Discuss

discuss@lists.surbl.org

1862 discussions

RE: [SURBL-Discuss] Improved name server status page
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 7:44 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] Improved name server status page > > >I've set up a better SURBL name server status page at: > > http://www.surbl.org/nameservers-output.html > >which is also linked from the main page. > >It shows some latency in zone file propagation, and it also >shows one of the name servers down. (Bjorn is that coming >back eventually?) > >We may want to ask all the public name servers to rsync >every 10 minutes.... Would that be OK Raymond? > >Currently I have the DNS timeout set to 10 seconds with two >retries. What kind of values are more typical or standard >for resolvers? > >I will use the scripts that generate the page to send >notifications (probably to myself at first) once things >stabilize. Since events don't happen very often, it's >probably not necessary to show a history on the page. > >Comments? > That is very cool! However do you think it is wise to make public the IP's of the servers? --Chris (Paranoid little monkey.)

3 3

FP on WS: fortunecity.com
by Jeff Chan 25 Aug '04

25 Aug '04

Got a report about fortunecity.com being an FP on WS. Looks mostly legit with some abuse but with a responsive abuse department. Whitelisting. WS folks please remove it.... Jeff C.

1 0

Re: [SURBL-Discuss] Fw: Your August eNewsletter from U.S. Bank
by Bill Landry 25 Aug '04

25 Aug '04

----- Original Message ----- From: "Jeff Chan" <jeffc(a)surbl.org> To: "Bill Landry" <billl(a)pointshare.com> Sent: Tuesday, August 24, 2004 5:28 PM Subject: Re: [SURBL-Discuss] Fw: Your August eNewsletter from U.S. Bank > Hi Bill, > Can you forward it to me dierctly? Oh, an one other key component as part of my test, I didn't actually receive the newsletter that I forwarded to you until after I logged onto my US Bank online account and subscribed it on the official US Bank web site. Don't know what else I can do to prove this one...? Bill

2 1

Re: spamvertised domains
by Jeff Chan 25 Aug '04

25 Aug '04

On Tuesday, August 24, 2004, 10:07:16 AM, spamfighter spamfighter wrote: > www.spamfighter.org > In the Download sections. Would any of those lists be appropriate for use in a SURBL? How often are they updated? What are the actual data sources? Are the records expired or do the files grow indefinitely? Jeff C. __ > ----- Original Message ----- > From: "SA" <rlfrank+sa(a)paradigm-omega.com> > To: "SpamAssassin Users" <users(a)spamassassin.apache.org> > Sent: Tuesday, August 24, 2004 11:56 AM > Subject: spamvertised domains >> Anyone know where there is a list (preferably plain text) of >> spamvertised domains. I want to compare the efficiency of blocking them >> using postfix body_checks vs SURBL. >> -- >> Robin Lynn Frank >> Director of Operations >> Paradigm-Omega, LLC >> Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

RE: [SURBL-Discuss] WS & DS FP?
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Bill Landry [mailto:billl@pointshare.com] >Sent: Tuesday, August 24, 2004 11:39 AM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] WS & DS FP? > > >----- Original Message ----- >From: "Chris Santerre" <csanterre(a)merchantsoverseas.com> > >> I agree. But the legit companies were spamming. That was >what I was trying >> to say, although poorly :) Some of the NANAS posts have >legit companies in >> them, but are spam. Most likely they paid a company to >market them. Or >they >> tried there hand at doing it themselves and purchased a >list. This looks >> like the main focus of yesmail/clickaction. A mass email marketing >company. >> SO they will get legit companies to pay them to >advertise/spam for them. >> >> They are a spammer for hier. I don't see them in ANY legit >mail other then >> this one single run with itworld. And that is because of a >seminar on how >to >> use email for mass marketing! I may get overruled on this >one, but I'm >> sticking to my guns that they are spammers. > >The IT World newsletter link to clickaction had nothing to do >with a mass >marketing seminar. If you review my original post again, you >will see that >it was used for a very legitimate purpose, to allow users that >have problems >viewing their IT World newsletter subscription in HTML format >to be able to >change it to a text based format - that was it, pure and simple. > >There are lots of other ways to block clickaction if people >feel that that >is necessary, however, since there are obviously very >legitimate uses for >clickaction services by very legitimate companies, I do not feel that >listing them in any of the SURBL is appropriate. My vote is >to keep them >whitelisted for now. > So once again, a spammer gets 1-2 legit companies to use them, and they get removed from all RBLs? If that is how we are going to operate, we might as well shutdown now. Game over. "obviously very legitimate uses for clickaction services" SO itworld wanted to reduce there own traffic and have this legit bulk done by a "Legit commercial email marketer". Well they picked the wrong one. This isn't the first time we have seen this and it won't be the last. The PROPER thing to do is inform itworld of the history of the marketer they are dealing with. Whitelist? No way in hell. Temp remove, sure go ahead, but they are just going to get submitted again. Then what? Why not local whitelist then for your site? I'm starting to sound like the crazy SPAM-L locals :) BUt I'm tired of having this one single argument every week. Spammer who gets legit businesses to sign up....we need to deal with this now. Otherwise, like I said, game over. --Chris (Antispam nut!)

4 3

RE: [SURBL-Discuss] FP in WS & DS?
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Bill Landry [mailto:billl@pointshare.com] >Sent: Tuesday, August 24, 2004 2:28 PM >To: SURBL Discussion list >Subject: [SURBL-Discuss] FP in WS & DS? > > >This is from a US Bank newsletter, and I have confirmed via >whois that US >Bank does own the domain in question: > > usbank-email.MUNGEDcom > >The sending IP address is not listed in any RBL/RHSBLs: > > http://www.dnsstuff.com/tools/ip4r.ch?ip=192.168.40.122 > >Looks like a legitimate, subscription based, US Bank newsletter. > >Bill We aren't seeing eye to eye today bill :) 207.189.106.22 not the reserved IP you listed. I see it as 4at1.com who is also: 00123.com 1nc002.com 1nc012.com 1nc022.com 4at1.com 4at2.com 4at2.net 4at5.net #Once ONCE (NET-207-189-106-0-1) 207.189.106.0 - 207.189.106.255 Empire Communications FORTIX-NET (NET-207-189-96-0-1) 207.189.96.0 - 207.189.127.255 Registrant: #once.com (4AT3-DOM) 309 SW Sixth Avenue, Suite 900 Portland, OR 97204 US Domain Name: 4AT1.COM Administrative Contact: #once.com (DB3242-ORG) billing#ONCE.COM 309 SW 6TH AVE STE 900 PORTLAND, OR 97204-1765 US 503-241-4185 fax: 503-241-4279 Technical Contact: #Once.com (AS3215-ORG) sysadmin#ONCE.COM 309 SW Sixth Avenue Suite 900 PORTLAND, OR 97204 US 5032414185 fax: 5032414279 Record expires on 28-Dec-2006. Record created on 28-Dec-1999. Database last updated on 24-Aug-2004 14:46:25 EDT. Domain servers in listed order: NS.ONCE.COM 207.189.106.105 NS2.ONCE.COM 207.189.106.108 NS3.ONCE.COM 207.162.212.83 --Chris

5 6

sc.surbl.org FP
by Brett Cove 25 Aug '04

25 Aug '04

citizensbankMUNGED.com Was likely listed due to it being a phish target. -Brett

2 1

RE: [SURBL-Discuss] FP in WS & DS?
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: Bill Landry [mailto:billl@pointshare.com] >Sent: Tuesday, August 24, 2004 3:06 PM >To: 'SURBL Discussion list' >Subject: Re: [SURBL-Discuss] FP in WS & DS? > > >----- Original Message ----- >From: "Chris Santerre" <csanterre(a)merchantsoverseas.com> > >> >This is from a US Bank newsletter, and I have confirmed via >> >whois that US >> >Bank does own the domain in question: >> > >> > usbank-email.MUNGEDcom >> > >> >The sending IP address is not listed in any RBL/RHSBLs: >> > >> > http://www.dnsstuff.com/tools/ip4r.ch?ip=192.168.40.122 >> > >> >Looks like a legitimate, subscription based, US Bank newsletter. >> >> We aren't seeing eye to eye today bill :) >> >> 207.189.106.22 not the reserved IP you listed. > >Yep, I corrected that in my last e-mail. > >> I see it as 4at1.com who is also: >> >> 00123.com >> 1nc002.com >> 1nc012.com >> 1nc022.com >> 4at1.com >> 4at2.com >> 4at2.net >> 4at5.net >> >> #Once ONCE (NET-207-189-106-0-1) >> 207.189.106.0 - 207.189.106.255 >> Empire Communications FORTIX-NET (NET-207-189-96-0-1) >> 207.189.96.0 - 207.189.127.255 > >Why would it matter who assigned US Bank the address space, or >who else they >assigned address space to? The IP address US Bank is using in >not listed in >any RBL/RHSBLs, and the bottom line is that the newsletter, >and the company >distributing it, are quite obviously both legitimate. What >else matters...? > Nope completely forget everything I posted. I was clearly off my rocker on that one! I entered the wrong data into my search and it spooled into the cluster Fsck I posted :) I'm taking steps to make sure that doesn't happen again today. (Translate: I'm pouring a cup of coffee!) This is what I get for doing 35 things at once and having 3 instances of firefow open with 10 tabs open in each of those! Now, where are my car keys?! --Chris

1 0

FP in WS & DS?
by Bill Landry 24 Aug '04

24 Aug '04

This is from a US Bank newsletter, and I have confirmed via whois that US Bank does own the domain in question: usbank-email.MUNGEDcom The sending IP address is not listed in any RBL/RHSBLs: http://www.dnsstuff.com/tools/ip4r.ch?ip=192.168.40.122 Looks like a legitimate, subscription based, US Bank newsletter. Bill

2 2

RE: [SURBL-Discuss] WS & DS FP?
by Chris Santerre 24 Aug '04

24 Aug '04

>-----Original Message----- >From: Chris Santerre [mailto:csanterre@merchantsoverseas.com] >Sent: Tuesday, August 24, 2004 12:06 PM >To: 'SURBL Discussion list' >Subject: RE: [SURBL-Discuss] WS & DS FP? > > > > >>-----Original Message----- >>From: Bill Landry [mailto:billl@pointshare.com] >>Sent: Tuesday, August 24, 2004 11:39 AM >>To: 'SURBL Discussion list' >>Subject: Re: [SURBL-Discuss] WS & DS FP? >> >> >>----- Original Message ----- >>From: "Chris Santerre" <csanterre(a)merchantsoverseas.com> >> >>> I agree. But the legit companies were spamming. That was >>what I was trying >>> to say, although poorly :) Some of the NANAS posts have >>legit companies in >>> them, but are spam. Most likely they paid a company to >>market them. Or >>they >>> tried there hand at doing it themselves and purchased a >>list. This looks >>> like the main focus of yesmail/clickaction. A mass email marketing >>company. >>> SO they will get legit companies to pay them to >>advertise/spam for them. >>> >>> They are a spammer for hier. I don't see them in ANY legit >>mail other then >>> this one single run with itworld. And that is because of a >>seminar on how >>to >>> use email for mass marketing! I may get overruled on this >>one, but I'm >>> sticking to my guns that they are spammers. >> >>The IT World newsletter link to clickaction had nothing to do >>with a mass >>marketing seminar. If you review my original post again, you >>will see that >>it was used for a very legitimate purpose, to allow users that >>have problems >>viewing their IT World newsletter subscription in HTML format >>to be able to >>change it to a text based format - that was it, pure and simple. >> >>There are lots of other ways to block clickaction if people >>feel that that >>is necessary, however, since there are obviously very >>legitimate uses for >>clickaction services by very legitimate companies, I do not feel that >>listing them in any of the SURBL is appropriate. My vote is >>to keep them >>whitelisted for now. >> > >So once again, a spammer gets 1-2 legit companies to use them, >and they get >removed from all RBLs? If that is how we are going to operate, >we might as >well shutdown now. Game over. > >"obviously very legitimate uses for clickaction services" > >SO itworld wanted to reduce there own traffic and have this >legit bulk done >by a "Legit commercial email marketer". Well they picked the >wrong one. This >isn't the first time we have seen this and it won't be the last. > >The PROPER thing to do is inform itworld of the history of the >marketer they >are dealing with. > >Whitelist? No way in hell. Temp remove, sure go ahead, but >they are just >going to get submitted again. Then what? Why not local >whitelist then for >your site? > >I'm starting to sound like the crazy SPAM-L locals :) BUt I'm tired of >having this one single argument every week. Spammer who gets legit >businesses to sign up....we need to deal with this now. >Otherwise, like I >said, game over. > >--Chris (Antispam nut!) More info: http://www.badads.org/january02.shtml They have been providing email support for itworld since 2001! Maybe itworld needs a clue! http://emailuniverse.com/list-news/?id=298 --Chris (Still digging.)

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss