... On Tuesday, November 8, 2005, 11:55:36 AM, Dhawal Doshy wrote:
Catherine Hampton writes:
Thanks Jeff, i'll continue doing the spamcop reporting. If only there was some way for mass submission (i have a list of 177 sub-domains if anyone is interested).
<raising hand>
Please email the list to updates@spambouncer.org and I'll list them in the Spam Haven URLs list. Thanks!
http://mx2.netmagicians.com/tripod.txt, just mailed them to the support team at lycos.com as well who will remove the offending accounts.
Please do report them to lycos. Getting the sites shut down is arguably more important than blacklisting, IMO.
Jeff C.
Don't harm innocent bystanders.
Discuss mailing list Discuss@lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss
Reporting the tripod sites to Lycos and shutting them is indeed more important than blacklisting the tripod sites - Agreed. But a quick extract of the HTML pages shows that the 179 tripod pages seem to only redirect to a total of 8 sites currently - those should get blacklisted. The current set is (not the same as the ones I saw earlier):
Site Registrar Contact email -------------------------------------------------------------------------------- http://www.aneigpie.com-MUNG - NameBay caturedin@yahoo.com http://www.arecurel.com-MUNG - NameBay livoutsid@yahoo.com http://www.baniclu.com-MUNG - NameBay caturedin@yahoo.com http://www.cherdon.info-MUNG - Directi tospecie@yahoo.com http://www.cherit.info-MUNG - Directi tospecie@yahoo.com http://www.chersky.info-MUNG - Directi tospecie@yahoo.com http://www.offmantate.com-MUNG - YesNIC greatestemal@yahoo.com http://www.onlialowus.com-MUNG - YesNIC greatestemal@yahoo.com
All currently have a 5 minute TTL and are at IP 211.233.16.84, which is listed at Spamhaus under SBL31414, a general dirty block at KIDC, though the example domains in the SBL include Kurayev's name servers registered by the ex-Joker (now Nicline) ROKSO domain reseller "Alex Blood"/"Ryan Kelly".
All use the same name servers:
ns0.areshooti.com-MUNG - YesNIC revisitinger@yahoo.com ns0.stomauset.com-MUNG - YesNIC omeceral@yahoo.com
Of course the YesNIC name servers, have no name servers themselves.
Paul Shupak track@plectere.com
On Tuesday, November 8, 2005, 10:08:46 PM, List User wrote:
a quick extract of the HTML pages shows that the 179 tripod pages seem to only redirect to a total of 8 sites currently - those should get blacklisted. The current set is (not the same as the ones I saw earlier):
Site Registrar Contact email
http://www.aneigpie.com-MUNG - NameBay caturedin@yahoo.com http://www.arecurel.com-MUNG - NameBay livoutsid@yahoo.com http://www.baniclu.com-MUNG - NameBay caturedin@yahoo.com http://www.cherdon.info-MUNG - Directi tospecie@yahoo.com http://www.cherit.info-MUNG - Directi tospecie@yahoo.com http://www.chersky.info-MUNG - Directi tospecie@yahoo.com http://www.offmantate.com-MUNG - YesNIC greatestemal@yahoo.com http://www.onlialowus.com-MUNG - YesNIC greatestemal@yahoo.com
All currently have a 5 minute TTL and are at IP 211.233.16.84, which is listed at Spamhaus under SBL31414, a general dirty block at KIDC, though the example domains in the SBL include Kurayev's name servers registered by the ex-Joker (now Nicline) ROKSO domain reseller "Alex Blood"/"Ryan Kelly".
Hi Paul, Thanks I've blacklisted those, but TBH it may not help too much since they don't seem to be appearing in spams themselves.
Keep on getting those domains shut down. :-)
Jeff C. -- Don't harm innocent bystanders.
Jeff Chan wrote:
On Tuesday, November 8, 2005, 10:08:46 PM, List User wrote:
a quick extract of the HTML pages shows that the 179 tripod pages seem to only redirect to a total of 8 sites currently - those should get blacklisted. The current set is (not the same as the ones I saw earlier):
Hi Paul, Thanks I've blacklisted those, but TBH it may not help too much since they don't seem to be appearing in spams themselves.
Keep on getting those domains shut down. :-)
Jeff C.
The count is now 400.. http://mx2.netmagicians.com/tripod_400.txt
I have also sent the list to lycos, but am yet to get any reply.
- dhawal
Reporting the tripod sites to Lycos and shutting them is indeed more important than blacklisting the tripod sites - Agreed. But a quick extract of the HTML pages shows that the 179 tripod pages seem to only redirect to a total of 8 sites currently - those should get blacklisted. The current set is (not the same as the ones I saw earlier):
<snip list>
I'm going to block these sites and the IP block(s) involved, but I don't see there being much pointin blocking them in a SURBL unless these sites themselves, and not a redirector, appear in the message bodies of spam.
I'm seriously considering a SpamBouncer 2.2 enhancement that checks for and follows redirects, and checks *those* sites against the SBL and other appropriate lists. (And SB internal data, of course.)
Catherine Hampton wrote:
<snip list>
I'm seriously considering a SpamBouncer 2.2 enhancement that checks for and follows redirects, and checks *those* sites against the SBL and other appropriate lists. (And SB internal data, of course.)
If largely adopted, that would have a nice side effect ... since those tripod/geocities sites are metered, after a large spam run, the checks themselves would create the few mb of trafic that would temporarily disable the sites, thus making them unattractive to spammers.
I'd welcome such an extension for Spamassassin ...
Sometimes, the answer contained is in the question ;-)
-
ariel＠spambouncer.org -
Dhawal Doshy -
Eric Montréal -
Jeff Chan -
List Mail User