[SURBL-Discuss] FP?: ultimatebizsource.biz

Jeff Chan jeffc at surbl.org
Fri Oct 15 07:01:18 CEST 2004


On Thursday, October 14, 2004, 8:43:40 PM, Joe Wein wrote:
> ultimatebizsource.biz claims to be an opt-in list with 55,000 subscribers.
> It's currently listed on [WS] and [JP] but not my personal list.

> I know, the name alone sounds like your typical spammer domain, but is it?
> Today the owner of getyoursiteongoogle.info mailed me, since I had
> blacklisted their domain.

> Turns out the evidence was a mailing from ultimatebizsource.biz which was
> listed on WS and JP. Since the recipient was a third party from the
> Prolocation feed, I could not easily verify if it was indeed unsolicited,
> but I checked what I could check quickly.

> To my surprize the outgoing mailserver's IP is not listed on any of the RBLs
> and neither are the name servers or the resolved name.

> There is only 1 NANAS sighting for this almost one year old domain. That
> posting is an automated one, and probably related to an ahbl.org listing
> mentioned in the SA-tags added to the evidence mail. I can find no listing
> for them at ahbl.org now.

> A web search for the domain name returns a single hit:
> http://www.google.com/search?q=ultimatebizsource.biz+spam

> That looks too little for 55,000 mails per day for one year.

> Joe

Perhaps the question should be: do they have legitimate uses?
Obviously their name, etc. sound very spammy, but is their
subscriber list truly opt-in or is is harvested or scraped,
etc.?  If it's truly opt-in then they may have legitimate
uses.  Their site claims to be opt in, but of course that's
impossible to confirm directly except perhaps by asking
everyone on it.

However if it were not opt in, it would seem there should be
many complaints.  Also 55-58k is pretty small for a scraped
or harvested list, which usually have more like millions.
So perhaps there's a chance it actually is opt in.

The domain registration is from October 31, 2003.  The
domain registration for a related domain: Cashfromhome.com
is quite a bit older: Creation Date: 08-jun-1998.  These
also lead me to believe they may have legitimate uses or
at least that 1-8 years should have been enough time for
SBL, NANAS, etc. to find them as true spammers.

(Note that there are 34 NANAS hits for the older domain,
but all are from 1998 through 2000.  None are newer, so
perhaps they spammed somewhat several years ago but
cleaned up their act in recent years.  Most of the NANAS
reports are apparently from the same person.)

Both domains are listed in WS:

/home/gorilla/black-gorilla-7_04.txt:cashfromhome.com
/home/prolocation/black-prolocation-master:ultimatebizsource.biz

Chris, what evidence do you have?  Same question for Raymond.

Jeff C.
--
"If it appears in hams, then don't list it."



More information about the Discuss mailing list