Date: Sun, 24 Sep 2006 02:07:25 -0400 From: Eric Montr?al erv@mailpeers.net Subject: Re: [SURBL-Discuss] Redirection URLs To: SURBL Discussion list discuss@lists.surbl.org Message-ID: 4516209D.6000500@mailpeers.net Content-Type: text/plain; charset=ISO-8859-1; format=flowed
A year ago, when the Geocities problem was much bigger, I made a simple analysis tool.
I don't maintain it anymore, and data is partial, however, it shows that the javascript encoding used is nearly always very basic and easy to decode:
Did you check every geocities et al link in your spam mails and add them to this list? You must've been angry to blast the spammers outta the earth!!! I just love that spirit. Thanks for the links.
Most of the listed sites appeared in spams long time ago and were not removed by Geocities.
The original site http://nospam.mailpeers.net/ contains .cf rules, but except for the generic ones it's not useful anymore, mostly since Yahoo / Geocities finally decided to do the right thing and block the new spam sites and I don't actively search geocities spamvertized links anymore.
Are the rules listed like subevil, alive_spammy(2), rip_spammy, alive_spammy_malware all kept updated? Even if not, I guess they shouldn't give FPs?
cheers, skar.