Discuss

discuss@lists.surbl.org

1862 discussions

Re: name-services.com (was: Re: [SURBL-Discuss] whitelist: accuradio.com)
by List Mail User 24 May '05

24 May '05

>... > >What about the WDRP spam apparently from them? Is that possibly >legitimate looking? > >From: "WDRP Compliance" <wdrp(a)name-services.com> >To: Domains(a)Menschel.net > >thetrueslf.com May 25, 2004 > View Contact Data: <http://wdrp.name-services.com/whois.asp?key=FC4464C8F2A> > >etc. > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > I thought I had made clear my beliefs about the "competence" of eNom's procedures and personnel:-) Anyway, this is clearly not spam, but a misdirected - yet valid communication for domain registration data checking. Clearly sent to the wrong person, but it isn't selling anything - it doesn't even link to any other page except ICANN's rules about data verification. It is downright well behaved - no links to their own services, no pleas to extend the registration period - one of the best I've seen of all that I've gotten from any registrar I've used. Just in typical fashion, they sent it to the wrong place:-) Do note that it is also typical eNom in that it functions by a "negative" option - do nothing and they say they will assume all the data is good; I suspect that this is *not* acceptable to ICANN (since if the contact data were false, the notice would likely be ignored and hence no checking actually performed) - but it fits perfectly the eNom model of let the customer be responsible for reporting and fixing all errors. Most people I've played golf with "cheat" - some knowingly, some accidentally - I long ago got used to people telling me that I should be adding penalties to my own score for "mistakes". This is sort of like the French justice system in reverse (instead of the police having to prove a defendant is innocent - let the defendant be responsible to show that he is guilty). Anyway, just go to the link - No "spam" - innocent, but incompetent. Paul Shupak track(a)plectere.com P.S. Now somebody should check if the data is actually valid for that domain; It appears that at least there i a technical violation in that the listed fax line goes unanswered during business hours! I'd even guess that Donovan Rittenbach doesn't even live there or have that telephone number anymore. He has at least two other domains at the same address and telephone number. The telephone number is unlisted (not normal for a business).

2 1

Re: Discuss Digest, Vol 14, Issue 23
by Robert Menschel 24 May '05

24 May '05

> Message: 2 > Date: Mon, 23 May 2005 09:01:36 -0700 (PDT) > From: List Mail User <track(a)Plectere.com> > Subject: name-services.com (was: Re: [SURBL-Discuss] whitelist: accuradio.com) > To: discuss(a)lists.surbl.org > Cc: jeffc(a)surbl.com, track(a)Plectere.com > Message-ID: <200505231601.j4NG1aYt025267(a)Plectere.com> > I've been watching this discussion without speaking up for > a couple of days now. the domain name-services is very popular with > spammers (they seem to be lax in throwing them off), but it has *at > least* 20x as many legitimate customers as "bad guys"; That said, I > do always double-check when I see it turn up in a domain I'm already > looking at - It is a good sign if you already have another reason for > checking a domain, but they themselves are mostly extremely clean. The > big problem is the domain is operated by eNom for others, and we all > probably are aware of the standard eNom procedure for complaints (i.e. > forward it to the spammer and ask him to "fix" it) - this makes them > look disproportionately bad. > The domain name-services.com itself doesn't belong on any SURBLs > (though it does exist within lots of Spamhaus and SPEWS records) or even > on URIBL's greylist (though maybe SPEWS should L2 them and eNom itself). > They have far, far too many legitimate customers. > Just my opinion/experience. But convincing to me. I've uploaded an update to my blacklist file, with this domain removed. Jeff -- by the same reasoning, it should be whitelisted? Bob Menschel

1 0

name-services.com (was: Re: [SURBL-Discuss] whitelist: accuradio.com)
by List Mail User 23 May '05

23 May '05

>... > >Hello Jeff, > >(sent one copy without attachment, and from not-listed address; that >copy can be deleted without forwarding to list. sorry) > >Monday, May 23, 2005, 3:00:09 AM, you wrote: > >JC> Message: 7 >JC> Date: Mon, 23 May 2005 00:57:48 -0700 >JC> From: Jeff Chan <jeffc(a)surbl.org> >JC> Subject: Re: [SURBL-Discuss] whitelist: accuradio.com >JC> To: Joseph Burford <josephb(a)gmail.com> >JC> Cc: SURBL Discussion list <discuss(a)lists.surbl.org> >JC> Message-ID: <127069243.20050523005748(a)surbl.org> >JC> Content-Type: text/plain; charset=us-ascii > >JC> On Sunday, May 22, 2005, 11:39:05 PM, Joseph Burford wrote: >>>> Since you say they're whitehats, I'll go ahead and whitelist them in >>>> SURBLs. Of minor interest one of their nameservers is on SORBS: >>>> >>>> 212.118.243.118 dns5.name-services.com >>>> >>>> http://www.sorbs.net/lookup.shtml?212.118.243.118 > >>> name-services.com is used by Register.com / Namebargain.com for their >>> customer DNS services. > >>> Regards, Hi, I've been watching this discussion without speaking up for a couple of days now. the domain name-services is very popular with spammers (they seem to be lax in throwing them off), but it has *at least* 20x as many legitimate customers as "bad guys"; That said, I do always double-check when I see it turn up in a domain I'm already looking at - It is a good sign if you already have another reason for checking a domain, but they themselves are mostly extremely clean. The big problem is the domain is operated by eNom for others, and we all probably are aware of the standard eNom procedure for complaints (i.e. forward it to the spammer and ask him to "fix" it) - this makes them look disproportionately bad. The domain name-services.com itself doesn't belong on any SURBLs (though it does exist within lots of Spamhaus and SPEWS records) or even on URIBL's greylist (though maybe SPEWS should L2 them and eNom itself). They have far, far too many legitimate customers. Just my opinion/experience. Paul Shupak track(a)plectere.com

2 1

Re: [SURBL-Discuss] whitelist: accuradio.com
by Robert Menschel 23 May '05

23 May '05

Hello Jeff, (sent one copy without attachment, and from not-listed address; that copy can be deleted without forwarding to list. sorry) Monday, May 23, 2005, 3:00:09 AM, you wrote: JC> Message: 7 JC> Date: Mon, 23 May 2005 00:57:48 -0700 JC> From: Jeff Chan <jeffc(a)surbl.org> JC> Subject: Re: [SURBL-Discuss] whitelist: accuradio.com JC> To: Joseph Burford <josephb(a)gmail.com> JC> Cc: SURBL Discussion list <discuss(a)lists.surbl.org> JC> Message-ID: <127069243.20050523005748(a)surbl.org> JC> Content-Type: text/plain; charset=us-ascii JC> On Sunday, May 22, 2005, 11:39:05 PM, Joseph Burford wrote: >>> Since you say they're whitehats, I'll go ahead and whitelist them in >>> SURBLs. Of minor interest one of their nameservers is on SORBS: >>> >>> 212.118.243.118 dns5.name-services.com >>> >>> http://www.sorbs.net/lookup.shtml?212.118.243.118 >> name-services.com is used by Register.com / Namebargain.com for their >> customer DNS services. >> Regards, >> Joseph JC> Hmm, then it probably should not be blacklisted: JC> black-rmenschel-200504:name-services.com JC> Bob Menschel, JC> Can you comment further on this listing of yours on sa-blacklist/ JC> ws.surbl.org? Spam is attached. I agree that as DNS, name-services.com shouldn't be blocked, nor as received, since other viable emails come through them. The only emails I've ever received /from/ name-services.com, and the only emails I've ever received with URI links to name-services.com, are like the attached. As far as I know, this is a scam. I've never done any business with name-services.com, and never looked at obtaining any of their services. I don't remember the exact steps I used April 27 to review this, but searching for their domain I found plenty of evidence of spam/scam, and no evidence that these people also sent out ham. If they themselves are a registry, and do send ham to domain registrants that they haven't already scammed, then yes, I should remove them from my blacklist file. If they are primarily DNS services and do not send emails other than spam/scam, then they should remain. Bob Menschel

1 0

Re: [SURBL-Discuss] LInk to add to SURBL
by List Mail User 21 May '05

21 May '05

>On Wed, 18 May 2005, Jeff Chan wrote: > >> On Wednesday, May 18, 2005, 6:44:05 AM, Spam Admin wrote: >> > spam link. >> >> > http://www.kexmt.move.fresh-deals.net/go/g/31/2869/1/?3495564 >> >> > Dan Zachary >> >> Hi Dan, >> This is a recently registered domain (a couple weeks ago) >> but it doesn't seem to resolve into spaces that are known >> to be spammy. That may just mean spammers have moved into >> a new network space, etc. >> >> However there are a number of odd things about this domain >> from the registration, to the host's registration, etc. >> And it doesn't seem to resolve currently. >> >> Is anyone else seeing this in spams? >> >> Jeff C. > >Jeff, >I've been getting spam containing that URL and other 'sisters' >(such as "dealstoday.net"). > >They have major spam-sign hallmarks: > >The payload is a few lines of HTML that reference images with the >ad "message" and then massive amounts of "Bayes poison" hidden by >HTML comments or CSS tricks (style="visibility:hidden"), bogus HTML >(large amounts of text after the closing </HTML> tag), >as well as being sent to stale local addresses. > >Examples available upon request. ;) > >-- >Dave Funk University of Iowa ><dbfunk (at) engineering.uiowa.edu> College of Engineering >319/335-5751 FAX: 319/384-0549 1256 Seamans Center >Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 >#include <std_disclaimer.h> >Better is not better, 'standard' is better. B{ >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Jeff, Now you have your answer about how "spammy" GMB is. (This is them also - check the name servers, and rDNS - also, look around the net-block for other nearby GMB sites). Also, another partial hidden "private" registration (i.e. dealstoday.net). Paul Shupak track(a)plectere.com

3 2

Question about scoring in SA3
by Kevin A. McGrail 21 May '05

21 May '05

I've been very pleased with SURBL in SA3 and I'd like to increase the scores. However, I don't understand how the default scores like this work: rules/50_scores.cf:score URIBL_AB_SURBL 0 2.007 0 0.417 rules/50_scores.cf:score URIBL_OB_SURBL 0 1.996 0 3.213 rules/50_scores.cf:score URIBL_PH_SURBL 0 0.839 0 2.000 rules/50_scores.cf:score URIBL_SC_SURBL 0 3.897 0 4.263 rules/50_scores.cf:score URIBL_WS_SURBL 0 0.539 0 1.462 I feel SA is being too conservative with the resource that SURBL provides. Can anyone give me their recommendations for my local configuration file for replacement scores that will be more effective? And since I couldn't find it referenced, can anyone tell me what the four numbers after the score mean? Regards, KAM

5 11

Reporting phishing-spams?
by Martin 20 May '05

20 May '05

Where is the best place to report phishing-spam? Thanks / Martin

2 2

some urls tht missed this morning
by Rakesh 20 May '05

20 May '05

Hi these three urls weren't listed in multi.surbl.org at 5:00 AM GMT. wonderfulcompressorwell.com bobtangofunny.com wonderfulcomplimentwell.com -- Regards, Rakesh B. Pal Project Leader Emergic CleanMail Team. Netcore Solutions Pvt. Ltd. ======================================================== Success is how high you reach after you hit the bottom. ========================================================

6 10

Re: [SURBL-Discuss] LInk to add to SURBL
by List Mail User 19 May '05

19 May '05

>... >> 220 max.madplus.com ESMTP Merak 7.4.5; Wed, 18 May 2005 12:11:27 -0400 >> quit > >> Same registrant also owns gmbdream. com and uses the company name >> of "GMB Direct". > >Thanks Paul. Does any of this help inform us about how spammy >this critter is? > >Jeff C. >-- >Don't harm innocent bystanders. > >... There is the quick results from a Goggle search which shows that "GMB Direct" runs a group of "email marketeering" companies/domains/sites which vary in published policies. A short list (just from the first few Google hits) include: **** First a few "general" hits **** Email Results: Permission Email Marketing Resources for Advertisers www.emailresults.com/directory_ category.asp?CategoryID=4027 GMBDirect - Contact us www.gmbdirect.com/en/contacts/ GMBDirect - About opt-in marketing www.gmbdirect.com/en/marketing/ **** The first "really suspicious one" **** ... Bulk direct e-mail marketing services available through our partners GMB Direct. ... +Direct E-mail Marketing with our partners at GMB Direct. ... www.flashcap.com/Main%20Site/ Services/Params/menu/100/default.aspx **** Some "clear" slime **** Sweeps-US.com - About Us ... COM is one of the family of Web sites owned and operated by GMB DIRECT. Founded in 1998, GMB DIRECT is a leader within the online marketing industry. ... sweeps-us.com/aboutus/ **** Uh-Oh - an "affiliate" program **** Welcome to GMBDirect Affiliate Network ... 1-877-GMB-DIRECT. 1-877-462-3473. info(a)gmbtrack.com. Member Log In. Username :. Password :. Publisher, Advertiser ... gmbtrack.com/ **** Now more slime **** Sweeps-US.com - About Us ... COM is one of the family of Web sites owned and operated by GMB DIRECT. Founded in 1998, GMB DIRECT is a leader within the online marketing industry. ... sweeps-us.com/aboutus/ **** Buy "opt-in" mailing lists **** Optin Email Directory Directory - Business directory, Business to ... ... Email Marketing - National, Click to visit! GMB Direct. www.gmbdirect.com. New York, New York. 877 GMB Direct. Click to visit! Targetware. www.targetware.com. ... www.optinemaildirectory.com/s.asp?d=1478 **** Finally the "give-away" - true "slime" - the privacy page from a Russian site they run (read the find print) **** E-Get - Privacy policy Privacy policy Last Updated: March 12, 2004. GMB Direct ("GMB Direct," "we," "us," "our") has created this site (the "Site") in order to advise you of GMB ... www.vme.net.ru/Privacy/ Against them; Their contract specifically states they are not responsible for the "correctness" of the lists. They will "rent" or "sell" email address lists. They will willingly transfer data gathered from one client to any other paying client (read the "privacy" statement). They have an extremely large number of domains, many hidden with private registrations. In their defense; They are very expensive compared to many spammers. They claim some large companies as customers. --- Thats it. They make it seem like they are legit, but they offer to use any customer provided list to email to (with no mention about "checking"). So clearly they are in the "spam support" business but may have some legitimate customers; Also, many of there domains are "hidden" with private registrations and their seem to fall into three categories - the ones that say they are GMB and are trying to sell services, the ones that say they are GMB but are for gathering personal information using questionable "sweepstakes" (e.g. Win a {TV, Gift Certificate, Sony VAIO, etc}) and other tatics, and finally the ones which do not identify themselves at all. The mere existence if the third group makes them slime (as does the second) and probably make them spammers for themselves as well as for customers (this wouldn't stand up in court, but probably would for a Grand Jury - You can decide where the decision should fall). So the question of "how spammy" is still open, but "are they spammers" is answered (i.e. you may want to list some domains, but not others). Paul Shupak track(a)plectere.com

1 0

Re: [SURBL-Discuss] Reporting phishing-spams?
by Joe Zitnik 19 May '05

19 May '05

Usually to the organization that is being misrepresented is a good place to start. I know there are addresses set up just for this with some companies, spoof(a)paypal.com and spoof(a)ebay.com come to mind. They might not actually do anything, but they are there. :-( >>> martin.lyberg(a)idkommunikation.com 5/19/2005 4:03 AM >>> Where is the best place to report phishing-spam? Thanks / Martin _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss