- Discuss - Mailman 3

free host: greatnow.com
by Jeff Chan 22 Oct '04

22 Oct '04

Got an FP report about greatnow.com, an apparent free hosting company. Based on DMOZ hits, they seem to have some legitimate uses. They also have a few NANAS hits. They are not in SBL. They probably have some minor abuse. Does anyone know anything more about them? Source is: /home/gorilla/black-gorilla-9_7_04_SCblog.txt:greatnow.com Jeff C. -- "If it appears in hams, then don't list it."

1 1

Fwd: surbl update
by Jeff Chan 22 Oct '04

22 Oct '04

[Joe asked me to forward this update. Thanks to everyone helping out with the project!] From: Jose Marcio Martins da Cruz Date: Thursday, October 21, 2004, 8:13:46 AM Subject: surbl update Hello Jeff, I've not enough time, at the moment, to participate on the list. I have a set of scripts to gather URLs from the spam I receive myself and from the spam on our postmaster mail box : around 5000 - 6000 messages a day. It seems to me that SURBL response delay becomes better each day. When I begun using SURBL, I was usually able to add some tenths of new URLs to surbl list. At the moment, I never add more than five a day, and most of the time, only one or at most three. It seems to me that this shows the excelent result of your work. Thanks, Joe -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

RE: [SURBL-Discuss] You guys are fast!
by Kristopher Austin 21 Oct '04

21 Oct '04

I've thought the exact same thing. I wish the lookup page would put the added date and times. I realize that would be difficult, but man would it be helpful. Kris -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Chris Santerre Sent: Thursday, October 21, 2004 1:46 PM To: 'SURBL Discussion list' Subject: RE: [SURBL-Discuss] You guys are fast! >-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Thursday, October 21, 2004 2:16 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] You guys are fast! > > >Hi Chris, > >> I get submission marked as spam because someone has already >added them to >> SURBL! (I scan submission on purpose for this very reason.) >Some of you guys >> are mad fast at adding these ;) > >What one it was added to ? Just curious ;) Dang I deleted three of them. One was childrenxxxxxxxx.com. Can't remember the xxxxxxxxxx. Many a times I would love to see date and time added. Just to know when they got put in. --Chris _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

RE: [SURBL-Discuss] You guys are fast!
by Chris Santerre 21 Oct '04

21 Oct '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Thursday, October 21, 2004 2:16 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] You guys are fast! > > >Hi Chris, > >> I get submission marked as spam because someone has already >added them to >> SURBL! (I scan submission on purpose for this very reason.) >Some of you guys >> are mad fast at adding these ;) > >What one it was added to ? Just curious ;) Dang I deleted three of them. One was childrenxxxxxxxx.com. Can't remember the xxxxxxxxxx. Many a times I would love to see date and time added. Just to know when they got put in. --Chris

1 0

You guys are fast!
by Chris Santerre 21 Oct '04

21 Oct '04

I get submission marked as spam because someone has already added them to SURBL! (I scan submission on purpose for this very reason.) Some of you guys are mad fast at adding these ;) --Chris

2 1

RE: [SURBL-Discuss] Recently whitelisted
by Chris Santerre 21 Oct '04

21 Oct '04

> >The remaining three which got whitelisted from your list are: > >coolestmail.com >emailcorner.net >messagingengine.com > >Thanks! > >Jeff C. LOL see, and you thought I was a hardline blacklister! I swing both ways......uh ...no, ......you know what I mean ;) --Chris (RED SOXXXXXXXXXXXXXXXXXXXXX!!!!!!!!!!!!!!!!!!!!!! Yeah!)

1 0

RE: [SURBL-Discuss] Recently whitelisted
by Chris Santerre 21 Oct '04

21 Oct '04

I was doing some research on kiddie pron. A bunch of whois email contact info came up similar. veryfast.biz So using our favorite set of utilities ;) , I found others linked to it. Thinking they might have something to do with the huge whirling dirvish of kiddie pron domains. It didn't appear that way. They appeared legit, but I had a small doubt I could have been duped. Those kiddie pron guys are pretty sly. But turns out they are whitehat, so I figured we should do a pre-emptive white listing on them. I don't think any of them were listed in an SURBL. --Chris (!esruc eht esreveR) >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, October 20, 2004 3:27 PM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] Recently whitelisted > > >On Wednesday, October 20, 2004, 12:05:43 PM, Chris Santerre wrote: >> In WS I have whitelisted the following thanks to responses >from Steve C, and >> Suresh. Jeff do you want to globally WL these? > >> 123mail.org >> 150mail.com >> 150ml.com >[...] > >Thanks much! > >Yes, if they are good enough to whitelist out of the individual >lists then we should whitelist them over all lists. I've added >them to the master whitelist. > >I also added fastmail.fm; hope that's correct. > >Can you describe where these came from? Are they >all from WS or also from OB; due to DMOZ hits or other? > >Jeff C. >-- >"If it appears in hams, then don't list it." >

2 1

Recently whitelisted
by Chris Santerre 21 Oct '04

21 Oct '04

In WS I have whitelisted the following thanks to responses from Steve C, and Suresh. Jeff do you want to globally WL these? 123mail.org 150mail.com 150ml.com 16mail.com 2-mail.com 4email.net 50mail.com bestmail.us cluemail.com coolestmail.com elitemail.org emailcorner.net emailgroups.net emailplus.org emailuser.net fast-email.com fast-mail.org fastemail.us fastemailer.com fastmail.cn fastmail.us fastmailbox.net fastmessaging.com fmailbox.com fmgirl.com fmguy.com hailmail.net imap-mail.com imapmail.org internet-e-mail.com internet-mail.org internetemails.net internetmailing.net jetemail.net letterboxes.org mail-central.com mail-page.com mailas.com mailbolt.com mailc.net mailhaven.com mailingaddress.org mailite.com mailmight.com mailnew.com mailsent.net mailworks.org messagingengine.com myfastmail.com nospammail.net ownmail.net postinbox.com proinbox.com promessage.com reallyfast.biz reallyfast.info rushpost.com speedpost.net speedymail.org ssl-mail.com swift-mail.com the-fastest.net the-quickest.com theinternetemail.com veryfast.biz warpmail.net xsmail.com yepmail.net your-mail.com Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

4 12

RE: [SURBL-Discuss] Recently whitelisted
by Chris Santerre 20 Oct '04

20 Oct '04

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Wednesday, October 20, 2004 4:07 PM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] Recently whitelisted > > >on Wed, Oct 20, 2004 at 03:46:53PM -0400, Rob McEwen wrote: >> Also, in case my terminology is not quite technically >accurate... this is >> what I meant: >> >> subdomains = subdomain.thatdomain.com > >This is one of those idiot-proof Web hosting naming conventions that I >wish would just die. 'subdomain.thatdomain.com' is a >/hostname/. It's not Agree on the hostname. > >> subwebs = thatdomain.com/subweb > >Why not just call them URL paths? We used to refer to these as >"subsites" back in the day, but technically they're just URL paths in >this context as there's no sense of their being components >with multiple >pages under them or anything. subsite works for me, even though it is just a path. Path or URL path just sounds goofy :) I still want to be able to list hosts in UC. But we just haven't gotten far enough with UC to try any of this yet. I'm hoping to find time to rewrite bigevil to find spammy things in URL paths. Like: www.xdomain.com/lolitateens/ scoring off the 'lolita'. But those closer to me know I got some HUGE stuff coming up in my life, so I may not be able to get to this soon. Possibly around thankgiving. --Chris

1 0

RE: [SURBL-Discuss] Possible new redir FP
by Chris Santerre 20 Oct '04

20 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, October 19, 2004 9:26 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Possible new redir FP > > >On Tuesday, October 19, 2004, 5:17:20 PM, Joe Wein wrote: >>> get2.us > >> I saw that in our spam feed to but skipped blacklisting >after checking the >> site, as it looks like a redirector. > >> Instead I sent them email reporting the abuse and pointed >out our open >> letter to redirector sites. > >> Joe > >Excellent! Thanks Joe. > >I checked them out a little more and their site and name servers >seem clean in terms of SBL, etc., including the parent domain >ScriptWiz.com. The apparent owner of the sites seems to have >several different sites, all pretty enterprising and apparently >legitimate. > >I'm going to go ahead and whitelist all the redirection sites >mentioned at: > > http://www.get2.us/start.php > >caught.us >get2.us >getto.us >hasballs.com >hated.us >ismyidol.com >spotted.us >went2.us >wentto.us > >None were whitelisted before, and only get2.us was listed in a >SURBL. > >Feedback, good or bad, on any of these is still welcomed! OK, hasballs.com is pretty funny ;) --Chris

4 4

Possible new redir FP
by Chris Santerre 20 Oct '04

20 Oct '04

get2.us listed in SC. Looks like a redir. Could be spam friendly. Great candidate for UC, but I'm suggesting Whitelisting for the rest. Thoughts? DOn't ask me if it appears in ham. Because I don't know. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 3

Fwd: Re: mailpolice point of contact
by Jeff Chan 19 Oct '04

19 Oct '04

Since Chris asked the question here too, here's what Bill found. Jeff C. __ This is a forwarded message From: Bill Landry <billl(a)pointshare.com> To: "Chris" <cpollock(a)earthlink.net>, users(a)spamassassin.apache.org Date: Monday, October 18, 2004, 9:01:43 PM Subject: mailpolice point of contact ===8<==============Original message text=============== ----- Original Message ----- From: "Chris" <cpollock(a)earthlink.net> > > > Does anyone know of a POC to report phishing msgs that the > > > mailpolice rbl misses? > > > > I sent an e-mail to a contact at MP to see who these could be sent to. > > You can also forward them to postmaster(a)corp.mailsecurity.net.au, which > > will get them listed on the SURBL phishing list. > > Thanks Bill, I'll give that a try, can't seem to get the > http//:rhs.mailpolice.com page to load, I'll run their ip through > whois and see if I have any luck. I already report all phishing to > postmaster(a)corp.mailsecurity.net.au, > reportphishing(a)antiphishing.org but seems like the mailpolice > list is lacking quit a bit in tagging phishing msgs. Chris, I heard back from MP, and was advised to go ahead and send these to spam(a)mailpolice.com. Bill ===8<===========End of original message text===========

1 0

Re: [SURBL-Discuss] Took top percentiles of DMOZ and wikipedia domains, some results
by Jeff Chan 19 Oct '04

19 Oct '04

On Saturday, October 16, 2004, 7:08:01 PM, David Funk wrote: > On Sat, 16 Oct 2004, Jeff Chan wrote: >> Thanks Dave, >> www.xiloo comes up for me but efriend.xiloo does not. >> Perhaps they took down a spammer's site? If so that >> could be good. >> >> But mainly I can't tell what the main site is since I >> can't read Chinese. It looks like a portal, but it's >> just a guess. And given that they seem to host multiple >> customer sites, perhaps we can assume they do hosting >> also. > Actually I don't read Chinese either. I use our local Chinese > grad student population for translation assistance in these > cases. I'm on the road for the next 4 days, I can get you > a 'read' on the main site when I get back. > Dave FWIW Spamhaus thinks xiloo.com is a spammer: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL14687 > Ref: SBL14687 > > 219.235.232.0/24 is listed on the Spamhaus Block List (SBL) > > 02-Jun-2004 06:05 GMT | SR02 > > dns6.xilu.com Spamhaus does not have the same inclusion criteria we do, but it can be a useful data point. Jeff C. -- "If it appears in hams, then don't list it."

1 0

RE: [SURBL-Discuss] Theory about FPs for sites with open subscrip tions
by Chris Santerre 18 Oct '04

18 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Saturday, October 16, 2004 10:31 AM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] Theory about FPs for sites with open >subscriptions > > >On Saturday, October 16, 2004, 6:57:56 AM, Rob McEwen wrote: >> Recently, a high-profile news web site (ranked about 1,500 >on alexa.com) had >> the IP address of the server sending their newsletters blocked by >> bl.spamcop.net > >> I contacted someone from SpamCop and they mentioned that, upon >> investigation, this site had an "open loop" newsletter subscription. > >> Recognizing that open loop subscriptions is a bad policy... >this is one of >> the reasons that, IMHO, SpamCop's RBL is much too aggressive >to use for >> all-or-none, "yes/no" blocking. (Though I do use it for auditing.) > >> More importantly, I hope that this kind of stuff does NOT >**automatically** >> get propagated from SpamCop to SURBL? (Though I'm largely >unfamiliar with >> this process.) > >The SpamCop RBL and our use of SpamCop's Spmavertised site data >are totally unconnected, aside from using some of the same >reports as input data. Their BL policies have no effect on >our sc.surbl.org policies. > >The problem with these open subscriptions getting onto SURBLs >is happening on OB, the Outblaze spamtrap SURBL, and WS, the >manual and some spamtrap SURBL. That, plus some looking at >the NANAS reports leads me to think some spamtraps may be >getting poisoned with these open subscription domains. The >poisoning may be deliberate or unintentional, with good >intentions or bad, but either way most of these open >subscription sites should not be getting onto our lists since >many have otherwise legitimate uses. > >Obviously open subscriptions are an extremely poor practice >and open for abuse, but that alone should not be a reason >to get listed in a SURBL, especially for otherwise legitimate >industrial/engineering/child protection sites, etc. > Perhaps it may be time for WS to have its own spamtraps? Most of you might already have them. I don't use any. Only what comes into my company. However a few "one time" aliases that were made for business reasons, I haven't deleted and they are starting to get spam. I just think we might be able to get some nice clean data with some nice new spamtraps for WS. Thoughts? --Chris

2 1

RE: [SURBL-Discuss] Removal of original BE domains from WS.
by Chris Santerre 18 Oct '04

18 Oct '04

>-----Original Message----- >From: Daniel Kleinsinger [mailto:danielk@avalonpub.com] >Sent: Saturday, October 16, 2004 1:14 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Removal of original BE domains from WS. > > >Jeff Chan wrote: > >>Hopefully that will decrease the FPs in WS, though there is still >>work to do if we're serious about reducing FPs. >> >I don't want to say too much (cause I don't really know what >I'm talking >about!), but back in the day of separate cf files, it wasn't >bigevil.cf >that gave me FPs, it was sa-blacklist.cf. When they were separate I >didn't actually use sa-blacklist because of the FPs. Too be honest, I >wasn't too pleased when bigevil started to exist only as the WS surbl >because of the sa-blacklist FPs. > >What I'm saying may be totally off base, but if you're looking for FPs >to remove, how about checking the sa-blacklist stuff that's still in >WS? Does that even make sense? > THANKS!! I love you to! ;) --Chris (Was I dreaming, or did the RedSox Actually win last night?)

1 0

Knight-Ridder realcities.com domains whitelisted
by Jeff Chan 18 Oct '04

18 Oct '04

I've whitelisted 100 domains from http://www.realcities.com/, which has a list of city sites run by large U.S. newspaper corporation Knight Ridder. None were blacklisted before. About a dozen were already whitelisted. Most are newspapers. These would be unlikely to be used by professional spammers. http://spamcheck.freeapp.net/whitelists/realcities.sort Jeff C. -- "If it appears in hams, then don't list it."

1 0

RE: [SURBL-Discuss] FP?: ultimatebizsource.biz
by Chris Santerre 17 Oct '04

17 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, October 15, 2004 10:49 AM >To: Chris Santerre >Cc: 'Jeff Chan'; 'SURBL Discussion list'; Joe Wein; Ryan Thompson >(E-mail) >Subject: Re: [SURBL-Discuss] FP?: ultimatebizsource.biz > > >On Friday, October 15, 2004, 7:50:06 AM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>By evidence I was referring to spams. If you have one, >>>post it and how it got to you or at least a description of >>>how it got to you. >>> > >> Sorry I can't. It's the evil gaff back from 7/04 again. >Where none of the >> sumissions were being archived. > >How do you feel about removing the 7/04 list from WS? Or is there >a subset of those we could remove? > 2285 domains in that file. I dont' feel good about it at all. Especially because the domain we are talking about seems so iffy. I'm not one to remove all of these just because I don't have the archived reports. If they are proved to be FPs then hell yeah I will remove those FPs. But to remove over 2k of them just for 2 reported FPs in that file??? --Chris

5 11

Took top percentiles of DMOZ and wikipedia domains, some results
by Jeff Chan 17 Oct '04

17 Oct '04

I took the top 50th percentile of the multiple-version-intersected DMOZ domains and matched them with the top 70th percentile of the multiple-version-intersected wikipedia domains: http://spamcheck.freeapp.net/whitelists/dmoz-50thpercentile.srt http://spamcheck.freeapp.net/whitelists/wikipedia-70thpercentile.srt resulting in a list of about 15k domains: http://spamcheck.freeapp.net/whitelists/percentile-wikipedia-dmoz.srt (first column is word counts:) 255838 255838 3955772 dmoz-50thpercentile.srt 28323 28323 402512 wikipedia-70thpercentile.srt 14982 14982 202925 percentile-wikipedia-dmoz.srt that appeared at least two or three times in both data sources. (Percentiles were chosen to give about two or three hits of domains within the same source.) I then matched those 15k against the list of all SURBL domains and got the following hits, all possible FPs: http://spamcheck.freeapp.net/whitelists/percentile-wikipedia-dmoz-blocklist… 0catch.com 1asphost.com 741.com 8bit.co.uk 8m.net anzwers.org arena.ne.jp away.com centralhome.com cheapass.com f2g.net faithweb.com fateback.com fortunecity.de freewebpage.org galeon.com htmlplanet.com i8.com itgo.com iwarp.com kit.net kki.net.pl ledger-enquirer.com nana.co.il online-dictionary.biz p5.org.uk quuxuum.org republika.pl s5.com spaceports.com t35.com telepolis.com transnationale.org up.co.il xiloo.com zip.net zonai.com One additional test I'd like to apply to all these data is to remove any that are listed in SBL, but I haven't coded that up yet. However Ryan Thompson's GetURI does include an SBL check, along with other goodies like domain age, so I fed these into his CGI version, with the results at: http://ry.ca/cgi-bin/geturi.cgi?id=ham-es0EnYAUmBru8HxYCzvQ5x It looks like all are between three and ten years old, aside from: fortunecity.de 2.7 years old 16 NANAS online-dictionary.biz 214 days 0 NANAS nana.co.il 552 days 754 NANAS 1asphost.com 786 days 60 NANAS And only these two had SBL hits: 8bit.co.uk 1796 days 131 NANAS xiloo.com 1667 days 342 NANAS Aside from those two, the rest may be candidates for whitelisting, though I did not check them further. (Note also that GetURI does not count NANAS; I did those few manually. May I ask for some help in checking these? Note that we should still continue to check the DMOZ hits since there are probably some more FPs in there also: http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.summed.txt http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.txt http://spamcheck.freeapp.net/whitelists/dmoz-blocklist.ws 1338 13380 141946 dmoz-blocklist1.summed.txt 1338 1338 20533 dmoz-blocklist1.txt 1173 11730 124298 dmoz-blocklist1.ws Most are in WS. Jeff C. -- "If it appears in hams, then don't list it."

5 18

FP in OB?
by Bill Landry 17 Oct '04

17 Oct '04

Domain, thechildsafetyguide.com, was listed in a Stork Avenue Newsletter (storkavenue.com) and is listed in OB. It's a fairly new domain, but seems legit and the web site looks legit: Registrant: American Family Safety Network Christian Bezick (cbezick(a)bellsouth.net) 2938 Banyan Blvd Circle NW Boca Raton FL,33431 US Tel. +001.5619129617 Creation Date: 24-May-2004 === - No NANAS listings - No SBL listings Bill

2 1

Theory about FPs for sites with open subscriptions
by Jeff Chan 16 Oct '04

16 Oct '04

After looking at NANAS hits for FPs, in particular the reporting parties and the destination addresses, I have a theory about some of the FPs. I think some anti-spam zealots may be deliberately subscribing spam traps, either their own or third parties' like Outblaze, to sites with open subscriptions. If so, they're probably doing it to draw attention to the fact that the sites have unconfirmed subscriptions. Or they could be cracker/spammer types trying to use them to poison the spamtrap feeds and therefore diminish the usefulness of data from them. This type of poisoning is a distinct possibility since it would appear that the "spams" (usually subscription newsletters) do appear to come from those sites or senders. I think we should consider the possibilities that either type of people (or even bots) could be adding otherwise legitimate sites to traps this way. (It would be trivially easy to write a spider to subscribe spamtrap or their own address to open subscription sites, and given some of the repeated reporters in NANAS, someone may have done that.) Whatever their reasons, we should not fall into this trap and list otherwise legitimate sites just because they have open subscriptions. Doing so probably diminishes the usefulness of SURBLs by increasing false positives. Comments, Jeff C. -- "If it appears in hams, then don't list it."

2 2

Removal of original BE domains from WS.
by Chris Santerre 16 Oct '04

16 Oct '04

We are going to remove the original 3k+ BigEvil domains from WS. We feel there may be too many FPs coming from it, as our methods of checking have gotten 5 million times better then what I used to do alone. So rather then checking them all for FP, we simplt remove. We feel this shouldn't cause any problems, and any domains still being used will be reported to us, and added back in. Does anyone have any objections to this? --Chris (Yankees suck.)

4 6

Re: [SURBL-Discuss] FP?: ultimatebizsource.biz
by alden＠engineno9inc.com 16 Oct '04

16 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, October 15, 2004 11:13 AM >To: Chris Santerre >Cc: 'Jeff Chan'; 'SURBL Discussion list'; Joe Wein; Ryan Thompson >(E-mail) >Subject: Re: [SURBL-Discuss] FP?: ultimatebizsource.biz <snip> >> 2285 domains in that file. I dont' feel good about it at >all. Especially >> because the domain we are talking about seems so iffy. I'm >not one to remove >> all of these just because I don't have the archived reports. >If they are >> proved to be FPs then hell yeah I will remove those FPs. But >to remove over >> 2k of them just for 2 reported FPs in that file??? > >> --Chris > >OK fair enough. There may be more than 2 FPs though. Here are >the DMOZ hits: > >> /home/gorilla/black-gorilla-7_04.txt in nouse-white-jeffc-dmoz >> >> 123go-shopping.com >> 24ktgoldcasino.com >> 3322.org >> abitz.com >> audiogalaxy.com >> bottomlinecom.net >> casinovendors.com >> chemicalhouse.com >> denversharedservices.com >> dimoskopisi.com >> dotphoto.com >> electroionic.com.ar >> etowns.net >> evite.com >> goldrush.com >> hotusa.org >> instoremag.com >> jlindustrial.com >> kinghost.com >> medica.de >> mwconsult.ru >> mypiece.com >> pcdi.com >> quevendo.com.ar >> response-o-matic.com >> spectralft.com >> telepolis.com >> tom.com >> vistaprint.com >> webwizguide.info >> wx-e.com >> zip.net >> >> Number of matches: 32 > >Do we see any FPs in those? > >Jeff C. >-- >"If it appears in hams, then don't list it." > evite.com is definitely an FP. It's an e-invitation site. Recipients may not all want the invites, and there's some (big) potential for spam, but the URL appears in LOTS of hams. Here's the source of a sample: <html> <head> </head> <body marginwidth="0" leftmargin="0" marginheight="0" topmargin="0" link="#993399" alink="#ff9900" vlink="#ff9900"> <table width="100%" cellpadding="0" cellspacing="0" border="0"> <tr> <td width="100%" height="80" align="center" valign="top"> <table width="600" cellpadding="0" cellspacing="0" border="0"> <tr> <td><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="177" height="70"></td> </tr> <tr> <td><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/html/img/hom…" width="1" height="10" border="0"></td> </tr> </table> </td> </tr> </table> <div align="center"> <table width="600" cellpadding="0" cellspacing="0" border="0"> <tr> <td valign="top" colspan="3"> <table cellpadding="0" cellspacing="0" border="0"> <tr> <td align="center" valign="top" colspan="3"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="600" height="15" border="0"></td> </tr> <tr> <td align="left" valign="top"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="20" height="45" border="0"></td> <td align="center" valign="top" width="560" height="45" style="color:#666; font-size:14px; font-family:verdana, arial, helvetica, sans-serif" bgcolor="#ffffff"><b>Melissa & Michael</b><font style="color:#666; font-size:12px"><br />have invited you to:<br /></font></td> <td align="right" valign="top" ><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="20" height="45" border="0"></td> </tr> <tr> <td valign="top" colspan="3"> <table width="600" cellpadding="0" cellspacing="0" border="0"> <tr> <td align="left" valign="top"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="117" height="65" border="0"></td> <td align="center" valign="top" width="366" height="65" colspan="3" style="color:#069; font-size:17px; font-family:verdana, arial, helvetica, sans-serif" bgcolor="#ffffff"><b>Nate's First Birthday Party</b></td> <td align="right" valign="top"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="117" height="65" border="0"></td> </tr> <tr> <td valign="top"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="117" height="163" border="0"></td> <td valign="top"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="103" height="163" border="0"></td> <td valign="top" width="160" height="57"> <table width="160" cellpadding="0" cellspacing="0" border="0"> <tr> <td align="center" valign="top" width="160" height="59" style="color:#666; font-size:11px; font-family:verdana, arial, helvetica, sans-serif" bgcolor="#ffffff"></td> </tr> <tr> <td valign="top"><a href="http://www.evite.com/pages/invite/viewInvite.jsp?inviteId=TIDNNMMWHRJIIZPUB…"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="160" height="74" border="0"></a></td> </tr> <tr> <td align="center" valign="top" width="160" height="30" background="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" style="color:#666; font-size:14px; font-family:verdana, arial, helvetica, sans-serif"><a href="http://www.evite.com/pages/invite/viewInvite.jsp?inviteId=TIDNNMMWHRJIIZPUB…"><b>View the Evite</b></a></td> </tr> </table> </td> <td valign="top"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="103" height="163" border="0" alt=""></td> <td valign="top"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="117" height="163" border="0" alt=""></td> </tr> </table> </td> </tr> </table> </td> </tr> <tr> <td align="left" valign="top" width="10" height="100%" background="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="10" height="1" border="0"></td> <td align="left" valign="top" width="580" background="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" style="color:#666; font-size:11px; font-family:verdana, arial, helvetica, sans-serif;"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/t.gif" width="580" height="1"><br /></td> <td align="right" valign="top" width="10"background="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="10" height="1" border="0"></td> </tr> <tr> <td align="center" valign="top" colspan="3"><img src="http://a1444.g.akamai.net/7/1444/9744/ZTWTGZBOST/www.evite.com/images/email…" width="600" height="17" border="0"></td> </tr> </table> <table width="600" border="0" cellspacing="0" cellpadding="2">  <tr><td style="color:#999; font-size:11px; font-family:verdana, arial, helvetica, sans-serif"><br><a href="http://www.evite.com/inviteMore?eventID=APFXZQNSIJQPZDYQWERX&iid=TIDNNMMWHR…">Invite More Friends</a> by adding them to the guest list.<br><br></td></tr>  <tr><td style="color:#999; font-size:11px; font-family:verdana, arial, helvetica, sans-serif"><b>Is this email going to your junk/bulk folder?</b>  Add <b>info(a)evite.com</b> to your address book to ensure that you receive all future Evites in your Inbox.</td></tr> <tr><td style="color:#999; font-size:11px; font-family:verdana, arial, helvetica, sans-serif"><br /><b>Was this email unwanted?</b>  Manage your <a href="http://www.evite.com/respond/rmcomm?iid=TIDNNMMWHRJIIZPUBRIW">communication preferences.</a></td></tr> <tr><td style="color:#999; font-size:11px; font-family:verdana, arial, helvetica, sans-serif" height="100%"><br> <b>Having Trouble?</b>  If you are unable to open this Evite, try copying the entire URL below into your browser:<br /> http://www.evite.com/r?iid=TIDNNMMWHRJIIZPUBRIW&li=iq&src=email</td></tr> </table> <br /> <img width=1 height=1 src="http://www.evite.com/mailDetect?iid=TIDNNMMWHRJIIZPUBRIW&src=email"> </div> </body> </html> Regards, Alden Alden Levy Engine No. 9, Inc. 130 West 57th Street, Suite 12E New York, NY 10019 (212) 981-1122 (212) 725-7202 (fax) www.engineno9inc.com

2 1

RE: [SURBL-Discuss] FP?: ultimatebizsource.biz
by Chris Santerre 15 Oct '04

15 Oct '04

Fair enough ;) Give me a bit. I've got a few things I have to get done here, and a conference call to get ready for. I'll get back to you this afternoon on these. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, October 15, 2004 11:13 AM >To: Chris Santerre >Cc: 'Jeff Chan'; 'SURBL Discussion list'; Joe Wein; Ryan Thompson >(E-mail) >Subject: Re: [SURBL-Discuss] FP?: ultimatebizsource.biz > > >On Friday, October 15, 2004, 7:55:54 AM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] >>>On Friday, October 15, 2004, 7:50:06 AM, Chris Santerre wrote: > >>>> Sorry I can't. It's the evil gaff back from 7/04 again. >>>Where none of the >>>> sumissions were being archived. >>> >>>How do you feel about removing the 7/04 list from WS? Or is there >>>a subset of those we could remove? > >> 2285 domains in that file. I dont' feel good about it at >all. Especially >> because the domain we are talking about seems so iffy. I'm >not one to remove >> all of these just because I don't have the archived reports. >If they are >> proved to be FPs then hell yeah I will remove those FPs. But >to remove over >> 2k of them just for 2 reported FPs in that file??? > >> --Chris > >OK fair enough. There may be more than 2 FPs though. Here are >the DMOZ hits: > >> /home/gorilla/black-gorilla-7_04.txt in nouse-white-jeffc-dmoz >> >> 123go-shopping.com >> 24ktgoldcasino.com >> 3322.org >> abitz.com >> audiogalaxy.com >> bottomlinecom.net >> casinovendors.com >> chemicalhouse.com >> denversharedservices.com >> dimoskopisi.com >> dotphoto.com >> electroionic.com.ar >> etowns.net >> evite.com >> goldrush.com >> hotusa.org >> instoremag.com >> jlindustrial.com >> kinghost.com >> medica.de >> mwconsult.ru >> mypiece.com >> pcdi.com >> quevendo.com.ar >> response-o-matic.com >> spectralft.com >> telepolis.com >> tom.com >> vistaprint.com >> webwizguide.info >> wx-e.com >> zip.net >> >> Number of matches: 32 > >Do we see any FPs in those? > >Jeff C. >-- >"If it appears in hams, then don't list it." >

2 1

RE: [SURBL-Discuss] FP?: ultimatebizsource.biz
by Chris Santerre 15 Oct '04

15 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, October 15, 2004 10:42 AM >To: Chris Santerre >Cc: 'Jeff Chan'; 'SURBL Discussion list'; Joe Wein; Ryan Thompson >(E-mail) >Subject: Re: [SURBL-Discuss] FP?: ultimatebizsource.biz > > >On Friday, October 15, 2004, 7:25:28 AM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>Both domains are listed in WS: >>> >>>/home/gorilla/black-gorilla-7_04.txt:cashfromhome.com >>>/home/prolocation/black-prolocation-master:ultimatebizsource.biz >>> >>>Chris, what evidence do you have? Same question for Raymond. > >> eh? Read their site! They don't particularly care who I am >as long as I have >> money. They 'say' they have an opt in list. But if I give >them money, they >> send my ad to their list. How could their members possibly >have opt'd in to >> recieve my ads when they don't even know me yet? > >Opt-in doesn't mean they opted in because they know you. >It could mean they opted in to get ads in general (for >whatever reason). > >By evidence I was referring to spams. If you have one, >post it and how it got to you or at least a description of >how it got to you. > Sorry I can't. It's the evil gaff back from 7/04 again. Where none of the sumissions were being archived. Keeps biting me in my ass. ouch. --Chris (If it appears in spam and you can't prove it....don't list.) <-ARGH!

2 1

RE: [SURBL-Discuss] FP?: ultimatebizsource.biz
by Chris Santerre 15 Oct '04

15 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, October 15, 2004 1:01 AM >To: Joe Wein >Cc: SURBL Discussion list >Subject: Re: [SURBL-Discuss] FP?: ultimatebizsource.biz > > >On Thursday, October 14, 2004, 8:43:40 PM, Joe Wein wrote: >> ultimatebizsource.biz claims to be an opt-in list with >55,000 subscribers. >> It's currently listed on [WS] and [JP] but not my personal list. > >> I know, the name alone sounds like your typical spammer >domain, but is it? >> Today the owner of getyoursiteongoogle.info mailed me, since I had >> blacklisted their domain. > >> Turns out the evidence was a mailing from >ultimatebizsource.biz which was >> listed on WS and JP. Since the recipient was a third party from the >> Prolocation feed, I could not easily verify if it was indeed >unsolicited, >> but I checked what I could check quickly. > >> To my surprize the outgoing mailserver's IP is not listed on >any of the RBLs >> and neither are the name servers or the resolved name. > >> There is only 1 NANAS sighting for this almost one year old >domain. That >> posting is an automated one, and probably related to an >ahbl.org listing >> mentioned in the SA-tags added to the evidence mail. I can >find no listing >> for them at ahbl.org now. > >> A web search for the domain name returns a single hit: >> http://www.google.com/search?q=ultimatebizsource.biz+spam > >> That looks too little for 55,000 mails per day for one year. > >> Joe > >Perhaps the question should be: do they have legitimate uses? >Obviously their name, etc. sound very spammy, but is their >subscriber list truly opt-in or is is harvested or scraped, >etc.? If it's truly opt-in then they may have legitimate >uses. Their site claims to be opt in, but of course that's >impossible to confirm directly except perhaps by asking >everyone on it. > >However if it were not opt in, it would seem there should be >many complaints. Also 55-58k is pretty small for a scraped >or harvested list, which usually have more like millions. >So perhaps there's a chance it actually is opt in. > >The domain registration is from October 31, 2003. The >domain registration for a related domain: Cashfromhome.com >is quite a bit older: Creation Date: 08-jun-1998. These >also lead me to believe they may have legitimate uses or >at least that 1-8 years should have been enough time for >SBL, NANAS, etc. to find them as true spammers. > >(Note that there are 34 NANAS hits for the older domain, >but all are from 1998 through 2000. None are newer, so >perhaps they spammed somewhat several years ago but >cleaned up their act in recent years. Most of the NANAS >reports are apparently from the same person.) > >Both domains are listed in WS: > >/home/gorilla/black-gorilla-7_04.txt:cashfromhome.com >/home/prolocation/black-prolocation-master:ultimatebizsource.biz > >Chris, what evidence do you have? Same question for Raymond. > eh? Read their site! They don't particularly care who I am as long as I have money. They 'say' they have an opt in list. But if I give them money, they send my ad to their list. How could their members possibly have opt'd in to recieve my ads when they don't even know me yet? cashfromhome? Hell they even list MLM right on their menu! If you're going to remove these guys, then please let Ryan know to add to UC. IN THEIR DEFENSE: their domain reg is from 1998 with no NANAS hits. HOWEVER, whose to say they send out their ad capmaigns using with links to that domain at all? Could be used as a front and they use other domains in their campaigns. --Chris

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss