Proflowers again, was: Send Holiday Flowers for $24.99 plus Beautiful Glass Vase from Proflowers (fwd)
Good afternoon, all, We discussed proflowers earlier this year. To quote Jeff:
It also seems they're at least trying to cut back on spamming if we accept the decrease in recent NANAS sightings.
I just received 4 more spams from them, one attached. Perhaps they just get quiet between holidays? I'd like to place one vote for blacklisting them. Opinions? Cheers, - Bill
--------------------------------------------------------------------------- "What is the most effective Windows NT remote management tool? A car." -- Network Intrusion Detection, An Analyst's Handbook 2nd Edition, 2000 Stephen Northcutt et al, page 147 (Courtesy of Rodrigo Goya lucent@securenet.com.mx) -------------------------------------------------------------------------- William Stearns (wstearns@pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------
William Stearns wrote:
Good afternoon, all, We discussed proflowers earlier this year. To quote Jeff:
It also seems they're at least trying to cut back on spamming if we accept the decrease in recent NANAS sightings.
I just received 4 more spams from them, one attached. Perhaps theyjust get quiet between holidays? I'd like to place one vote for blacklisting them. Opinions? Cheers, - Bill
Finding several messages like:
Subject: Send Holiday Flowers for $24.99 plus Beautiful Glass Vase from Proflowers
With links to: http://images. proflowers. com/rtimages/Other/COP_featureBG.gif
Msgs contain links in SURBLs: asandox. com, adimgs. com & ofrsvr. com, etc.
I've added them to my local zone on 2004-08-30 as I doubt any of my users would ever order flowers from the US unles its via Fleurop.
you have my vote though it could be a joejob - they'll stay in my zone.
Alex
William Stearns wrote:
Good afternoon, all, We discussed proflowers earlier this year. To quote Jeff:
It also seems they're at least trying to cut back on spamming if we accept the decrease in recent NANAS sightings.
I just received 4 more spams from them, one attached. Perhaps theyjust get quiet between holidays? I'd like to place one vote for blacklisting them. Opinions?
We've seen piles of spam promoting proflowers.com in the past two days, all containing asandox.com uris and arriving via an asandox.com relay. IMO asando.com (http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20781) is the uri that should be blocked, not proflowers.com.
-Brett
On Thursday, December 23, 2004, 3:51:58 PM, Brett Cove wrote:
William Stearns wrote:
Good afternoon, all, We discussed proflowers earlier this year. To quote Jeff:
It also seems they're at least trying to cut back on spamming if we accept the decrease in recent NANAS sightings.
I just received 4 more spams from them, one attached. Perhaps theyjust get quiet between holidays? I'd like to place one vote for blacklisting them. Opinions?
We've seen piles of spam promoting proflowers.com in the past two days, all containing asandox.com uris and arriving via an asandox.com relay. IMO asando.com (http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20781) is the uri that should be blocked, not proflowers.com.
Thank you. That is exactly the right way to reason things. If asando_ is the actual spamming affiliate or whatever, then they should be the ones to block.
Jeff C. -- "If it appears in hams, then don't list it."
Good evening, Jeff, all,
On Thu, 23 Dec 2004, Jeff Chan wrote:
On Thursday, December 23, 2004, 3:51:58 PM, Brett Cove wrote:
William Stearns wrote:
We discussed proflowers earlier this year. To quote Jeff:It also seems they're at least trying to cut back on spamming if we accept the decrease in recent NANAS sightings.
I just received 4 more spams from them, one attached. Perhaps theyjust get quiet between holidays? I'd like to place one vote for blacklisting them. Opinions?
We've seen piles of spam promoting proflowers.com in the past two days, all containing asandox.com uris and arriving via an asandox.com relay. IMO asando.com (http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20781) is the uri that should be blocked, not proflowers.com.
Thank you. That is exactly the right way to reason things. If asando_ is the actual spamming affiliate or whatever, then they should be the ones to block.
It raises an interesting philosophical question; is the original company that paid for the compaign and benefits from the sales responsible? I don't claim to have an all-seeing answer, and would like to hear other people's opinions. Cheers, - Bill
--------------------------------------------------------------------------- "Mouse movement detected. Please reboot for changes to take effect." -------------------------------------------------------------------------- William Stearns (wstearns@pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------
On Thursday, December 23, 2004, 6:43:42 PM, William Stearns wrote:
Good evening, Jeff, all,
On Thu, 23 Dec 2004, Jeff Chan wrote:
On Thursday, December 23, 2004, 3:51:58 PM, Brett Cove wrote:
William Stearns wrote:
We discussed proflowers earlier this year. To quote Jeff:It also seems they're at least trying to cut back on spamming if we accept the decrease in recent NANAS sightings.
I just received 4 more spams from them, one attached. Perhaps theyjust get quiet between holidays? I'd like to place one vote for blacklisting them. Opinions?
We've seen piles of spam promoting proflowers.com in the past two days, all containing asandox.com uris and arriving via an asandox.com relay. IMO asando.com (http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20781) is the uri that should be blocked, not proflowers.com.
Thank you. That is exactly the right way to reason things. If asando_ is the actual spamming affiliate or whatever, then they should be the ones to block.
It raises an interesting philosophical question; is the originalcompany that paid for the compaign and benefits from the sales responsible? I don't claim to have an all-seeing answer, and would like to hear other people's opinions. Cheers, - Bill
Yes, they're responsible. Does that mean none of their customers should be able to get their mail?
That's a much harder and more relevant philosophical question.
Jeff C. -- "If it appears in hams, then don't list it."
-----Original Message----- From: discuss-bounces@lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Jeff Chan Sent: 24 December 2004 03:51 To: William Stearns Cc: SURBL Discussion list Subject: Re: [SURBL-Discuss] Proflowers again,was: Send Holiday Flowers for $24.99 plus Beautiful Glass Vase fromProflowers (fwd)
On Thursday, December 23, 2004, 6:43:42 PM, William Stearns wrote:
Good evening, Jeff, all,
On Thu, 23 Dec 2004, Jeff Chan wrote:
On Thursday, December 23, 2004, 3:51:58 PM, Brett Cove wrote:
William Stearns wrote:
We discussed proflowers earlier this year. To quote Jeff:It also seems they're at least trying to cut back on
spamming if
we accept the decrease in recent NANAS sightings.
I just received 4 more spams from them, oneattached. Perhaps
they just get quiet between holidays? I'd like to place one vote for blacklisting them. Opinions?
We've seen piles of spam promoting proflowers.com in the past two days, all containing asandox.com uris and arriving via an asandox.com relay. IMO asando.com (http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20781) is the uri that should be blocked, not proflowers.com.
Thank you. That is exactly the right way to reason things. If asando_ is the actual spamming affiliate or whatever, then they should be the ones to block.
It raises an interesting philosophical question; is theoriginal company that paid for the compaign and benefits from the sales responsible? I don't claim to have an all-seeing answer,
and would like
to hear other people's opinions. Cheers, - Bill
Yes, they're responsible. Does that mean none of their customers should be able to get their mail?
That's a much harder and more relevant philosophical question.
I suppose it depends on the response of proflowers when they are told that they are being promoted via spam. If they respond that this was never their intention and the campaign will stop immediately then I'd say leave them alone. However if they don't stop the campaign then block them. Besides if you just block the spammer then proflowers will get the messages that anti spamming doesn't directly hurt them only the spammer and they will shift to another one.
On Thursday, December 23, 2004, 10:04:30 PM, Nick Askew wrote:
I suppose it depends on the response of proflowers when they are told that they are being promoted via spam. If they respond that this was never their intention and the campaign will stop immediately then I'd say leave them alone. However if they don't stop the campaign then block them. Besides if you just block the spammer then proflowers will get the messages that anti spamming doesn't directly hurt them only the spammer and they will shift to another one.
Since the mail mentioning the actual spammers' sites is blocked, as we have done with asandox.com and havagreatday.com, then we have hurt their spamming effort and any benefit proflowers may have gotten from it. Whatever money or affiliate bonuses or whatever proflowers may be paying to the spammers becomes far less effective since the mail won't get through. I think that's a very specific and useful effect.
Of course anyone who got the spam should **also complain to proflowers** to let them know what they think about their practices.
Jeff C. -- "If it appears in hams, then don't list it."
On Thursday, December 23, 2004, 3:51:58 PM, Brett Cove wrote:
William Stearns wrote:
Good afternoon, all, We discussed proflowers earlier this year. To quote Jeff:
It also seems they're at least trying to cut back on spamming if we accept the decrease in recent NANAS sightings.
I just received 4 more spams from them, one attached. Perhaps theyjust get quiet between holidays? I'd like to place one vote for blacklisting them. Opinions?
We've seen piles of spam promoting proflowers.com in the past two days, all containing asandox.com uris and arriving via an asandox.com relay. IMO asando.com (http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20781) is the uri that should be blocked, not proflowers.com.
FWIW I've added to the SC manual blacklist:
asandox.com havagreatday.com
Both were getting SpamCop reports already, so I've nudged them onto the list. They're also on SBL, some NANAS, etc.
http://www.spamhaus.org/SBL/sbl.lasso?query=SBL16372 http://www.spamhaus.org/SBL/sbl.lasso?query=SBL20781
http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12057
Perhaps not too surprisingly they share name and mail servers:
66.63.176.2 ,3 ,4
66.63.182.2
Jeff C. -- "If it appears in hams, then don't list it."
-
Alex Broens -
Brett Cove -
Jeff Chan -
Nick Askew -
William Stearns