Discuss

discuss@lists.surbl.org

1862 discussions

Lots of new questionable URL redirectors
by William Stearns 27 Sep '06

27 Sep '06

Good evening, all, I'm seeing a _lot_ of URL redirection sites I've never seen before: shorten.in, registered Aug 20, 2006 (http://shorten.in/194 -> prosperityautomatedsystem.com) simurl.com (http://simurl.com/ss-nn-uu -> julesent4.info -> prosperityautomatedsystem.com) qdeo.com (http://qdeo.com/53 -> julesent4.info -> prosperityautomatedsystem.com) kuturl.com (http://kuturl.com/x.php?za -> 404) This last one now shows: Because of the actions of a SPAMMER - we have withdrawn this service. So, apologies to all of you who genuinely used our free service. You can blame the scum who ruined it for everyone else. We try hard to help others, while some are determined to prove themselves as lower than amoeba crap. Many of the URLs redirect to www.prosperityautomatedsystem.com. Try submitting a URL to these; you'll see the number returned is very low, indicating these are either fake redirectors or rarely used. Thoughts? Opinions? Strawberry-banana smoothies? ;-) Cheers, - Bill --------------------------------------------------------------------------- I are sigfile disease!! All your quote are belong to us. Copy us every "sig"! (Courtesy of Charlie Stross, on an lwn.net letter) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

3 2

Re: Redirection URLs
by opencomputing＠gmail.com 24 Sep '06

24 Sep '06

>Date: Sun, 24 Sep 2006 02:07:25 -0400 >From: Eric Montr?al <erv(a)mailpeers.net> >Subject: Re: [SURBL-Discuss] Redirection URLs >To: SURBL Discussion list <discuss(a)lists.surbl.org> >Message-ID: <4516209D.6000500(a)mailpeers.net> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > >A year ago, when the Geocities problem was much bigger, I made a simple >analysis tool. > >I don't maintain it anymore, and data is partial, however, it shows that >the javascript >encoding used is nearly always very basic and easy to decode: > >http://nospam.mailpeers.net/alive_spammy2.txt > > Did you check every geocities et al link in your spam mails and add them to this list? You must've been angry to blast the spammers outta the earth!!! I just love that spirit. Thanks for the links. >Most of the listed sites appeared in spams long time ago and were not >removed by >Geocities. > >The original site http://nospam.mailpeers.net/ contains .cf rules, but >except for the generic >ones it's not useful anymore, mostly since Yahoo / Geocities finally >decided to do the right >thing and block the new spam sites and I don't actively search geocities >spamvertized links >anymore. > > Are the rules listed like subevil, alive_spammy(2), rip_spammy, alive_spammy_malware all kept updated? Even if not, I guess they shouldn't give FPs? cheers, skar. -- OpenProtect - The email virus/spam filter http://openprotect.com

1 0

Redirection URLs
by opencomputing＠gmail.com 24 Sep '06

24 Sep '06

Hi, I'm receiving lots of spam with URLs like the one below: http://geocities.com/wihim2968 The above URL in fact redirects a blacklisted domain j99k.com. Is there a plan to add the redirected original URL also to the blacklists? Or blacklist URL redirection services(at least in a different list like AG-aggressive) which don't check the target URL in blacklists? Or should I look up the real target of the URL and look it up too? But this would lead to latencies of around 10-20 seconds depending on a 3rd party web server like geocities in the above example :( cheers, skar. -- OpenProtect - The email virus/spam filter http://openprotect.com

3 2

RE: [SURBL-Discuss] Possible FP interweave...
by Chris Santerre 20 Sep '06

20 Sep '06

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Wednesday, September 20, 2006 11:27 AM > To: Chris Santerre > Cc: SURBL Discussion List (E-mail) > Subject: Re: [SURBL-Discuss] Possible FP interweave... > > > On Wednesday, September 20, 2006, 8:02:05 AM, Chris Santerre wrote: > > 2.0 URIBL_WS_SURBL Contains an URL listed in the > WS SURBL blocklist > > [URIs: interweave.com] > > 3.9 URIBL_SC_SURBL Contains an URL listed in the > SC SURBL blocklist > > [URIs: interweave.com] > > > *might* be an FP. We do business with them. I can't find > much in NANAS. And > > the IP 63.79.28.36 comes up clean. > > I'm not seeing it blacklisted. Is someone running an old version > of SpamAssassin with the DNS bug? SpamAssassin version 3.0.0 --Chris

2 1

Possible FP interweave...
by Chris Santerre 20 Sep '06

20 Sep '06

2.0 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: interweave.com] 3.9 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist [URIs: interweave.com] *might* be an FP. We do business with them. I can't find much in NANAS. And the IP 63.79.28.36 comes up clean. Thanks, Chris Santerre SysAdmin and Spamfighter www.rulesemporium.com www.uribl.com

2 1

[ob] FP?? worklifereward.com-M
by List Mail User 20 Sep '06

20 Sep '06

Hi, This looks like an FP - worklifereward.com-M is owned by Office Depot and is in several URLs in this week's email "flyer". Of course, they have also switched ESPs to postfuture.com-M (Yes, the same) and are mailing from an IP in multiple BLs (64.5.35.226 is currently listed at BLARS, FIVETEN, PSBL, SpamCop and on SPEWS Level 2; Both the PSBL and SpamCop have "reasonable" delisting requirements, so there is trouble). Paul Shupak track(a)plectere.com

2 1

FP: minilien.com
by John Wilcock 15 Sep '06

15 Sep '06

Just spotted this one, on both black.uribl.com and ab.surbl.org - it's a very widely used French-language URL-shortening service. I'd say this is a definite FP. I can see people getting confused about whether minilien are really white hat, given that it now redirects to a page on the unfortunately-named digipills.com - but AFAICT this is also a genuine domain originally created by a medical student and offering free hosting for genuine medically-related content. John. -- -- Over 3000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr

4 10

Re: [SURBL-Discuss] hotlog.ru?
by List Mail User 14 Sep '06

14 Sep '06

I don't know about any "keystroke logger", but hit13.hotlog.ru-M and click.hotlog.ru-M are the pages used to count "hits" for send-safe.com - There is an open SBL for that alone. Definately "spam support" services. Paul Shupak track(a)plectere.com

1 0

RE: [SURBL-Discuss] FP: minilien.com
by Chris Santerre 14 Sep '06

14 Sep '06

I had delisted them until I saw this post. I like Christians train of thought. I know he has contacted them. Based on what they do, I'll either leave it listed or remove. --Chris > -----Original Message----- > From: Christian Stigen Larsen [mailto:csl@sublevel3.org] > Sent: Wednesday, September 13, 2006 9:32 AM > To: SURBL Discussion list > Cc: uribl-discuss(a)lists.maddoc.net > Subject: Re: [SURBL-Discuss] FP: minilien.com > > > > Den 13. sep. 2006 kl. 15.07 skrev John Wilcock: > > Just spotted this one, on both black.uribl.com and ab.surbl.org - > > it's a very widely used French-language URL-shortening service. > > > > I'd say this is a definite FP. > > But then again, if spam email uses minilien.com for > masquerading evil > redirects, then > it's the site owner's problem. There is an explicit coverage > on this > topic on the > SURBL.org site. > > Redirection services such as tinyurl.com and (my own) memurl.com > looks up if the > destination hosts are blocklisted, and so should minilien.com > > If we regard this one as a false positive, then it's free access for > spammail that > uses the minilien service. > > I suggest we notify the site owner and let him act accordingly. > > -- > Christian Stigen Larsen, http://csl.sublevel3.org > > > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss >

1 0

hotlog.ru?
by MRSCAPTGATOR＠aol.com 14 Sep '06

14 Sep '06

Hey Jeff, did you ever find out what that hotlog.ru was? I believe it may be like a worm were all keystrokes web pages ect. are logged. What do you think? I have reason to believe this! Cin [SURBL-Discuss] hotlog.ru? Jeff Chan _jeffc at surbl.org _ (mailto:discuss@lists.surbl.org?Subject=[SURBL-Discuss]%20hotlog.ru?&In-Reply-To=) Mon Aug 8 06:53:00 CEST 2005 * Previous message: _[SURBL-Discuss] Why you should check Phish IPs first :/ _ (http://lists.surbl.org/pipermail/discuss/2005-August/004973.html) * Next message: _[SURBL-Discuss] XS inclusion into multi _ (http://lists.surbl.org/pipermail/discuss/2005-August/004978.html) * Messages sorted by: _[ date ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/date.html#4977) _[ thread ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/thread.html#4977) _[ subject ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/subject.html#4977) _[ author ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/author.html#4977) ____________________________________ hotlog.ru and some subdomains appeared in the SURBL data yesterday, but the site is also ranked about 25k on Alexa so it seems to be a fairly popular site. A couple readers of Russian took a look at the site and determined it's some kind of web log analysis tool vendor, but could not easily say if it had legitimate uses. Is anyone here familiar with them? In particular might they have legitimate uses? It's been around since 2000: domain: HOTLOG.RU type: CORPORATE nserver: ank.ank.ru. nserver: ns.wplus.net. nserver: ns1.wplus.net. state: REGISTERED, DELEGATED person: ANDREW N KUZMIN phone: +7 812 5963532 fax-no: +7 812 5963532 e-mail: _ank at ank.ru_ (http://lists.surbl.org/mailman/listinfo/discuss) registrar: RUCENTER-REG-RIPN created: 2000.11.29 paid-till: 2005.11.30 source: TC-RIPN Jeff C. -- Don't harm innocent bystanders. ____________________________________ * Previous message: _[SURBL-Discuss] Why you should check Phish IPs first :/ _ (http://lists.surbl.org/pipermail/discuss/2005-August/004973.html) * Next message: _[SURBL-Discuss] XS inclusion into multi _ (http://lists.surbl.org/pipermail/discuss/2005-August/004978.html) * Messages sorted by: _[ date ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/date.html#4977) _[ thread ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/thread.html#4977) _[ subject ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/subject.html#4977) _[ author ]_ (http://lists.surbl.org/pipermail/discuss/2005-August/author.html#4977) ____________________________________ _More information about the Discuss mailing list_ (http://lists.surbl.org/mailman/listinfo/discuss)

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss