by List Mail User 14 Apr '05

14 Apr '05

>... >>-----Original Message----- >>From: List Mail User [mailto:track@plectere.com] >>Sent: Wednesday, April 13, 2005 11:03 PM >>To: maverick(a)capitalone.com; track(a)plectere.com >>Cc: legal(a)capitalone.com; discuss(a)lists.surbl.org >>Subject: RE: [SURBL-Discuss] Capital One redirector >> >> >> Worthless form letter - obviously no human ever read it. Also, >>I was initially wrong, postmaster(a)capitolone.com *does* >>bounce. The chances >>of my ever accepting a CapitolOne credit card offer have just >>gone to zero. >> >> Paul Shupak >> track(a)plectere.com > >Yeah I got the same junk from "Maverick". > >--Chris (Talk to me Goose!) >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Did you also notice that their mail server uses a HELO argument which doesn't resolve? Bad mail and web administration - How good a bank are they likely to be? All of us in the US know that their advertising budget is *very* large; Maybe they should divert some of that money to infrastructure maintainence. Paul Shupak track(a)plectere.com

1 0

RE: [SURBL-Discuss] Capital One redirector
by Chris Santerre 14 Apr '05

14 Apr '05

>-----Original Message----- >From: List Mail User [mailto:track@plectere.com] >Sent: Wednesday, April 13, 2005 11:03 PM >To: maverick(a)capitalone.com; track(a)plectere.com >Cc: legal(a)capitalone.com; discuss(a)lists.surbl.org >Subject: RE: [SURBL-Discuss] Capital One redirector > > > Worthless form letter - obviously no human ever read it. Also, >I was initially wrong, postmaster(a)capitolone.com *does* >bounce. The chances >of my ever accepting a CapitolOne credit card offer have just >gone to zero. > > Paul Shupak > track(a)plectere.com Yeah I got the same junk from "Maverick". --Chris (Talk to me Goose!)

1 0

Ten year registration limit (was Re: [SURBL-Discuss] Re: New redirector: www.nate.com)
by List Mail User 14 Apr '05

14 Apr '05

>... > >List Mail User wrote: > >> gabia.com-munged >> http://www.rfc-ignorant.org/tools/lookup.php?domain=gabia.com > >ACK, that's also the first time that I heard about any "ICANN >10 years limit" for the expiration of com-domains. And here >it's apparently the reason for a whois-RFCI-entry, which RfC >could that be ? Not RfC 1591 or RfC 1032 (looking for "exp"). > >> Its good to know people do read > >I'm a RFCI+SURBL+SPF-fan ;-) Bye, Frank > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Frank, Sorry it took me so long to get back - I've been busy; But I just found another violation of the same rule:) and it took a little more sigging than I expected (almost 20 minutes). The ten year rule can be found in the document at: http://www.internic.net/faqs/domain-names.html Under the heading "How long does a registration last? Can it be renewed?", about 1/3 of the way through the document. It applies to all domain registrations. Paul Shupak track(a)plectere.com P.S. The new violator is the NIC for ".nu" - i.e. nic.nu.

1 0

Abused Open ZDNet Redirector
by Spam Control 14 Apr '05

14 Apr '05

Hello Yahoo!, Several of our users receive your Yahoo! Alerts. This is a valuable service for our users. Included in your Yahoo! Alerts are links which frequently use a redirector at zdnet.com, such as: http://chkpt.zdnet.com/chkpt/siliconfeed/http://networks.silicon.com/teleco… Unfortunately, this is an "open" redirector, readily available for abuse, and readily, frequently, and repeatedly abused by spammers. zdnet.com has so far chosen to NOT close this redirector. Instead of limiting its use to valid commercial activity, registered in advance, they allow this redirector to be used for any purpose, valid or spam. Because of this, because of the amount of spam we have been receiving that uses this redirector, we have had to implement tests which identify http://chkpt.zdnet.com/chkpt as spam-sign. This may have the unfortunately side-effect of causing some of your Yahoo! Alerts to be mis-identified as spam. The anti-spam community has been unable to get zdnet.com to change their policy concerning this redirector. If you are able to get them to see the error of their ways, we will gladly remove these tests from our anti-spam system. Until then, all we can do is hope that it does not affect your Yahoo Alerts! too badly. Sincerely, SpamControl, Menschel.net

1 0

RE: [SURBL-Discuss] Capital One redirector
by List Mail User 14 Apr '05

14 Apr '05

Worthless form letter - obviously no human ever read it. Also, I was initially wrong, postmaster(a)capitolone.com *does* bounce. The chances of my ever accepting a CapitolOne credit card offer have just gone to zero. Paul Shupak track(a)plectere.com -------------------------------------------------------------------------------- >From maverick(a)capitalone.com Wed Apr 13 19:35:10 2005 >X-Server-Uuid: 80E87EA0-9936-41C1-8001-884D959F42CB >Date: Wed, 13 Apr 2005 14:23:27 -0400 >To: "List Mail User" <track(a)Plectere.com> >Subject: RE: [SURBL-Discuss] Capital One redirector >From: Maverick <maverick(a)capitalone.com> >MIME-Version: 1.0 >X-Mailer: Kana 6.0 >X-WSS-ID: 6E43BC13148132-24-01 >Content-Type: text/plain; > charset=us-ascii >Content-Transfer-Encoding: 8bit >X-MIME-Autoconverted: from quoted-printable to 8bit by Plectere.com id j3E2ZABh013550 > >Thank you for notifying us of this suspicious email. Please note that the >email was not originated by Capital One and you should not respond to it. >While this email has not compromised Capital One's systems in any way, we >take these incidents seriously and work with law enforcement agencies to >investigate them. > >In the future, you should respond to emails only sent from valid/secured >websites. Make sure you are responding to an email from Capital One by >typing in the url (or website address) and not clicking on a link. We >would encourage you to contact the company [or Capital One] if you receive >a questionable email to verify that it was sent from the company. To >verify that emails are sent from Capital One or not, please forward them to >Capital One at abuse(a)capitalone.com. Customer Relations representatives >will respond in writing. > >We do appreciate your concerns and if you have additional questions, please >do not hesitate to contact us. > >Sincerely, > >Capital One Services(R) > >Visit us online at http://www.capitalone.com, where you can access valuable >products and services. > > > >Original Message Follows: >------------------------- > >>... >>>-----Original Message----- >>>From: Craig Baird [mailto:craig@xpressweb.com] >>>Sent: Wednesday, April 13, 2005 11:58 AM >>>To: discuss(a)lists.surbl.org >>>Subject: [SURBL-Discuss] Capital One redirector >>> >>> >>>Wow! Look at this open Capital One redirector in a phishing >>>spam. Talk about >>>a phisher's dream come true! >> >>HOLY Shiznat!! You have got to be kidding me! WOW! >> >>What the hell are they thinking? >> >>--Chris > > Chris, > > Where's that list of redirectors? > > How do these large companies find such stupid people to do this >for them? Wouldn't you think any programmer would tell his boss why >these shouldn't exist? Or is there some book with an example every idiot >is copying from? > > Paul Shupak > track(a)plectere.com > >P.S. There seem to be no limits on where this one will take you, porn, >pills, >and penis gadgets, etc.. > > >http://www.capitalone.com/redirect.html?linkid=I_sell_drugs_any_kiddie_porn >&dest=http://www.google.com > > >

1 0

Re: [SURBL-Discuss] Capital One redirector
by List Mail User 14 Apr '05

14 Apr '05

>... > >On Wednesday, April 13, 2005, 8:57:49 AM, Craig Baird wrote: >> Wow! Look at this open Capital One redirector in a phishing spam. Talk about >> a phisher's dream come true! > >More importantly is anyone contacting Capital One? If not, >then please do. > >Jeff C. >-- >"If it appears in hams, then don't list it." > Jeff, On one of the first messages I "Cc" about four addresses at Capitol One; And Chris S. replied, leaving the "Cc"'s intact. Let's hope someone at abuse@, postmaster@ or any of their contact addresses reads email. (Cc: legal(a)capitalone.com, postmaster(a)capitalone.com, abuse(a)capitalone.com, hostmaster(a)capitalone.com - none bounced). Also, Joseph Burford, noted that he had sent them a message directly (didn't mention what address - possibly "spoof@"?). Paul Shupak track(a)plectere.com

1 0

Capital One redirector
by Craig Baird 14 Apr '05

14 Apr '05

Wow! Look at this open Capital One redirector in a phishing spam. Talk about a phisher's dream come true! Capital One is committed to maintaining a safe environment for its community of buyers and sellers. To protect the security of your account, Capital One Bank employs some of the most advanced security systems in the world and our anti-fraud teams regularly screen the Capital One Bank system for unusual activity. We recently have determined that different computers have logged onto your Capital One Banking account, and multiple password failures were present before the logons. We now need you to re-confirm your account information to us. If this is not completed by April 14, 2006, we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes. We thank you for your cooperation in this manner. In order to confirm your Online Bank records, we may require some specific information from you. Click below to verify your account http://www.capitalone.com/redirect.html? linkid=SECURITY+VALIDATION&dest=http://24.232.117.142/bin/capitalone.com/ Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account. We apologize for any inconvenience. If you choose to ignore our request, you leave us no choice but to temporaly suspend your account. Thank you for using Capital One Bank! ---------------------- It looks like the website has been taken down, but the redirector is still open. -- Craig

4 3

RE: [SURBL-Discuss] Capital One redirector
by Matthew.van.Eerde＠hbinc.com 13 Apr '05

13 Apr '05

Craig Baird wrote: > Wow! Look at this open Capital One redirector in a phishing spam. > Talk about a phisher's dream come true! > http://www.capitalone.com/redirect.html?linkid=SECURITY+VALIDATION&dest=htt… EBay had one of these recently... actually it took you to a login page, and redirected you once you logged in. Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer perl -e"map{y/a-z/l-za-k/;print}shift" "Jjhi pcdiwtg Ptga wprztg,"

1 0

RE: [SURBL-Discuss] Capital One redirector
by Chris Santerre 13 Apr '05

13 Apr '05

>-----Original Message----- >From: List Mail User [mailto:track@plectere.com] >Sent: Wednesday, April 13, 2005 1:49 PM >To: discuss(a)lists.surbl.org >Cc: legal(a)capitalone.com; postmaster(a)capitalone.com; >abuse(a)capitalone.com; hostmaster(a)capitalone.com >Subject: RE: [SURBL-Discuss] Capital One redirector > > >>... >>>-----Original Message----- >>>From: Craig Baird [mailto:craig@xpressweb.com] >>>Sent: Wednesday, April 13, 2005 11:58 AM >>>To: discuss(a)lists.surbl.org >>>Subject: [SURBL-Discuss] Capital One redirector >>> >>> >>>Wow! Look at this open Capital One redirector in a phishing >>>spam. Talk about >>>a phisher's dream come true! >> >>HOLY Shiznat!! You have got to be kidding me! WOW! >> >>What the hell are they thinking? >> >>--Chris > > Chris, > > Where's that list of redirectors? > > How do these large companies find such stupid people to do this >for them? Wouldn't you think any programmer would tell his boss why >these shouldn't exist? Or is there some book with an example >every idiot >is copying from? > > Paul Shupak All open redirs are going to be listed on our gray uribl list. We are still finishing up the infrastructure now. Already have a bunch of mirrors. So as soon as its up, I'm sure a lot of these guys will sit up and take notice at their emails being blocked. Our list will consider ANY open redirector to be in the same category as an open mail relay. I've already started looking for more of these open redirs. --Chris

1 0

RE: [SURBL-Discuss] Capital One redirector
by List Mail User 13 Apr '05

13 Apr '05

>... >>-----Original Message----- >>From: Craig Baird [mailto:craig@xpressweb.com] >>Sent: Wednesday, April 13, 2005 11:58 AM >>To: discuss(a)lists.surbl.org >>Subject: [SURBL-Discuss] Capital One redirector >> >> >>Wow! Look at this open Capital One redirector in a phishing >>spam. Talk about >>a phisher's dream come true! > >HOLY Shiznat!! You have got to be kidding me! WOW! > >What the hell are they thinking? > >--Chris Chris, Where's that list of redirectors? How do these large companies find such stupid people to do this for them? Wouldn't you think any programmer would tell his boss why these shouldn't exist? Or is there some book with an example every idiot is copying from? Paul Shupak track(a)plectere.com P.S. There seem to be no limits on where this one will take you, porn, pills, and penis gadgets, etc.. http://www.capitalone.com/redirect.html?linkid=I_sell_drugs_any_kiddie_porn…

1 0

RE: [SURBL-Discuss] Capital One redirector
by Chris Santerre 13 Apr '05

13 Apr '05

>-----Original Message----- >From: Craig Baird [mailto:craig@xpressweb.com] >Sent: Wednesday, April 13, 2005 11:58 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] Capital One redirector > > >Wow! Look at this open Capital One redirector in a phishing >spam. Talk about >a phisher's dream come true! HOLY Shiznat!! You have got to be kidding me! WOW! What the hell are they thinking? --Chris

2 1

Re: [SURBL-Discuss] avsMUNGED-gold.com
by List Mail User 12 Apr '05

12 Apr '05

Jeff, Look again, dtag. de is listed at rfci for whois, postmaster, and abuse! Paul Shupak track(a)plectere.com

1 0

Re: [SURBL-Discuss] avsMUNGED-gold.com
by List Mail User 12 Apr '05

12 Apr '05

>... > >I received a spam from avsMUNGED-gold.com. They are a porn site and all signs >lead to blocking them except how long their domain has been around and the >lack of information showing up in the tools I didn't block them. >Comments? > >Lindsay >_______________________________________________ >... > % jwhois avs-gold.com [Querying whois.internic. net] [Redirected to whois.registrar.telekom. de] [Querying whois.registrar.telekom. de] [whois.registrar.telekom. de] [whois.registrar.telekom. de] % Copyright (c)2003 by Deutsche Telekom AG % % Restricted rights. % % % Except for agreed Internet operational purposes, no part of this % information may be reproduced, stored in a retrieval system, or % transmitted, in any form or by any means, electronic, mechanical, % recording, or otherwise, without prior permission of the Deutsche Telekom AG % on behalf of itself and/or the copyright holders. Any use of this % material to target advertising or similar activities are explicitly % forbidden and will be prosecuted. The Deutsche Telekom AG requests % to be notified of any such activities or suspicions thereof. domain: avs-gold.com registrant-hdl: RDT-H70 admin-c: RDT-AM174 tech-c: RDT-UH124 zone-c: RDT-HM3 nserver: pns.dtag. de nserver: secondary000.dtag. net. status: connected changed: 2004-01-14 source: DEUTSCHE TELEKOM AG % jwhois -h whois.registrar.telekom. de ha RDT-AM174 [Querying whois.registrar.telekom. de] [whois.registrar.telekom. de] [whois.registrar.telekom. de] % Copyright (c)2003 by Deutsche Telekom AG % % Restricted rights. % % % Except for agreed Internet operational purposes, no part of this % information may be reproduced, stored in a retrieval system, or % transmitted, in any form or by any means, electronic, mechanical, % recording, or otherwise, without prior permission of the Deutsche Telekom AG % on behalf of itself and/or the copyright holders. Any use of this % material to target advertising or similar activities are explicitly % forbidden and will be prosecuted. The Deutsche Telekom AG requests % to be notified of any such activities or suspicions thereof. nic-hdl: RDT-AM174 type: person firstname: Achim lastname: Maier address: Rosengarten 14 pcode: D-80805 city: Muenchen country: DE e-mail: A-Maier22@gmx. de phone: +49 899945687 fax-no: changed: 2002-08-05 source: DEUTSCHE TELEKOM AG The adminitrative contact appears to have an invalid telephone number; Too few digits for the prefix code of +49:89. If rfci accepts it (the person who actually checks is likely to be German), then I'll wdprs it. Paul Shupak track(a)plectere.com P.S. Note, the name servers are listed at rfci already (trivial, but real).

1 0

RE: [SURBL-Discuss] avsMUNGED-gold.com
by Chris Santerre 12 Apr '05

12 Apr '05

>-----Original Message----- >From: Lindsay Snider [mailto:lindsay@pa.net] >Sent: Tuesday, April 12, 2005 10:39 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] avsMUNGED-gold.com > > >I received a spam from avsMUNGED-gold.com. They are a porn >site and all signs >lead to blocking them except how long their domain has been >around and the >lack of information showing up in the tools I didn't block them. >Comments? > >Lindsay If they sent you a spam you didn't subscribe for...then whats the question? 62.159.229.68 - IP hosts 39 Total Domains ... Showing 1 - 39 out of 39 Domain Name 1 ALTE-GEILE-WEIBER.COM. 2 AMATEUR-MUSCHI.COM. 3 AVS-GOLD.COM. 4 BILDER-KOSTENLOS.COM. 5 ECHT-GRATIS.COM. 6 EDELHUREN.ORG. 7 GEIL-ONANIEREN.COM. 8 GEILE-OSTFRAUEN.COM. 9 GEILE-RUBENSFRAUEN.COM. 10 GEILE-SELBSTBEFRIEDIGUNG.COM. 11 GRATIS-BILDER.COM. 12 GRATISFOTO.COM. 13 GRATISWICHSER.COM. 14 GRATISWIXER.COM. 15 GROSSE-GEILE-TITTEN.COM. 16 HOBBYHURE-ZUM-FICKEN.COM. 17 KLEINE-TITTEN.ORG. 18 KOSTENLOS-FICKEN.ORG. 19 LECKEN-BLASEN-FICKEN.COM. 20 MEGA-HAENGETITTEN.COM. 21 PRIVAT-FICKEN.COM. 22 PRIVATCAM.ORG. 23 PRIVATE-WEBCAM.ORG. 24 RASIERTE-HURE.COM. 25 RASIERTE.ORG. 26 RIESENTITTEN.ORG. 27 ROTHAARIGE.ORG. 28 RUBENSFRAUEN.ORG. 29 SCHLAMPENBILDER.ORG. 30 SCHWANGERE-FRAUEN.NET. 31 SCHWULE-SEITE.COM. 32 SEX-ADRESSEN.ORG. 33 SEX-HURE.COM. 34 SEX-KONTAKT.ORG. 35 SEX-UMSONST.ORG. 36 VOYEURNETZ.ORG. 37 WE-PRIVATE.COM. 38 WEBCAM-PRIVAT.COM. 39 WIXPICS.COM. HTH, --Chris

1 0

Re: [SURBL-Discuss] More spams with Zdnet redirector
by List Mail User 10 Apr '05

10 Apr '05

>... >Date: Sat, 9 Apr 2005 10:56:10 +0200 (CEST) >From: Raymond Dijkxhoorn <raymond(a)surbl.org> >X-X-Sender: raymond(a)mailbox.prolocation.net >To: "Kevin A. McGrail" <kmcgrail(a)pccc.com> >Subject: Re: [SURBL-Discuss] More spams with Zdnet redirector >... > >Hi! > >> Why the use of the full test rather than the uri test? >> Regards, > >>> full PROLO_REDIR_ZDNET_CHECK_1 /http:\/\/.*chkpt.zdnet.com\/chkpt/ >>> score PROLO_REDIR_ZDNET_CHECK_1 8.0 >>> describe PROLO_REDIR_ZDNET_CHECK_1 PROLO_REDIR-ZDNET CHECK_1_2_3, Body > >URI tests are done on the toplevel domain, i dont want to block whole >zdnet... > >If you have something else that can do it, thats also fine, i mean, this >works for us <tm> > >Bye, >Raymond. >... I've begun sending them to shs(a)cnet.com - no bounce, but no response either. Starting tomorrow, *all* the CNet editors get a copy. Todays below. Paul Shupak track(a)plectere.com P.S. The messages was blocked, but only because of local rules (in particular, that zdnet is now in rfci.whois, and the forged headers said netscape.net which is in rfci.abuse and rfci.postmaster), which put the message at .05 poiints above the account's threshold for spam. I need to type in Raymond's rule - probably in the next hour. -------------------------------------------------------------------------------- --- spam body ------------------------------------------------------------------ -------------------------------------------------------------------------------- Is this what you asked for, I searched high and low for this. According to my findings, this one place has the stuff you asked for to help with your mood swings. I've used them them before so has a bunch of our friends, so don't worry. Here's there new location http://chkpt.zdnet.com/chkpt/wk/univcs.info/p/yo1 Please, contact me if you got any further questions Jason Trade between India and Pakistan is less than 1 percent of their combined total exports. Per capita income stood at $470 in India in 2002 and $420 in Pakistan, the World Bank says. "The task of finishing off the black plague of terrorism is a nagging necessity that cannot be delayed," he said. Holding the civil ceremony at Windsor Guildhall instead of the castle? Who cares. Having your future mother- and father-in-law boycott the actual wedding? Boo-hoo. Like you'll miss them.

2 1

More spams with Zdnet redirector
by Rakesh 09 Apr '05

09 Apr '05

Guys Seems Zdnet doesn't bothers about its open redirectors as yet. This is a spam that I trapped just 5 mins back. Spammers are enjoying using these openredirectors. Can any one send a reminder to Zdnet of this redirector. The Spam ....... Hi, Wanna get up 4 times in one night, well we've got the answer for you, check us out at http://chkpt.zdnet.com/chkpt/howbad/rdx56.info/p/yo -- Regards, Rakesh B. Pal Emergic CleanMail Team. Netcore Solutions Pvt. Ltd. -- Revolutions do not require corporate support.

11 28

Re: [SURBL-Discuss] More spams with Zdnet redirector
by List Mail User 09 Apr '05

09 Apr '05

>... > >On Friday, April 8, 2005, 9:09:51 AM, List User wrote: >> Here I agree completely with Chris. An open HTTP redirector is >> just the same as an open SMTP relay. Fifteen years ago SMTP relays were >> not only common, they were part of being a "helpful" citizen; Today, we >> all consider them invitations to abuse and organizations like SORBS exist >> to seek them out and blacklist them. Six years ago, a HTTP redirector was >> a similar concept - a friendly way to provide a service to others; In today's >> Internet environment, and open redirector is every bit as "evil" as an open >> SMTP relay - there is no way to prevent its abuse and it is a "screaming" >> invitation to all spammers - "use me, I'll help you!". Just as people seek >> out and blacklist SMTP relays, someone should for HTTP redirectors, If Chris >> makes such a list available, I will quickly adopt and use it (and recommend >> that everyone else does to). > >That's fine, but it's not the purpose of SURBLs, which is to list >domains only used in spams. > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Jeff, I realize this is a SURBL list, and I do fully support the intentions and differing goals of all the different groups involved in fighting spam. It does seem that this type of situation does not clearly fit any of the SURBL lists. I was simply stating, that if Chris creates such an organization and list, I will use it - and that it might also be of some interest to of the other mailing list members too (I probably should have "Cc:"'s the SA list, now that I think about it). Also, I did "Cc:" shs(a)cnet.com - which did not bounce (at least yet), so hopefully he will become aware of how at least some of us feel. In fact, given the goals of SURBL as best I understand them, an attempt to recognize redirectors does seem the best fit for your group; Even though I would like *somebody* to "step up to the plate" with something more aggressive (like SORBS does for SMTP relays). At this point, the discussion has seemed to have progressed beyond being appropriate or proper for the SURBL list, though possibly it could be continued in some other forum(s). Thank you again for providing all the services that you and SURBL do, Paul Shupak track(a)plectere.com

2 1

RE: [SURBL-Discuss] More spams with Zdnet redirector
by List Mail User 08 Apr '05

08 Apr '05

>From discuss-bounces(a)lists.surbl.org Fri Apr 8 06:48:07 2005 >From: Chris Santerre <csanterre(a)MerchantsOverseas.com> >To: "'Jeff Chan'" <jeffc(a)surbl.org>, > "'SURBL Discussion list'" <discuss(a)lists.surbl.org> >Subject: RE: [SURBL-Discuss] More spams with Zdnet redirector >Date: Fri, 8 Apr 2005 09:47:20 -0400 >... > >>-----Original Message----- >>From: Jeff Chan [mailto:jeffc@surbl.org] >>Sent: Thursday, April 07, 2005 10:55 PM >>To: SURBL Discussion list >>Subject: Re: [SURBL-Discuss] More spams with Zdnet redirector >> >> >>On Thursday, April 7, 2005, 12:45:51 PM, Patrik Nilsson wrote: >>> At 00:13 2005-04-07 -0700, Jeff Chan wrote: >>>>On Wednesday, April 6, 2005, 11:58:31 PM, Nick Askew wrote: >>>> > Jeff, >>>> >>>> > So it seems that there is an obvious loophole in SURBL. >>As long as the >>>> > spammer uses a legitimate business running a redirector >>you will never >>>> black >>>> > list them (perhaps the spammer could even set up their >>own legitimate >>>> > redirector). This open redirector discussion for ZDNET >>has been open for >>>> > several weeks now, they have had more than ample warning. >>>> >>>> > Nick >>>> >>>>No, it's not a loophole. Programs like SpamAssassin and >>>>SpamCopURI correctly parse some redirection sites like >>>>g.msn.com and check the redirected-to site. >> >> >>> That workaround is part of the problem, not part of the solution. >> >>> If we encourage client implementations to work around the >>problem in that >>> way, we will always have: >> >>> 1. Clients that need to be updated with the latest >>redirectors, unless we >>> provide and encourage implementations to use a constantly >>updated online >>> source of redirectors. >> >>> 2. Major redirectors getting included in the special >>work-arounds, like >>> Google, and smaller ones not getting included. >> >>> If we believe that open redirectors are bad, we should not solve the >>> problem by working around a few major ones that we are >>currently aware of. >> >>> Patrik >> >>Our solution is to detect and check the big ones, and try >>to get all of them to not be open to spammers. >> >>What's your solution? Blacklisting all open redirectors? >>So no one should be able to mention them? > >Thats EXACTLY what the new gray list will do. > >--Chris >'If it appears in spam, list it' > >(I can't take credit for the above tagline. Another nut came up with it >before me!) >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Jeff and Chris, Here I agree completely with Chris. An open HTTP redirector is just the same as an open SMTP relay. Fifteen years ago SMTP relays were not only common, they were part of being a "helpful" citizen; Today, we all consider them invitations to abuse and organizations like SORBS exist to seek them out and blacklist them. Six years ago, a HTTP redirector was a similar concept - a friendly way to provide a service to others; In today's Internet environment, and open redirector is every bit as "evil" as an open SMTP relay - there is no way to prevent its abuse and it is a "screaming" invitation to all spammers - "use me, I'll help you!". Just as people seek out and blacklist SMTP relays, someone should for HTTP redirectors, If Chris makes such a list available, I will quickly adopt and use it (and recommend that everyone else does to). Unfortunately, the world has changed - what was being friendly is now being abusive; It is not a change for the better, it just *is*. Paul Shupak track(a)plectere.com

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss