Discuss

discuss@lists.surbl.org

1876 discussions

RE: ZDNET redirecting to spammer websites?
by Rose, Bobby 22 Mar '05

22 Mar '05

Even though zdnet.com shouldn't be in SURBL, wouldn't having chkpt.zdnet.com (the actually site doing the redirect) be in SURBL? -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Tuesday, March 22, 2005 12:38 AM To: users(a)spamassassin.apache.org Cc: SURBL Discuss Subject: Re: ZDNET redirecting to spammer websites? On Monday, March 21, 2005, 11:32:45 AM, Bobby Rose wrote: > Wouldn't this just be something that SURBL should take care of? If > this URL is the source of spam then it should be in SURBL regardless > if it's in the zdnet.com domain. Right!? Which domain are you referring to? zdnet.com should not be in SURBLs because it has too many legitimate uses. If we listed zdnet.com that would surely result in false positives. On the other hand viags.com and simply-rx.net should be listed in SURBLs, *and they are*. What's needed is for applications like SpamAssassin to parse the redirection correctly and check both zdnet.com and viags.com. zdnet.com should not match SURBLs, but viags.com should. QED. Jeff C. __ > -----Original Message----- > From: Rosenbaum, Larry M. [mailto:rosenbaumlm@ornl.gov] > Sent: Monday, March 21, 2005 10:35 AM > To: users(a)spamassassin.apache.org > Subject: ZDNET redirecting to spammer websites? > We received a drug spam containing the following URL: > http://chkpt.zdnet.com/chkpt/supposedtoallow/fdl%2ev%69%61%67%73.co%6d > /p > /b/kmioa > This URL will actually take you to fdl.viags.com (which then goes to > www.simply-rx.net). As far as I know, the SA SURBL check will check > zdnet.com, not the spammer domain viags.com. What is going on here, > and what should we do about it? > Larry Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 1

Re: ZDNET redirecting to spammer websites?
by Frank Ellermann 22 Mar '05

22 Mar '05

Jeff Chan wrote: > What's needed is for applications like SpamAssassin to parse > the redirection correctly That's very near to the point where it could outsmart itself. There's no general rule to identify redirections in URLs, I'd try to stay away from it. Bye, Frank

1 0

New redirector: www.nate.com
by David B Funk 22 Mar '05

22 Mar '05

Ugg, just ran across another open redirector abused in spam www.nate.com/r/XY12/target.domain where XY12 seems to be any combination of 4 letters and digits. Looks like some Korean ISP thingie. -- Dave Funk University of Iowa <dbfunk (at) engineering.uiowa.edu> College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 #include <std_disclaimer.h> Better is not better, 'standard' is better. B{

3 2

Re: ZDNET redirecting to spammer websites?
by Jeff Chan 22 Mar '05

22 Mar '05

On Monday, March 21, 2005, 11:32:45 AM, Bobby Rose wrote: > Wouldn't this just be something that SURBL should take care of? If this > URL is the source of spam then it should be in SURBL regardless if it's > in the zdnet.com domain. Right!? Which domain are you referring to? zdnet.com should not be in SURBLs because it has too many legitimate uses. If we listed zdnet.com that would surely result in false positives. On the other hand viags.com and simply-rx.net should be listed in SURBLs, *and they are*. What's needed is for applications like SpamAssassin to parse the redirection correctly and check both zdnet.com and viags.com. zdnet.com should not match SURBLs, but viags.com should. QED. Jeff C. __ > -----Original Message----- > From: Rosenbaum, Larry M. [mailto:rosenbaumlm@ornl.gov] > Sent: Monday, March 21, 2005 10:35 AM > To: users(a)spamassassin.apache.org > Subject: ZDNET redirecting to spammer websites? > We received a drug spam containing the following URL: > http://chkpt.zdnet.com/chkpt/supposedtoallow/fdl%2ev%69%61%67%73.co%6d/p > /b/kmioa > This URL will actually take you to fdl.viags.com (which then goes to > www.simply-rx.net). As far as I know, the SA SURBL check will check > zdnet.com, not the spammer domain viags.com. What is going on here, and > what should we do about it? > Larry Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

RE: HELP: RE: [SURBL-Discuss] ZDnet redirector still open.
by Chris Santerre 22 Mar '05

22 Mar '05

Well its been a week since the first report. Emails to the media have begun. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, March 18, 2005 11:27 PM >To: SURBL Discuss >Subject: Re: HELP: RE: [SURBL-Discuss] ZDnet redirector still open. > > >On Friday, March 18, 2005, 8:41:13 AM, Chris Santerre wrote: >>>From: Alex Broens [mailto:surbl@alexb.ch] > >>>Jeff, >>> >>>Could you pls make some extra noise so this hole gets closed. >>> >>>- or do we need to run an international press release? - or >maybe some >>>extra pressure via Slashdot? >>> >>>Alex > >> Maybe their competitors would like to run a story on it :) I >know someone on >> SPAM-L list was trying to get it removed. Lets see what they say. > >Before calling the media, let's give cnet a week to fix it. >If it's not fixed by then, we can bring it up with them >again. > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

RE: REDIRECTOR: chkpt.zdnet.com
by Chris Santerre 21 Mar '05

21 Mar '05

It makes more sense to email him direct. Too bad I can't find he email anywhere! I guess its time to start telling the media about this open redirect. Oh well, we gave them fair amount of time. --Chris >-----Original Message----- >From: Rob McEwen [mailto:rob@powerviewsystems.com] >Sent: Monday, March 21, 2005 11:11 AM >To: discuss(a)lists.surbl.org; users(a)spamassassin.apache.org >Subject: Re: REDIRECTOR: chkpt.zdnet.com > > >(I've sent this to both SA & SURBL) > >There has been much fuss about ZDNet being slow or >unresponsive about fixing >open redirects. > >I have a suggestion. > >Someone ought to post a message on John Dvorak's blog. I did a >search to >find the most recent post on his blog relating to spam to find the best >place to post. > >Therefore, someone please go here and post a message to him to get this >message across: > >http://www.dvorak.org/blog/?p=1437 > >(I'd do it myself but I just got over the flu and I'm severely >behind in my >work. Also, I think that someone with more "pull" than me out >to do this... >someone like Chris or Jeff. Plus, Dvorak will recognize my >name from other >very unrelated topics that I've posted on his blog in the past and I >wouldn't want to confuse issues with him by using my name.) > >Rob McEwen >PowerView Systems > >

2 1

REDIRECTOR: chkpt.zdnet.com
by Alex Broens 21 Mar '05

21 Mar '05

Guys, Does somebody know someone at ZDnet This looks like a new redir. <center> <a href=http://chkpt.zdnet.com/chkpt/wenot/fvguug%2ere%74ai%6c%62%6C%6f%77s.co… target=_blank>CL1CCK HERE TO 0RDER or</a> </center> => http://chkpt.zdnet.com/chkpt/wenot/fvguug.retailblows. com/ Alex

4 5

HELP: RE: [SURBL-Discuss] ZDnet redirector still open.
by Chris Santerre 19 Mar '05

19 Mar '05

>-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Friday, March 18, 2005 9:36 AM >To: SUBL List >Subject: [SURBL-Discuss] ZDnet redirector still open. > > >Jeff, > >Could you pls make some extra noise so this hole gets closed. > >- or do we need to run an international press release? - or maybe some >extra pressure via Slashdot? > >Alex Maybe their competitors would like to run a story on it :) I know someone on SPAM-L list was trying to get it removed. Lets see what they say. I just dismantled an entire rack while everything was live. Boy was that fun! --Chris

3 2

ZDnet redirector still open.
by Alex Broens 18 Mar '05

18 Mar '05

Jeff, Could you pls make some extra noise so this hole gets closed. - or do we need to run an international press release? - or maybe some extra pressure via Slashdot? Alex

1 0

Recall: [SURBL-Discuss] Help for the Windows Guy!
by Jeff Baker 15 Mar '05

15 Mar '05

Jeff Baker would like to recall the message, "[SURBL-Discuss] Help for the Windows Guy!". All outbound email messages have been scanned for viruses and content with the e500 web appliance.

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss