- Discuss - Mailman 3

SpamCop URI Compilation
by Robin, Rob 26 Aug '04

26 Aug '04

All, My company has the policy of not throwing away default build from the OS install. Therefore, all my perl libs have been compiled under /usr/local/blah/blah without doing UNINST=1. After downloading all the necessary modules, etc, I am close to getting Spamcop URI compile. Details: Perl 5.005_03, SpamAssassin 2.63. perl ./Makefile.PL went through fine. Problem w/ it is extract_url.t test script. PERL5LIB="/usr/local/spamassassin/2.63/lib: /usr/local/perl5lib/HTML/Parser/3.26/lib: /usr/local/perl5lib/File/Spec/0.82/lib:/usr/local/perl5lib/URI/1.31/lib /usr/local/perl5lib/Test/Simple/0.47/lib /usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker /usr/local/perl5lib/podlators/1.27/lib /usr/local/perl5lib/Pod/Parser/1.28/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22" Export PERL5LIB The reason why I called the test script directly is because "make test" put my PERL5LIB directories as a less preferred lib and thus loaded older version of other libs that failed. I needed to circumvent by calling the test script directly. All the test scripts passed, except extract_urls.t. I defined "/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib" as part of PERL5LIB, since I know that SpamCopURI.pm is located at /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin/SpamCopURI.pm. Perl -V confirms that everything is defined properly. From the error message, could it be my perl version is too old ? Please note that all other test scripts went through just fine. bash-2.02# perl ./t/extract_urls.t 1..23 Undefined subroutine &Mail::SpamAssassin::SpamCopURI::_extract_urls called at ./t/extract_urls.t line 46. # Looks like your test died before it could output anything. Any input will be appreciated. #Perl -V (output). I verify that all the dir for my PERL5LIB existed just fine. Characteristics of this binary (from libperl): Built under bsdos Compiled at Oct 8 2000 21:58:54 %ENV: PERL5LIB="/usr/local/spamassassin/current/lib:/usr/local/perl5lib/HTML/Parser/current/lib:/usr/local/perl5lib/File/Spec/current/lib:/usr/local/perl5lib/URI/current/lib:/usr/local/perl5lib/Test/Simple/current/lib:/usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker:/usr/local/perl5lib/podlators/current/lib:/usr/local/perl5lib/Pod/Parser/current/lib:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22" @INC: /usr/local/spamassassin/current/lib /usr/local/perl5lib/HTML/Parser/current/lib /usr/local/perl5lib/File/Spec/current/lib /usr/local/perl5lib/URI/current/lib /usr/local/perl5lib/Test/Simple/current/lib /usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker /usr/local/perl5lib/podlators/current/lib /usr/local/perl5lib/Pod/Parser/current/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22 /usr/libdata/perl5/5.00503/i386-bsdos /usr/libdata/perl5/5.00503 /usr/libdata/perl5/site_perl/i386-bsdos /usr/libdata/perl5/site_perl /usr/libdata/perl5/site_perl/i386-bsdos/include . Thanks, ------------------------ Rob Robin Network Analyst Green Apple, Inc. 740-653-9890 rrobin(a)greenapple.com www.greenapple.com Internet access, hosting and development solutions since 1995.

2 1

RE: [SURBL-Discuss] Strange happenings...
by Chris Santerre 26 Aug '04

26 Aug '04

Older Steve submission. Yup same file. And I can see why these guys would have been added. Looks like spammers were using a spacer.gif image from them in theis spams. Hence lots of NANAS hits. This was before we looked for posion like this. Removed. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, August 18, 2004 9:52 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Strange happenings... > > >On Wednesday, August 18, 2004, 6:17:26 PM, Bill Landry wrote: > >> Replying to my own post. I see now that the URI above gets >redirected to: > >> >http://qspace.iplace.MUNGEDcom/cobrands/41/?sc=1452NLCRamp;&CM= MHHNewsletterServices&CE=TextArea3 > >> and "iplace.com" is listed in WS. So my next questions is, should >> "iplace.com" be listed in WS? > >Probably not. Anyone know if these guys are spammers or why it's >on WS? > >Name: icreditreport.com >Address: 205.180.159.210 >Aliases: qspace.iplace.com > >If this appeared in a legitimate message, then we probably should >whitelist. Was it in a ham? > >Comments? > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

3 2

New tld?
by Chris Santerre 26 Aug '04

26 Aug '04

I've never seen this TLD??? www.sdlkjfdd.it.tt Can I add to surbl? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

4 3

RE: [SURBL-Discuss] WS FP greenfieldonline.com
by Chris Santerre 26 Aug '04

26 Aug '04

http://media.greenfieldonline.com/images/sample/greenrtop.jpg http://media.greenfieldonline.com/images/sample/first600.jpg "Free chances to win cash and prizes by filling surveys ------------------------------------------------------ $$$ (added 11/6/2000) Free Sweepstakes GreenfieldOnline.com is a survey-based site that wants your input on consumer products and services. Register for free to fill out their surveys and you could win any of their great cash and prize giveaways. http://www.bonustree.com/freebies/greenfield.html " http://signup.greenfieldonline.com/welcome.asp?wm=3823 And after all that... I actually feel like they are legit. Go figure! remove, no whitelist. (RNW - new term?) +1 RNW --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, August 26, 2004 4:52 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] WS FP greenfieldonline.com > > >WS folks, please consider removing greenfieldonline.com > >Looks white hat. > >Jeff C. >__ > >From: Jeff Chan >To: "Bill Landry" >Date: Thursday, August 26, 2004, 1:07:10 AM >Subject: WS FP? > >===8<==============Original message text=============== >On Thursday, August 26, 2004, 12:19:32 AM, Bill Landry wrote: >> Jeff, I am sending this directly to you since the list will >not deliver HTML >> e-mail attachments. Anyway, here is another MSN newsletter >with a redirect >> to greenfieldonline.MUNGEDcom that is listed in WS. The >actual link can be >> found under "Hot Offers" near the top right side of the >e-mail: "Win $2,500 >> cash for a vacation" > >> Thoughts on this one? > >> Bill > >Hi Bill, >They look legitimate to me so I whitelisted greenfieldonline.com > >Do you mind if I forward this to the discussion list? It can >be better to do these publically. > >Including the newsletter could be done as a text paste of the >raw message, but in this case it's probably not necessary. > >Jeff C. >-- >Jeff Chan >mailto:jeffc@surbl.org >http://www.surbl.org/ > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

WS FP greenfieldonline.com
by Jeff Chan 26 Aug '04

26 Aug '04

WS folks, please consider removing greenfieldonline.com Looks white hat. Jeff C. __ From: Jeff Chan To: "Bill Landry" Date: Thursday, August 26, 2004, 1:07:10 AM Subject: WS FP? ===8<==============Original message text=============== On Thursday, August 26, 2004, 12:19:32 AM, Bill Landry wrote: > Jeff, I am sending this directly to you since the list will not deliver HTML > e-mail attachments. Anyway, here is another MSN newsletter with a redirect > to greenfieldonline.MUNGEDcom that is listed in WS. The actual link can be > found under "Hot Offers" near the top right side of the e-mail: "Win $2,500 > cash for a vacation" > Thoughts on this one? > Bill Hi Bill, They look legitimate to me so I whitelisted greenfieldonline.com Do you mind if I forward this to the discussion list? It can be better to do these publically. Including the newsletter could be done as a text paste of the raw message, but in this case it's probably not necessary. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

RE: [SURBL-Discuss] Need help classifying a domain, solis2.365med ia.com
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, August 25, 2004 2:52 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Need help classifying a domain, >solis2.365media.com > > >On Wednesday, August 25, 2004, 7:51:13 AM, Chris Santerre wrote: >> Here is a link from a pure spam! No doubt in my mind it is >spam. However I'm >> not sure if the domain has legit purposes. > >> http://solis2.365media.com/galepublishing/AWDD/public/signin.asp > >365media.com was registered in 1998 and is in the U.S. >Chances are that they would probably not have survived >this long if they were a spam gang. > >To me a "pure spam" comes from a zombie and points to >a site at a spam-friendly ISP in China, Korea or Brazil. 1/2 ;-) > After further investigation, I have to go run over the head of marketing with my sports car. *sigh* it isn't a spam domain at all. An ISP in asia is blocking our company as a spammer :) IT would be funnier if a few of our vendors were not on that ISP :/ --Chris

1 0

Need help classifying a domain, solis2.365media.com
by Chris Santerre 25 Aug '04

25 Aug '04

Here is a link from a pure spam! No doubt in my mind it is spam. However I'm not sure if the domain has legit purposes. http://solis2.365media.com/galepublishing/AWDD/public/signin.asp Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

RE: [SURBL-Discuss] Fw: Your August eNewsletter from U.S. Bank
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 9:40 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Fw: Your August eNewsletter from U.S. Bank > > >On Tuesday, August 24, 2004, 5:41:36 PM, Bill Landry wrote: >> ----- Original Message ----- >> From: "Jeff Chan" <jeffc(a)surbl.org> >> To: "Bill Landry" <billl(a)pointshare.com> >> Sent: Tuesday, August 24, 2004 5:28 PM >> Subject: Re: [SURBL-Discuss] Fw: Your August eNewsletter >from U.S. Bank > > >>> Hi Bill, >>> Can you forward it to me dierctly? > >> Oh, an one other key component as part of my test, I didn't >actually receive >> the newsletter that I forwarded to you until after I logged >onto my US Bank >> online account and subscribed it on the official US Bank web site. > >OK That's pretty important. You actually opted in and got the >newsletter with those references. > >Jeff C. Yes, I officially go on record as saying usbank and usbank-email should both be whitelisted. --Chris

1 0

RE: [SURBL-Discuss] FP in WS & DS?
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 7:41 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] FP in WS & DS? > > >On Tuesday, August 24, 2004, 3:15:16 PM, Bill Landry wrote: >> ----- Original Message ----- >> From: "Raymond Dijkxhoorn" <raymond(a)prolocation.net> > >>> > And you know for a fact that they did not subscribe to >the newsletter? >> I am >>> > a US Back customer and I have never received their >newsletter (and they >>> > certainly have my e-mail address since I do online >banking with them) >> until >>> > just now, when I subscribed to it for testing purposes. >>> >>> I am not a customer, heck, i dont even know that US bank at >all, but i >>> have at least 10 fresh ones in my spamtrap, on never used >domains/address >>> combinations. They are a known fishing target. > >> No one is disputing that, certainly not me, since I report >US Bank phishing >> e-mails to PH almost daily. However, don't confuse these >phishing e-mails >> with "legitimate", subscription based, e-mails coming >directly from US Bank. >> Remember, they are a legitimate, national banking >institution and have a >> right to send out legitimate e-mail newsletters to their >subscribers without >> having them unnecessarily and erroneously blocked. > >> Would you dispute this? > >So bottom line: is usbank-email.com legitimate and being >mentioned in a phish? Does the phish actually direct victims >to a different site? > This is a legit site being mentioned in a fish. They should not be listed in SURBL. --Chris (I found my keys!)

1 0

Fw: Your August eNewsletter from U.S. Bank
by Bill Landry 25 Aug '04

25 Aug '04

USBank Money Wise[Apologies if this gets posted to the list twice, I inadvertently sent it from an e-mail address that I believe will be rejected by the list, since it is not subscribed to the list] Jeff, since I never saw any response as to whether you were going to whitelist "usbank-email.MUNGEDcom" or not, I thought I would just go ahead and forward the actual newsletter to the list, just in case anyone still has any doubts or concerns as to its legitimacy (note that they even included a "Phishing Alert" in the newsletter). Please let me know what you decide to do so that I have deal with this appropriately by whitelisting on my end, if necessary. Bill ----- Original Message ----- From: U.S. Bank To: my e-mail address Sent: Tuesday, August 24, 2004 8:08 AM Subject: Your August eNewsletter from U.S. Bank View this email as a Web page. Visit the U.S. Bank eNewletter Archive. Managing Money in College Even students who don't study accounting need to have money management skills. With U.S. Bank Internet Banking, you have the tools to help them establish a solid financial foundation. Internet Banking allows college students to view account activity, transfer funds and pay bills - all from their computer. Students can do the bulk of management, and you can monitor from afar, assuring that they develop financial independence, and that you get a good night's sleep. More >> Check 21: What Does it Mean to You? Check 21 is short for the Check Clearing for the 21st Century Act, which was signed into law by President Bush last year. Beginning on October 28, 2004, banks may begin to replace original paper checks with a "substitute check" if the check was cleared using an electronic image. This substitute check is the legal equivalent of the original check and meets certain characteristics, accurately representing all information on the original check and conforming to industry standards. More >> Searching Files for a Cancelled Check Just Became a Thing of the Past! Sue Smith felt her blood pressure rise when she opened the bill from her son's recent hospital stay. It was for $582! "That can't be right," she thought. Further review of the bill indicated the hospital hadn't received her last payment. "I know I paid that bill, but now I have to go home, dig through my files for last month's bank statement and make a copy of the cancelled check to show the hospital. Like I have time for this!" That might have been the case last month, but not today! Images of your cancelled checks and deposit slips are now online. More >> Phishing Alert There's a new breed of criminal out there called "phishers." They send very realistic looking emails, pretending to be from your bank or some other organization that you trust. Then they ask you to provide sensitive account information, like a PIN, Social Security number, account number or passwords. Don't do it...never, never, ever, ever, ever...ever. More >> Apply Now, Get a Decision Now Don't wait around for answers...get an immediate decision when you apply for our: a.. Checking & savings accounts b.. CDs c.. Home equity loans & lines d.. Credit cards e.. And much more! More >> The Check's Not in the Mail Nowadays, research shows that it's much safer to pay bills online than through traditional "snail" mail. Why? Because your mailbox gives criminals an easy, convenient way to steal your personal information. When you pay your bills online, this information stays secure. And you won't have to worry about putting stamps on those bills either! More great ideas >> To ensure that you continue to receive email from us, please add us to your Address Book (1800USBanks(a)usbank-email.com). Thank you. At U.S. Bank, protecting your privacy is our priority. For your safety, we will never request your personal information, such as IDs, passwords or PINs via email and recommend that you do not share this information with others. Sharing this information gives the recipient full access to your account. If you receive an email like this, please forward it to fraud_help(a)usbank.com or call our Fraud Liaison Center toll-free at 1-877-595-6256. You are receiving this email as a courtesy from U.S. Bank. Please know that you can modify your preferences or be removed from our mailing list at any time. View the U.S. Bank Privacy Policy. Our Web site address is usbank.com Deposit products offered by U.S. Bank, Member FDIC, Equal Housing Lender. U.S. Bank EP-MN-BB1R 2751 Shepard Road St. Paul, MN 55116

3 8

RE: [SURBL-Discuss] Improved name server status page
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 7:44 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] Improved name server status page > > >I've set up a better SURBL name server status page at: > > http://www.surbl.org/nameservers-output.html > >which is also linked from the main page. > >It shows some latency in zone file propagation, and it also >shows one of the name servers down. (Bjorn is that coming >back eventually?) > >We may want to ask all the public name servers to rsync >every 10 minutes.... Would that be OK Raymond? > >Currently I have the DNS timeout set to 10 seconds with two >retries. What kind of values are more typical or standard >for resolvers? > >I will use the scripts that generate the page to send >notifications (probably to myself at first) once things >stabilize. Since events don't happen very often, it's >probably not necessary to show a history on the page. > >Comments? > That is very cool! However do you think it is wise to make public the IP's of the servers? --Chris (Paranoid little monkey.)

3 3

FP on WS: fortunecity.com
by Jeff Chan 25 Aug '04

25 Aug '04

Got a report about fortunecity.com being an FP on WS. Looks mostly legit with some abuse but with a responsive abuse department. Whitelisting. WS folks please remove it.... Jeff C.

1 0

Re: [SURBL-Discuss] Fw: Your August eNewsletter from U.S. Bank
by Bill Landry 25 Aug '04

25 Aug '04

----- Original Message ----- From: "Jeff Chan" <jeffc(a)surbl.org> To: "Bill Landry" <billl(a)pointshare.com> Sent: Tuesday, August 24, 2004 5:28 PM Subject: Re: [SURBL-Discuss] Fw: Your August eNewsletter from U.S. Bank > Hi Bill, > Can you forward it to me dierctly? Oh, an one other key component as part of my test, I didn't actually receive the newsletter that I forwarded to you until after I logged onto my US Bank online account and subscribed it on the official US Bank web site. Don't know what else I can do to prove this one...? Bill

2 1

Re: spamvertised domains
by Jeff Chan 25 Aug '04

25 Aug '04

On Tuesday, August 24, 2004, 10:07:16 AM, spamfighter spamfighter wrote: > www.spamfighter.org > In the Download sections. Would any of those lists be appropriate for use in a SURBL? How often are they updated? What are the actual data sources? Are the records expired or do the files grow indefinitely? Jeff C. __ > ----- Original Message ----- > From: "SA" <rlfrank+sa(a)paradigm-omega.com> > To: "SpamAssassin Users" <users(a)spamassassin.apache.org> > Sent: Tuesday, August 24, 2004 11:56 AM > Subject: spamvertised domains >> Anyone know where there is a list (preferably plain text) of >> spamvertised domains. I want to compare the efficiency of blocking them >> using postfix body_checks vs SURBL. >> -- >> Robin Lynn Frank >> Director of Operations >> Paradigm-Omega, LLC >> Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

RE: [SURBL-Discuss] WS & DS FP?
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Bill Landry [mailto:billl@pointshare.com] >Sent: Tuesday, August 24, 2004 11:39 AM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] WS & DS FP? > > >----- Original Message ----- >From: "Chris Santerre" <csanterre(a)merchantsoverseas.com> > >> I agree. But the legit companies were spamming. That was >what I was trying >> to say, although poorly :) Some of the NANAS posts have >legit companies in >> them, but are spam. Most likely they paid a company to >market them. Or >they >> tried there hand at doing it themselves and purchased a >list. This looks >> like the main focus of yesmail/clickaction. A mass email marketing >company. >> SO they will get legit companies to pay them to >advertise/spam for them. >> >> They are a spammer for hier. I don't see them in ANY legit >mail other then >> this one single run with itworld. And that is because of a >seminar on how >to >> use email for mass marketing! I may get overruled on this >one, but I'm >> sticking to my guns that they are spammers. > >The IT World newsletter link to clickaction had nothing to do >with a mass >marketing seminar. If you review my original post again, you >will see that >it was used for a very legitimate purpose, to allow users that >have problems >viewing their IT World newsletter subscription in HTML format >to be able to >change it to a text based format - that was it, pure and simple. > >There are lots of other ways to block clickaction if people >feel that that >is necessary, however, since there are obviously very >legitimate uses for >clickaction services by very legitimate companies, I do not feel that >listing them in any of the SURBL is appropriate. My vote is >to keep them >whitelisted for now. > So once again, a spammer gets 1-2 legit companies to use them, and they get removed from all RBLs? If that is how we are going to operate, we might as well shutdown now. Game over. "obviously very legitimate uses for clickaction services" SO itworld wanted to reduce there own traffic and have this legit bulk done by a "Legit commercial email marketer". Well they picked the wrong one. This isn't the first time we have seen this and it won't be the last. The PROPER thing to do is inform itworld of the history of the marketer they are dealing with. Whitelist? No way in hell. Temp remove, sure go ahead, but they are just going to get submitted again. Then what? Why not local whitelist then for your site? I'm starting to sound like the crazy SPAM-L locals :) BUt I'm tired of having this one single argument every week. Spammer who gets legit businesses to sign up....we need to deal with this now. Otherwise, like I said, game over. --Chris (Antispam nut!)

4 3

RE: [SURBL-Discuss] FP in WS & DS?
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Bill Landry [mailto:billl@pointshare.com] >Sent: Tuesday, August 24, 2004 2:28 PM >To: SURBL Discussion list >Subject: [SURBL-Discuss] FP in WS & DS? > > >This is from a US Bank newsletter, and I have confirmed via >whois that US >Bank does own the domain in question: > > usbank-email.MUNGEDcom > >The sending IP address is not listed in any RBL/RHSBLs: > > http://www.dnsstuff.com/tools/ip4r.ch?ip=192.168.40.122 > >Looks like a legitimate, subscription based, US Bank newsletter. > >Bill We aren't seeing eye to eye today bill :) 207.189.106.22 not the reserved IP you listed. I see it as 4at1.com who is also: 00123.com 1nc002.com 1nc012.com 1nc022.com 4at1.com 4at2.com 4at2.net 4at5.net #Once ONCE (NET-207-189-106-0-1) 207.189.106.0 - 207.189.106.255 Empire Communications FORTIX-NET (NET-207-189-96-0-1) 207.189.96.0 - 207.189.127.255 Registrant: #once.com (4AT3-DOM) 309 SW Sixth Avenue, Suite 900 Portland, OR 97204 US Domain Name: 4AT1.COM Administrative Contact: #once.com (DB3242-ORG) billing#ONCE.COM 309 SW 6TH AVE STE 900 PORTLAND, OR 97204-1765 US 503-241-4185 fax: 503-241-4279 Technical Contact: #Once.com (AS3215-ORG) sysadmin#ONCE.COM 309 SW Sixth Avenue Suite 900 PORTLAND, OR 97204 US 5032414185 fax: 5032414279 Record expires on 28-Dec-2006. Record created on 28-Dec-1999. Database last updated on 24-Aug-2004 14:46:25 EDT. Domain servers in listed order: NS.ONCE.COM 207.189.106.105 NS2.ONCE.COM 207.189.106.108 NS3.ONCE.COM 207.162.212.83 --Chris

5 6

sc.surbl.org FP
by Brett Cove 25 Aug '04

25 Aug '04

citizensbankMUNGED.com Was likely listed due to it being a phish target. -Brett

2 1

RE: [SURBL-Discuss] FP in WS & DS?
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: Bill Landry [mailto:billl@pointshare.com] >Sent: Tuesday, August 24, 2004 3:06 PM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] FP in WS & DS? > > >----- Original Message ----- >From: "Chris Santerre" <csanterre(a)merchantsoverseas.com> > >> >This is from a US Bank newsletter, and I have confirmed via >> >whois that US >> >Bank does own the domain in question: >> > >> > usbank-email.MUNGEDcom >> > >> >The sending IP address is not listed in any RBL/RHSBLs: >> > >> > http://www.dnsstuff.com/tools/ip4r.ch?ip=192.168.40.122 >> > >> >Looks like a legitimate, subscription based, US Bank newsletter. >> >> We aren't seeing eye to eye today bill :) >> >> 207.189.106.22 not the reserved IP you listed. > >Yep, I corrected that in my last e-mail. > >> I see it as 4at1.com who is also: >> >> 00123.com >> 1nc002.com >> 1nc012.com >> 1nc022.com >> 4at1.com >> 4at2.com >> 4at2.net >> 4at5.net >> >> #Once ONCE (NET-207-189-106-0-1) >> 207.189.106.0 - 207.189.106.255 >> Empire Communications FORTIX-NET (NET-207-189-96-0-1) >> 207.189.96.0 - 207.189.127.255 > >Why would it matter who assigned US Bank the address space, or >who else they >assigned address space to? The IP address US Bank is using in >not listed in >any RBL/RHSBLs, and the bottom line is that the newsletter, >and the company >distributing it, are quite obviously both legitimate. What >else matters...? > Nope completely forget everything I posted. I was clearly off my rocker on that one! I entered the wrong data into my search and it spooled into the cluster Fsck I posted :) I'm taking steps to make sure that doesn't happen again today. (Translate: I'm pouring a cup of coffee!) This is what I get for doing 35 things at once and having 3 instances of firefow open with 10 tabs open in each of those! Now, where are my car keys?! --Chris

1 0

FP in WS & DS?
by Bill Landry 24 Aug '04

24 Aug '04

This is from a US Bank newsletter, and I have confirmed via whois that US Bank does own the domain in question: usbank-email.MUNGEDcom The sending IP address is not listed in any RBL/RHSBLs: http://www.dnsstuff.com/tools/ip4r.ch?ip=192.168.40.122 Looks like a legitimate, subscription based, US Bank newsletter. Bill

2 2

RE: [SURBL-Discuss] WS & DS FP?
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: Chris Santerre [mailto:csanterre@merchantsoverseas.com] >Sent: Tuesday, August 24, 2004 12:06 PM >To: 'SURBL Discussion list' >Subject: RE: [SURBL-Discuss] WS & DS FP? > > > > >>-----Original Message----- >>From: Bill Landry [mailto:billl@pointshare.com] >>Sent: Tuesday, August 24, 2004 11:39 AM >>To: 'SURBL Discussion list' >>Subject: Re: [SURBL-Discuss] WS & DS FP? >> >> >>----- Original Message ----- >>From: "Chris Santerre" <csanterre(a)merchantsoverseas.com> >> >>> I agree. But the legit companies were spamming. That was >>what I was trying >>> to say, although poorly :) Some of the NANAS posts have >>legit companies in >>> them, but are spam. Most likely they paid a company to >>market them. Or >>they >>> tried there hand at doing it themselves and purchased a >>list. This looks >>> like the main focus of yesmail/clickaction. A mass email marketing >>company. >>> SO they will get legit companies to pay them to >>advertise/spam for them. >>> >>> They are a spammer for hier. I don't see them in ANY legit >>mail other then >>> this one single run with itworld. And that is because of a >>seminar on how >>to >>> use email for mass marketing! I may get overruled on this >>one, but I'm >>> sticking to my guns that they are spammers. >> >>The IT World newsletter link to clickaction had nothing to do >>with a mass >>marketing seminar. If you review my original post again, you >>will see that >>it was used for a very legitimate purpose, to allow users that >>have problems >>viewing their IT World newsletter subscription in HTML format >>to be able to >>change it to a text based format - that was it, pure and simple. >> >>There are lots of other ways to block clickaction if people >>feel that that >>is necessary, however, since there are obviously very >>legitimate uses for >>clickaction services by very legitimate companies, I do not feel that >>listing them in any of the SURBL is appropriate. My vote is >>to keep them >>whitelisted for now. >> > >So once again, a spammer gets 1-2 legit companies to use them, >and they get >removed from all RBLs? If that is how we are going to operate, >we might as >well shutdown now. Game over. > >"obviously very legitimate uses for clickaction services" > >SO itworld wanted to reduce there own traffic and have this >legit bulk done >by a "Legit commercial email marketer". Well they picked the >wrong one. This >isn't the first time we have seen this and it won't be the last. > >The PROPER thing to do is inform itworld of the history of the >marketer they >are dealing with. > >Whitelist? No way in hell. Temp remove, sure go ahead, but >they are just >going to get submitted again. Then what? Why not local >whitelist then for >your site? > >I'm starting to sound like the crazy SPAM-L locals :) BUt I'm tired of >having this one single argument every week. Spammer who gets legit >businesses to sign up....we need to deal with this now. >Otherwise, like I >said, game over. > >--Chris (Antispam nut!) More info: http://www.badads.org/january02.shtml They have been providing email support for itworld since 2001! Maybe itworld needs a clue! http://emailuniverse.com/list-news/?id=298 --Chris (Still digging.)

2 1

RE: [SURBL-Discuss] WS & DS FP?
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: David Hooton [mailto:david.hooton@gmail.com] >Sent: Tuesday, August 24, 2004 10:42 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] WS & DS FP? > > >On Tue, 24 Aug 2004 10:16:39 -0400, Chris Santerre ><csanterre(a)merchantsoverseas.com> wrote: >> I agree. But the legit companies were spamming. That was >what I was trying >> to say, although poorly :) Some of the NANAS posts have >legit companies in >> them, but are spam. Most likely they paid a company to >market them. Or they >> tried there hand at doing it themselves and purchased a >list. This looks >> like the main focus of yesmail/clickaction. A mass email >marketing company. >> SO they will get legit companies to pay them to >advertise/spam for them. >> >> They are a spammer for hier. I don't see them in ANY legit >mail other then >> this one single run with itworld. And that is because of a >seminar on how to >> use email for mass marketing! I may get overruled on this >one, but I'm >> sticking to my guns that they are spammers. > >I'm with Chris, string them up! > >How about a slightly more moderate approach, lets not whitelist them, >but lets remove them from the list for now. If they re-offend then we >list them until such time as they prove themselves as whitehat. > >This kind of domain is a very slippery one, it incredibly hard to put >them on either side of the FP fence. >-- >Regards, > >David Hooton Oh it gets even better according to our friend. Related domains! abii.com businesscreditusa.com businessusa.com clickaction.com databaseamerica.com dblink.com directoriesusa.com donnelleymarketing.com easymailers.org emailmarketing.com enterconnect.net infousa.com infousadomain.com infousagov.com infousaproductsupport.com insync-palm.com libraryusa.com listbazaar.com mysalesconnection.com myyesmail.com newleadsusa.com nomail.com p01.com p02.com p03.com p04.com pondmail.com postdirect.com salesgenie.net salesleadsusa.biz salesleadsusa.com yesmail-inc.com yesmail.com yesmail.net yesmail.org ym0.com ym0.net ymc0.com ymc0.net So what do you think of them now? --Chris

1 0

RE: [SURBL-Discuss] WS & DS FP?
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 9:48 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] WS & DS FP? > > >On Tuesday, August 24, 2004, 6:46:01 AM, Chris Santerre wrote: >> Sorry I just noticed yesmail.com is listed is SURBL. So >clickaction.net >> should be as well. They are one in the same. > >Listings should not necessarily be associative. The real test >remains as "how spammy are they?" Do these guys do anything >legitimate? The NANAS customers of clickaction looked pretty >legitimate to me, assuming they're really customers. > >Jeff C. > I agree. But the legit companies were spamming. That was what I was trying to say, although poorly :) Some of the NANAS posts have legit companies in them, but are spam. Most likely they paid a company to market them. Or they tried there hand at doing it themselves and purchased a list. This looks like the main focus of yesmail/clickaction. A mass email marketing company. SO they will get legit companies to pay them to advertise/spam for them. They are a spammer for hier. I don't see them in ANY legit mail other then this one single run with itworld. And that is because of a seminar on how to use email for mass marketing! I may get overruled on this one, but I'm sticking to my guns that they are spammers. --Chris

3 2

RE: [SURBL-Discuss] Improved name server status page
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Tuesday, August 24, 2004 9:39 AM >To: SURBL Discussion list >Subject: RE: [SURBL-Discuss] Improved name server status page > > >Hi! > >> >Currently I have the DNS timeout set to 10 seconds with two >> >retries. What kind of values are more typical or standard >> >for resolvers? > >> >I will use the scripts that generate the page to send >> >notifications (probably to myself at first) once things >> >stabilize. Since events don't happen very often, it's >> >probably not necessary to show a history on the page. > >> That is very cool! However do you think it is wise to make >public the IP's >> of the servers? > ><BOFH mode=on> > >No, indeed, lets hide them, it will only cause problems if we >list them ;) > ><BOFH mode=off> > >Chris, you paranoid DONKEY :) how do you think people should >lookup the >zones if we dont publish where to get them. DNS does the exact >same thing. > >; <<>> DiG 9.2.1 <<>> ns surbl.org >;; global options: printcmd >;; Got answer: >;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21524 >;; flags: qr rd ra; QUERY: 1, ANSWER: 12, AUTHORITY: 0, ADDITIONAL: 12 > >;; QUESTION SECTION: >;surbl.org. IN NS > >;; ANSWER SECTION: >surbl.org. 13466 IN NS ns9.surbl.org. >surbl.org. 13466 IN NS ns8.surbl.org. >surbl.org. 13466 IN NS ns7.surbl.org. >surbl.org. 13466 IN NS ns6.surbl.org. >surbl.org. 13466 IN NS ns5.surbl.org. >surbl.org. 13466 IN NS ns3.surbl.org. >surbl.org. 13466 IN NS ns2.surbl.org. >surbl.org. 13466 IN NS ns13.surbl.org. >surbl.org. 13466 IN NS ns12.surbl.org. >surbl.org. 13466 IN NS ns11.surbl.org. >surbl.org. 13466 IN NS ns10.surbl.org. >surbl.org. 13466 IN NS ns1.surbl.org. > >;; ADDITIONAL SECTION: >ns9.surbl.org. 14175 IN A 209.234.97.11 >ns8.surbl.org. 14175 IN A 66.59.111.182 >ns7.surbl.org. 14175 IN A 130.161.128.84 >ns6.surbl.org. 14175 IN A 128.255.17.20 >ns5.surbl.org. 14175 IN A 128.255.17.19 >ns3.surbl.org. 14175 IN A 139.130.4.5 >ns2.surbl.org. 14175 IN A 209.204.159.15 >ns13.surbl.org. 14175 IN A 66.170.2.60 >ns12.surbl.org. 14175 IN A 66.170.2.50 >ns11.surbl.org. 14175 IN A 64.21.208.212 >ns10.surbl.org. 14175 IN A 66.251.133.4 >ns1.surbl.org. 14175 IN A 208.201.249.238 > LOL, yeah I realise that, but let the spammers do that. Why make it easy for them. Most can't spell DNS. :) The more hoops they have to go thru the better. I'm sure we may see a DDOS attempt by first quarter next year. --Chris

3 2

RE: [SURBL-Discuss] Improved name server status page
by Chris Santerre 24 Aug '04

24 Aug '04

Almost perfect. You have to follow RFC standards and name them either star wars or Simpsons Characters. Not ns1, ns2, ...... :) --Chris >-----Original Message----- >From: William C. Devine II [mailto:william@devine.net] >Sent: Tuesday, August 24, 2004 10:00 AM >To: Jeff Chan; SURBL Discussion list >Subject: RE: [SURBL-Discuss] Improved name server status page > > >You could keep a generic list of nameservers such as 'Server >1', 'Server >2', etc, which correlates to 'ns1', 'ns2', etc. It'd just add a level >of obscurity and require just a little more of a monkey to figure out >though. > >william > >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 6:40 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Improved name server status page > > >On Tuesday, August 24, 2004, 6:32:44 AM, Chris Santerre wrote: >> That is very cool! However do you think it is wise to make public the >IP's >> of the servers? > >Yeah that kind of raised some flags for me too, but the servers >are easy enough to find, and the names of the servers are not >unique due to the round robin. > >For example e.surbl.org resolves to two different name servers. > >So the only thing unique and used for the subdomains are their >IP addresses. I suppose we could set up another set of aliases >for them, but kind of don't want another set to maintain. >(The old style ns1, ns2, etc. names remain but for BIND >type servers for the parent zone. They have already diverged >from the rbldnsd servers.) > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] whitelist rm04.net and rm02.net?
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 2:14 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] whitelist rm04.net and rm02.net? > > >On Monday, August 23, 2004, 6:12:57 PM, Jeff Chan wrote: >> We've had a request to whitelist rm04.net and rm02.net. > >> Does anyone know anything about them? They seem to belong to: > >>> SilverPOP Systems >>> (DOM-151479) >>> 200 Galleria Parkway >>> Suite 750 Atlanta >>> GA >>> 30339 US > >> And reportedly appeared in a newsletter belonging to: >> Altiris http://www.altiris.com > >Someone I trust told me SilverPOP is whitehat, so I've >whitelisted them: > >silverpop.com >rm01.net >rm02.net >rm03.net >rm04.net >rm05.net >rm06.net >rm07.net >rm08.net >rm09.net >rm10.net > > >Jeff C. > I have no comment on their spamminess. But here is the list of more silverpop domains, from a good source ;) adm02.com ecommercial.com mailsubs.com mindarrow.com mindarrow.net radicalmail.com rm01.net rm02.net rm03.net rm04.net rm06.net rm07.net rm08.net silverpop.com --Chris

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss