Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

RE: [SURBL-Discuss] Blogger attacks SURBL
by Chris Santerre 03 Jun '05

03 Jun '05

>-----Original Message----- >From: Michele Neylon :: Blacknight Solutions >[mailto:michele@blacknight.ie] >Sent: Tuesday, May 31, 2005 5:05 AM >To: 'Jeff Chan'; 'SURBL Discussion list'; 'SpamAssassin Users' >Subject: RE: [SURBL-Discuss] Blogger attacks SURBL > > >discuss-bounces(a)lists.surbl.org wrote: >> Pardon the dramatic title, but hopefully it got your attention. >> >> This guy's domain got listed by Outblaze, we removed it, and >> as thanks this guy paints us as irresponsible. Please help >> us straighten him out, gently: >> >> http://blog.holtz.com/index.php/weblog/comments/blacklisting_blogs/ >> >> I gave it my shot. >> >> Jeff C. > >I love the way his blogging software leaves the email >addresses "naked" > >Mr Michele Neylon Actually they are encrypted in the web code, but decrypted for human readers. To me, thats about as secure as locking the door but leaving the windows open. --Chris

1 0

RE: [SURBL-Discuss] PayPal Joe-job
by Chris Santerre 03 Jun '05

03 Jun '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, June 01, 2005 7:57 PM >To: Joe Wein >Cc: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] PayPal Joe-job > > >On Wednesday, June 1, 2005, 8:19:20 AM, Joe Wein wrote: >> Since I list a lot of fake company domains in >money-forwarding scams on my >> website (a data source of JP on multi.surbl.org), I seem to >have offended a >> few people. > >> Yesterday someone made 4 PayPal payments to my account, two >from the US, one >> from France and one from Australia. PayPal caught it or was >alerted and >> reversed all transfers, as well as suspending my account pending >> investigation. > >Hmm, I just got a paypal donation (first in months it seems) from >someone who has apparently never posted to any of the many spam >lists I'm on. Should I be concerned? Only if the amount ended in .37 cents :) --Chris

1 0

Strange Bounce [Was: Undelivered Mail Returned to Sender]
by Martin G. Diehl 03 Jun '05

03 Jun '05

Why would someone (for example, mailto:nico.prenzel@pn-systeme.de ) signup to an eMail list ... and then require authentication? Just curious ... IMO, if you don't want eMail, don't signup to an active eMail list. -------- Message With Full Headers -------- From: - Tue May 31 07:28:42 2005 X-UIDL: 1117523571.M110438P38333.mx6.oct X-Mozilla-Status: 0001 X-Mozilla-Status2: 10000000 Return-Path: <> Delivered-To: mdiehl(a)nac.net Received: (qmail 38071 invoked by uid 0); 31 May 2005 07:12:36 -0000 Received: from 81.169.145.166 by mx6.oct (envelope-from <>, uid 0) with qmail-scanner-1.25 (clamuko: 0.72. Clear:RC:0(81.169.145.166):. Processed in 0.244881 secs); 31 May 2005 07:12:36 -0000 X-Qmail-Scanner-Mail-From: via mx6.oct X-Qmail-Scanner: 1.25 (Clear:RC:0(81.169.145.166):. Processed in 0.244881 secs) Received: from unknown (HELO natnoddy.rzone.de) (81.169.145.166) by rbl-mx6.oct.nac.net with SMTP; 31 May 2005 07:12:35 -0000 Received: from szpn0002 (p213.54.179.94.tisdip.tiscali.de [213.54.179.94]) by post.webmailer.de (8.13.1/8.13.1) with ESMTP id j4V7CXPC014589 for <mdiehl(a)nac.net>; Tue, 31 May 2005 09:12:34 +0200 (MEST) Received: by szpn0002 (Postfix) id 996CE474E0; Tue, 31 May 2005 09:05:26 +0200 (CEST) Date: Tue, 31 May 2005 09:05:26 +0200 (CEST) From: MAILER-DAEMON(a)szpn0002.pn-systeme.de (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: mdiehl(a)nac.net MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="04F23A26C6.1117523126/szpn0002" Message-Id: <20050531070526.996CE474E0@szpn0002> X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on spamd2.oct X-Spam-Level: *** X-Spam-PrefsFile: nac.net/mdiehl X-Spam-Status: No, score=3.6 required=4.7 tests=RAZOR2_CF_RANGE_51_100, RAZOR2_CHECK autolearn=disabled version=3.0.2 Subject: Undelivered Mail Returned to Sender Date: Tue, 31 May 2005 09:05:26 +0200 (CEST) From: MAILER-DAEMON(a)szpn0002.pn-systeme.de (Mail Delivery System) To: mdiehl(a)nac.net This is the Postfix program at host szpn0002. I'm sorry to have to inform you that your message could not be be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program <nico.prenzel(a)pn-systeme.de>: host 192.168.101.1[192.168.101.1] said: 530 Authentication required (in reply to MAIL FROM command) Reporting-MTA: dns; szpn0002 X-Postfix-Queue-ID: 04F23A26C6 X-Postfix-Sender: rfc822; mdiehl(a)nac.net Arrival-Date: Tue, 31 May 2005 07:59:06 +0200 (CEST) Final-Recipient: rfc822; nico.prenzel(a)pn-systeme.de Action: failed Status: 5.0.0 Diagnostic-Code: X-Postfix; host 192.168.101.1[192.168.101.1] said: 530 Authentication required (in reply to MAIL FROM command) Subject: Re: Blogger attacks SURBL From: "Martin G. Diehl" <mdiehl(a)nac.net> Date: Tue, 31 May 2005 02:02:20 -0400 To: Jeff Chan <jeffc(a)surbl.org> CC: SURBL Discuss <discuss(a)lists.surbl.org>, SpamAssassin Users <users(a)spamassassin.apache.org> Jeff Chan wrote: > Pardon the dramatic title, but hopefully it got your attention. > > This guy's domain got listed by Outblaze, we removed it, and as > thanks this guy paints us as irresponsible. Please help us > straighten him out, gently: > > http://blog.holtz.com/index.php/weblog/comments/blacklisting_blogs/ > > I gave it my shot. > > Jeff C. > -- > Don't harm innocent bystanders. The way I read his response is that he stands against SPAM and in favor of anti SPAM measures ... *provided* he is not inconvenienced. -- Martin

1 0

20050602 embedded image spam
by Sean Sowell 03 Jun '05

03 Jun '05

Hello SURBL folks --- Thank you so much for adding the last batch of submissions! Awesome! Reduced false negatives from those domains by more than half. Is it ok to submit a fresh list for consideration every couple of days? If so, feel free to make use of the domains below. If not, please disregard them or let me know a better way to do this. Am rather new at this SpamAssassin thing; that's how I discovered the SURBLs. I'm also trying to figure out how SA's "HTML_IMAGE_ONLY..." and "HTML_IMAGE_RATIO..." rules work and why much of this spam doesn't trip those sensors. Am reading up on pyzor/razor, dcc, and the njabl lists as well. Not sure yet if my host will let me install them. Kind regards, Sean S. PS: I keep .eml and .pdf copies of each of these. If you need any, let me know. ===== Tue, 31 May 2005 13:55:48 -0700 bondedselecterse.com and webnetworkers.com and mediagroup.com Tue, 31 May 2005 21:07:02 GMT kyouk.com and memolink.com and inthewildblueyonder.com Tue, 31 May 2005 21:48:17 GMT pbarn.com Tue, 31 May 2005 14:52:35 -0700 fantastickernest.com and mediagroup.com Tue, 31 May 2005 23:23:04 GMT luvbj.com Wed, 1 Jun 2005 03:57:03 +0400 (MSD) goste.biz Tue, 31 May 2005 15:08:41 -0700 clearcutsavings.com and clearcutsav.com Tue, 31 May 2005 17:58:08 -0700 saverzforyou2.info Tue, 31 May 2005 21:02:27 -0700 trustyingyanglearn.com and price-savers.com and mediagroup.com Tue, 31 May 2005 23:53:06 -0700 saverzforyou2.info Wed, 01 Jun 2005 08:33:06 -0700 moringleaderboard.com and price-savers.com and mediagroup.com Wed, 01 Jun 2005 09:27:13 -0700 cellotracketchupps.com and consumerincentivepromotions.com and mediagroup.com Wed, 01 Jun 2005 20:49:01 GMT allgt.com and athleticprowess.com Wed, 01 Jun 2005 21:19:35 GMT netderby.com and savingsderby.com Wed, 01 Jun 2005 21:49:32 GMT mywapdealer.com and mydealdetective.com Wed, 01 Jun 2005 16:57:38 -0500 en34.com and winfreestuff.com Wed, 01 Jun 2005 22:54:09 GMT bijue.com and balancebucks.com Wed, 1 Jun 2005 11:50:32 -0700 saverzforyou2.info Wed, 01 Jun 2005 23:24:19 GMT psdvn.com and shoptosmile.com Wed, 01 Jun 2005 21:40:45 -0400 watchesei.com Wed, 01 Jun 2005 15:10:47 -0700 clearcutsavings.com and ccs44.com Wed, 01 Jun 2005 21:05:40 -0700 tramblentiling.com and giftfox.com and mediagroup.com Wed, 01 Jun 2005 21:18:11 -0700 coolrushersheyday.com and producttestpanel.com and mediagroup.com Thu, 02 Jun 2005 00:02:56 -0700 datdir.com and localratesource.com and rocketoffers.com Thu, 02 Jun 2005 10:12:38 -0700 clearcutsavings.com and ccs44.com Thu, 02 Jun 2005 11:28:30 -0700 vestuarynoplastic.com and mediagroup.com Thu, 02 Jun 2005 20:50:01 GMT rybyn.com and technologyengagement.com Thu, 02 Jun 2005 21:20:02 GMT k-rea.com and loanonme.com Thu, 02 Jun 2005 16:35:31 -0500 en34.com and winfreestuff.com Thu, 02 Jun 2005 23:25:03 GMT beank.com and connectedcircuit.com

1 0

FEC endorses selling of email addresses
by Matthew Wilson 02 Jun '05

02 Jun '05

Let's try that link again... http://chicagotribune.com/technology/chi-0505310158may31,1,5465703.story > "Draft rules from the Federal Election Commission, which enforces > campaign finance laws, would require that paid political > advertisements > on the Internet declare who funded the ad, as television spots do. > Similar disclaimers would be placed on political Web sites, as well as > on e-mails sent to people on purchased lists containing more than 500 > addresses."

1 0

FEC endorses selling of email addresses
by Matthew Wilson 02 Jun '05

02 Jun '05

I thought you (fellow) anti-spam folks would get a kick out of this... "Draft rules from the Federal Election Commission, which enforces campaign finance laws, would require that paid political advertisements on the Internet declare who funded the ad, as television spots do. Similar disclaimers would be placed on political Web sites, as well as on e-mails sent to people on purchased lists containing more than 500 addresses." from http://www.chicagotribune.com/technology/chi-0505310158may31,1,5465703.s tory Matthew Wilson, MCSE (2003), MCSA-Messaging Network Administrator matthew(a)boomer.com Boomer Consulting, Inc. 610 Humboldt Manhattan, KS 66502 http://www.boomer.com <http://www.boomer.com/> 1-888-266-6375 x 17

1 0

PayPal Joe-job
by Joe Wein 02 Jun '05

02 Jun '05

Since I list a lot of fake company domains in money-forwarding scams on my website (a data source of JP on multi.surbl.org), I seem to have offended a few people. Yesterday someone made 4 PayPal payments to my account, two from the US, one from France and one from Australia. PayPal caught it or was alerted and reversed all transfers, as well as suspending my account pending investigation. In the last two days I also received "fan mail" from Nigeria and South Africa regarding some anti-419 data that I publish. Just wanted to let you guys know. I take it as a sign that the scammers are feeling some pain, which is good :-) Joe Wein -- joewein.de LLC 6-30 Sumiyoshidai, Aoba-ku Yokohama, 227-0035, Japan E-Mail: joewein(a)pobox.com WWW: http://www.joewein.de

3 2

RE: [SURBL-Discuss] Re: embedded image spams
by Bjurstrom, Eric 01 Jun '05

01 Jun '05

I believe this is the second incarnation I have seen of the email, used to be a different domain. Its quite annoying as the previous one was in the various surbl lists, but due to the obfuscation was not getting flagged. -----Original Message----- From: List Mail User [mailto:track@plectere.com] Sent: Tuesday, May 31, 2005 7:28 PM To: discuss(a)lists.surbl.org Cc: track(a)plectere.com Subject: RE: [SURBL-Discuss] Re: embedded image spams thouljthou1. com - multitrade group, now omnicorporation New name and address though. Paul Shupak track(a)plectere.com _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

[way off-topic] Email Cartoon
by Kevin A. McGrail 01 Jun '05

01 Jun '05

Perhaps you've seen, perhaps you haven't but here is some SPAM humor to pass the time. Sorry if you aren't interested but as my office has taken to referring to me as a SPAM junkie, I totally related to this cartoon and thought some of the others would too. WARNING: This cartoon could be considered offensive and should not be viewed by anyone. http://www.pccc.com/downloads/junk/cool/email_cartoon.mpg <shun>flames</shun> Regards, KAM

1 0

RE: [SURBL-Discuss] Re: embedded image spams
by List Mail User 01 Jun '05

01 Jun '05

thouljthou1. com - multitrade group, now omnicorporation New name and address though. Paul Shupak track(a)plectere.com

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss