The following 2 URIs (and possibly a third) are FP's:
i-say-MUNGED.com Surveynetworks-MUNGED.com
And possibly Itracks-MUNGED.com
i-say-MUNGED is the IPSOS survey site, and seems legit, and surveynetworks-MUNGED Is a collection of them.
I'm not 100% certain of itracks-MUNGED, but please check.
These are all on WS.
On Tuesday, August 17, 2004, 4:33:21 PM, Larry Rosenman wrote:
The following 2 URIs (and possibly a third) are FP's:
i-say-MUNGED.com Surveynetworks-MUNGED.com
And possibly Itracks-MUNGED.com
i-say-MUNGED is the IPSOS survey site, and seems legit, and surveynetworks-MUNGED Is a collection of them.
I'm not 100% certain of itracks-MUNGED, but please check.
These are all on WS.
Thanks Larry, I checked them a little and they all look at least quasi-legitimate, so I whitelisted them all, plus some related domains:
itracks.com ipsos-reid.com i-say.com venteinc.com surveynetworks.com
We need to ask the ws folks how these are getting in and how we can stop them from doing so.
Jeff C.
"Jeff Chan" jeffc@surbl.org
i-say-MUNGED.com Surveynetworks-MUNGED.com
...
Thanks Larry, I checked them a little and they all look at least quasi-legitimate, so I whitelisted them all, plus some related domains:
...
We need to ask the ws folks how these are getting in and how we can stop them from doing so.
I'd like to add to my previous posting the fact that ns1.MUNGEDventeinc.com, the name server for MUNGEDsurveynetworks.com is 207.218.64.10.
As it turns out, 207.218.64.0/22 is listed on SBL, otherwise I wouldn't have listed a domain registered in 2002:
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL13341 "Apparently the entire /22 is controlled by E-Tracks and "winfreestuff;" the only rDns throughout are to their domains"
Also read the entry about Vente, Inc. / MUNGED-WinFreeStuff.com at http://www.cluelessmailers.org/listings/companyblacklist.html
It sure looks like a spamhaus to me.
Joe
The following 2 URIs (and possibly a third) are FP's:
i-say-MUNGED.com Surveynetworks-MUNGED.com
And possibly Itracks-MUNGED.com
i-say-MUNGED is the IPSOS survey site, and seems legit, and surveynetworks-MUNGED Is a collection of them.
On March 7, 2004 I received spam from hardcore spammer DQ Media (email address OnlineSweepstakes@MUNGEDdq09.net) which advertised MUNGEDsurveynetworks.com as the only company mentioned in the spam other than DQ Media itself:
<td class="style4"><div align="center"><font size="-2" face="Verdana, Arial, Helvetica, sans-serif">To remove yourself from future Survey Network's mailings please click <a href="http://www.MUNGEDsurveynetworks.com/s.cfm?poo=1&ref=8602">here</a> </font></div></td>
That's how they got listed by me.
Joe
On Wed, 18 Aug 2004, Joe Wein wrote:
The following 2 URIs (and possibly a third) are FP's:
i-say-MUNGED.com Surveynetworks-MUNGED.com
And possibly Itracks-MUNGED.com
i-say-MUNGED is the IPSOS survey site, and seems legit, and surveynetworks-MUNGED Is a collection of them.
On March 7, 2004 I received spam from hardcore spammer DQ Media (email address OnlineSweepstakes@MUNGEDdq09.net) which advertised MUNGEDsurveynetworks.com as the only company mentioned in the spam other than DQ Media itself:
<td class="style4"><div align="center"><font size="-2" face="Verdana,Arial, Helvetica, sans-serif">To remove yourself from future Survey Network's mailings please click <a href="http://www.MUNGEDsurveynetworks.com/s.cfm?poo=1&ref=8602">here</a> </font></div></td>
That's how they got listed by me.
Me too. Cheers, - Bill
--------------------------------------------------------------------------- "Microsoft has done more for the fault tolerance industry than any other company. They have made end-users very tolerant of faults". (Courtesy of "Deliduka, Bennet" bennet.deliduka@state.vt.us) -------------------------------------------------------------------------- William Stearns (wstearns@pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------
On Tuesday, August 17, 2004, 10:31:08 PM, William Stearns wrote:
On Wed, 18 Aug 2004, Joe Wein wrote:
The following 2 URIs (and possibly a third) are FP's:
i-say-MUNGED.com Surveynetworks-MUNGED.com
And possibly Itracks-MUNGED.com
i-say-MUNGED is the IPSOS survey site, and seems legit, and surveynetworks-MUNGED Is a collection of them.
On March 7, 2004 I received spam from hardcore spammer DQ Media (email address OnlineSweepstakes@MUNGEDdq09.net) which advertised MUNGEDsurveynetworks.com as the only company mentioned in the spam other than DQ Media itself:
<td class="style4"><div align="center"><font size="-2" face="Verdana,Arial, Helvetica, sans-serif">To remove yourself from future Survey Network's mailings please click <a href="http://www.MUNGEDsurveynetworks.com/s.cfm?poo=1&ref=8602">here</a> </font></div></td>
That's how they got listed by me.
Me too.
First, I don't dispute that you received these spams. But, the question is: does this domain have any legitimate use? If so then we probably should not list them since we want to avoid false positives.
I've taken venteinc off the whitelist, but am leaving surveynetworks on it because:
1. clueless mailers are not the same degree of badness as the hard core criminal spammer.
2. They probably are not stealing zombied services and should therefore be easily blocked by conventional sender RBLs. Since their name server is already in SBL, uridnsbl and other name server resolving URL scanners would block them based on that.
3. They are probably not doing the same volume of mail as the hard core spammers.
4. They are probably subject to ISP AUPs since they're hosted in North America.
etc.
However if it can be proven that they ONLY EVER do spam, i.e. never do any legitimate mail, then I'm willing to let them be blocked.
Larry, Can you forward some headers for the surveynetworks message? I'd like to see if their sending servers are already listed in RBLs.
Jeff C.
Hi!
On March 7, 2004 I received spam from hardcore spammer DQ Media (email address OnlineSweepstakes@MUNGEDdq09.net) which advertised MUNGEDsurveynetworks.com as the only company mentioned in the spam other than DQ Media itself:
<td class="style4"><div align="center"><font size="-2" face="Verdana,Arial, Helvetica, sans-serif">To remove yourself from future Survey Network's mailings please click <a href="http://www.MUNGEDsurveynetworks.com/s.cfm?poo=1&ref=8602">here</a> </font></div></td>
That's how they got listed by me.
Should we relist them again? It surely looks like a 'legit' entry to appear in WS.
I also had them in my spamtrap.
Bye, Raymond.
On Wednesday, August 18, 2004, 12:24:02 AM, Raymond Dijkxhoorn wrote:
On March 7, 2004 I received spam from hardcore spammer DQ Media (email address OnlineSweepstakes@MUNGEDdq09.net) which advertised MUNGEDsurveynetworks.com as the only company mentioned in the spam other than DQ Media itself:
<td class="style4"><div align="center"><font size="-2" face="Verdana,Arial, Helvetica, sans-serif">To remove yourself from future Survey Network's mailings please click <a href="http://www.MUNGEDsurveynetworks.com/s.cfm?poo=1&ref=8602">here</a> </font></div></td>
That's how they got listed by me.
Should we relist them again? It surely looks like a 'legit' entry to appear in WS.
I also had them in my spamtrap.
I'd like to know if they have any legitimate uses and whether their mail servers are already in RBLs.
Jeff C.
Hi!
Should we relist them again? It surely looks like a 'legit' entry to appear in WS.
I also had them in my spamtrap.
I'd like to know if they have any legitimate uses and whether their mail servers are already in RBLs.
They are inside spamhaus...
But, another thing, i can understand the policy. Any legit use, then its not inside SURBL. But cant we, since this will give trouble in the future anyway, make a 'bitch.surbl.org' or something alike, where we CAN list those domains? They CAN spam, and we CAN list :)
Bye, Raymond.
On Wednesday, August 18, 2004, 12:47:47 AM, Raymond Dijkxhoorn wrote:
But, another thing, i can understand the policy. Any legit use, then its not inside SURBL. But cant we, since this will give trouble in the future anyway, make a 'bitch.surbl.org' or something alike, where we CAN list those domains? They CAN spam, and we CAN list :)
We could, but I'm not to concerned about the borderline cases. Yes they're annoying, but they're probably not creating nearly as much spam traffic as the guys who use zombies, etc.
Jeff C.
Hi!
But, another thing, i can understand the policy. Any legit use, then its not inside SURBL. But cant we, since this will give trouble in the future anyway, make a 'bitch.surbl.org' or something alike, where we CAN list those domains? They CAN spam, and we CAN list :)
We could, but I'm not to concerned about the borderline cases. Yes they're annoying, but they're probably not creating nearly as much spam traffic as the guys who use zombies, etc.
But on the other hand, for things like zombies, open proxy's we have lists like DSBL. But sure, get the picture.
Bye, Raymond
-
Jeff Chan -
Joe Wein -
Larry Rosenman -
Raymond Dijkxhoorn -
William Stearns