Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

Re: [SURBL-Discuss] LInk to add to SURBL
by List Mail User 18 May '05

18 May '05

>From discuss-bounces(a)lists.surbl.org Wed May 18 06:57:18 2005 X-Scanned-By: RAE MPP/Clamd http://raeinternet.com/mpp Date: Wed, 18 May 2005 09:44:05 -0400 From: Spam Admin <spam_admin(a)sil.org> User-Agent: Mozilla Thunderbird 1.0.2 (X11/20050317) X-Accept-Language: en-us, en MIME-Version: 1.0 To: SURBL Discussion list <discuss(a)lists.surbl.org> References: <00ad01c55ba8$75db8040$cc0a0a0a(a)thoughtworthy.internal> <428B41AB.7060701(a)sil.org> In-Reply-To: <428B41AB.7060701(a)sil.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Prolocation-MailScanner-Information: Please contact helpdesk(a)prolocation.net for more information X-Prolocation-MailScanner: Found to be clean X-Prolocation-MailScanner-SpamCheck: X-Prolocation-MailScanner-From: spam_admin(a)sil.org Subject: [SURBL-Discuss] LInk to add to SURBL X-BeenThere: discuss(a)lists.surbl.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: SURBL Discussion list <discuss(a)lists.surbl.org> List-Id: SURBL Discussion list <discuss.lists.surbl.org> List-Unsubscribe: <http://lists.surbl.org/mailman/listinfo/discuss>, <mailto:discuss-request@lists.surbl.org?subject=unsubscribe> List-Archive: <http://lists.surbl.org/pipermail/discuss> List-Post: <mailto:discuss@lists.surbl.org> List-Help: <mailto:discuss-request@lists.surbl.org?subject=help> List-Subscribe: <http://lists.surbl.org/mailman/listinfo/discuss>, <mailto:discuss-request@lists.surbl.org?subject=subscribe> Sender: discuss-bounces(a)lists.surbl.org Errors-To: discuss-bounces(a)lists.surbl.org X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on nepal.plectere.com X-Spam-Status: No, score=-102.3 required=5.0 tests=AWL,BAYES_00,URIBL_L2SPEWS, USER_IN_WHITELIST autolearn=no version=3.0.1 X-Spam-Level-Plectere: spam link. http://www.kexmt.move.fresh-deals.net/go/g/31/2869/1/?3495564 Dan Zachary _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

Re: [SPAM-TAG] [SURBL-Discuss] Would SURBL block Yahoo, redirect? (Jeff Chan)
by J. Fowler 17 May '05

17 May '05

> So it checks yahoo.com and thelumbercartel.com . I'm certainly not suggesting thelubercartel.com was spamming. Just wanted to make that clear. The actual spam seen came from: http://google.com.s1gns.net/mortgage.asp And thanks. My concern was for the applications such as SA catching long urls. Jay

1 0

Would SURBL block Yahoo redirect?
by J. Fowler 17 May '05

17 May '05

Hello, Is this something Yahoo should be concerned with? Would SURBL lists flag spam if the leading url was yahoo? http://rds.yahoo.com/*-http://www.thelumbercartel.com/ I caught a few spams using yahoo to disguise their URL. saw somthing like this: http://rds.yahoo.com/S=1/K=r/v=3/e=0/t=0/i=1/r=1/*-http://google.com.s1gns.… Just curious what you guys thought.

3 3

Re: MORE (was: Re: [SURBL-Discuss] yet another joe job)
by List Mail User 17 May '05

17 May '05

>... >> All DNS provided by: >> >> nserver: ns1.dnsm.net 218.7.120.70 >> nserver: ns2.dnsm.net 218.7.120.70 >> >> And all domains registered to: >> >> owner: Roelf Van der Brug >> email: admin(a)taiwanmedialtd.com >> address: Singel 2 >> address: Jordaan >> city: Amsterdam >> state: -- >> postal-code: 1015JT >> country: NL >> phone: +31 84 220 2586 > >We have seen fake registrations before, and this also fits there. >Amsterdam is 020. not 084. The PO code fits Amsterdam however. > >domain: taiwanmedialtd.com >status: lock >owner: Mohammad Khan >email: admin(a)taiwanmedialtd.com >address: Kizilelma Caddesi No >address: Findikzade >city: Istanbul > >Funny, we have seen that also before. > >Bye, >Raymond. >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > The postal code would be correct, if it was on land, but for the on the docks (and this is a boat slip), the proper postal code is 1013JT. Also, there are two variants of the Istanbul address, one has just "No" at the end, the other is "No. 62" - It is actually a rug shop in the bazaar. The "really" old registrations used taiwantelco. com as the email domain and dnst. net for name service. (I have found over a hundred, before I started using other people's data - from Joe Wein's, Bill Stearns' and a few other peoples collected and published lists I've found a few hundred more.) My favorite's are still the ones which use the address from the Beverley Hills 90210 TV show (mostly a couple of months ago). The most recent Turkish address, Pakistani telephone number, and email they are using is (Note: there is a bazaar at Oguzhan Caddesi No. 1 that fills the entire block - this address does not exist, but the telephone is a valid mobile phone registered in Pakistan and the email is functional): Gulhan Ozgur Oguzhan Caddesi No:2 Kat: 2 Denizli TR-20100 TR +9.2582411726 magicgoodman(a)yahoo.com Paul Shupak track(a)plectere.com

2 1

RE: [SURBL-Discuss] yet another joe job
by Chris Santerre 17 May '05

17 May '05

>-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Monday, May 16, 2005 11:32 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] yet another joe job > > > >Please list the following domains: > >dnbfbsqs.com SPAMMER >ghtnsecn.com SPAMMER >rumbumbale.com SPAMMER >tnashbsv.com SPAMMER >turuntale.com SPAMMER All but one were already in uribl.com. I added the other ;) Keep up the good fight Steven! --Chris

4 7

RE: [SURBL-Discuss] German spam crap
by Smith, Eric 17 May '05

17 May '05

Excellent thank you. I wasn't sure if the actual sites they were linking were involved. /E. -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Raymond Dijkxhoorn Sent: Monday, May 16, 2005 11:25 AM To: SURBL Discussion list Subject: RE: [SURBL-Discuss] German spam crap Hi! > So I saw the rule, but will any of the links in most of the messages be > added to SURBL? It's my understanding this is virus related coming > sometimes from internal hosts infected with a new class of virus that will > turn the infected PC into a spam host. We do filter internal mail for spam > also so I thought I would check if the links in these messages will > eventually make it to SURBL. No, since the sites itself didnt do the spamrums, but were just abused also. And no, thats not SURBL material... >> http://mailscanner.prolocation.net/german.cf >> >> Ruleset to stop the Sober crap thats been going around like crazy >> currently. The political spams written in german language... >> >> Hopefully it will help some people to stop this crap. So get the ruleset if you wanna filter those. Bye, Raymond. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

German spam crap
by Raymond Dijkxhoorn 17 May '05

17 May '05

Hi! Its mentioned on the SA list also, but since we got some questions about it from other people who didnt read it there: http://mailscanner.prolocation.net/german.cf Ruleset to stop the Sober crap thats been going around like crazy currently. The political spams written in german language... Hopefully it will help some people to stop this crap. Bye, Raymond.

3 2

Re: MORE (was: Re: [SURBL-Discuss] yet another joe job)
by List Mail User 17 May '05

17 May '05

>> >> >> >-----Original Message----- >> >From: Steven Champeon [mailto:schampeo@hesketh.com] >> >Sent: Monday, May 16, 2005 11:32 AM >> >To: discuss(a)lists.surbl.org >> >Subject: [SURBL-Discuss] yet another joe job >> > >> > >> > >> >Please list the following domains: >> > >> >dnbfbsqs.com SPAMMER >> >ghtnsecn.com SPAMMER >> >rumbumbale.com SPAMMER >> >tnashbsv.com SPAMMER >> >turuntale.com SPAMMER >> >> All but one were already in uribl.com. I added the other ;) >> >> Keep up the good fight Steven! > >Can't really help not ;) > >More domains just came in today: > >aupd.com >bnik.com >c5t.net >d3w.net >da9.net >ei7.net >el9.net >f5s.net >g3r.net >h64.net >l73.net >lzac.com >mq5.net >myyv.com >nf0.net >nlav.com >pi11.com >pq4.net >pqer.com >przc.com >rgry.com >t6i.net >uosb.com >vf9.net >viags.com >wlue.com >xi4.net >yi4.net >ymil.com > >Looks like a completely different spammer. :( > >All DNS provided by: > >nserver: ns1.dnsm.net 218.7.120.70 >nserver: ns2.dnsm.net 218.7.120.70 > >And all domains registered to: > >owner: Roelf Van der Brug >email: admin(a)taiwanmedialtd.com >address: Singel 2 >address: Jordaan >city: Amsterdam >state: -- >postal-code: 1015JT >country: NL >phone: +31 84 220 2586 >admin-c: admin(a)taiwanmedialtd.com#0 >tech-c: admin(a)taiwanmedialtd.com#0 >billing-c: admin(a)taiwanmedialtd.com#0 >nserver: ns1.dnsm.net 218.7.120.70 >nserver: ns2.dnsm.net 218.7.120.70 >created: 2005-04-21 14:11:39 UTC >modified: 2005-05-09 10:20:38 UTC >expires: 2006-04-21 10:11:39 UTC > >-- >hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com >join us! http://hesketh.com/about/careers/account_manager.html join us! >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > All taiwantelco/taiwanmedialtd - also uses addresses in Turkey and telephone numbers in Pakistan. Look at the domain dnst. net for some historic data. Many new domains are registered on a "Bay Drive" in Beverley Hills - zipcodes 90210 and 90211 (no such street exists, except on the TV show, it did) and some in New York and a few other places. There is some relationship, maybe shared customers. Some of their sites are hosted on the same machines as the multitrade group machines (see the spamhaus records on both). BTW. The 2 Singel address is a boat slip with no tenant (also the proper postal code for the boat docks is 1013, not 1015). They just switched registrars after Joker marked almost all of their domains as "invalid address". See 900mg. com, aekb. com, b7x. com, cpko. com, dgko. com, and about a hundred more. Paul Shupak track(a)plectere.com

1 0

yet another joe job
by Steven Champeon 16 May '05

16 May '05

Please list the following domains: dnbfbsqs.com SPAMMER ghtnsecn.com SPAMMER rumbumbale.com SPAMMER tnashbsv.com SPAMMER turuntale.com SPAMMER webstandards.org is being joe'd by the same spammer again: Zhamelgo, Alexandr aazhago(a)yahoo.com Profsoyuznaya 25-1, 31 Moscow, MSK 117418 RU +7.0956995731 Fax:+61.294750668 His nameservers for the domains are: DOG.CCPATONCEJK.BIZ 202.99.172.145 TSURT.CCPATONCEJK.BIZ 200.149.11.62 Thanks, Steve -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us! http://hesketh.com/about/careers/account_manager.html join us!

1 0

RE: [SURBL-Discuss] German spam crap
by Smith, Eric 16 May '05

16 May '05

So I saw the rule, but will any of the links in most of the messages be added to SURBL? It's my understanding this is virus related coming sometimes from internal hosts infected with a new class of virus that will turn the infected PC into a spam host. We do filter internal mail for spam also so I thought I would check if the links in these messages will eventually make it to SURBL. /E. -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Kevin A. McGrail Sent: Sunday, May 15, 2005 1:06 PM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] German spam crap Thanks Raymond. I was wondering about that. It's been hammering a ton of my mailing list subscriptions including sourceforge! > Its mentioned on the SA list also, but since we got some questions about > it from other people who didnt read it there: > > http://mailscanner.prolocation.net/german.cf > > Ruleset to stop the Sober crap thats been going around like crazy > currently. The political spams written in german language... > > Hopefully it will help some people to stop this crap. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss