[SURBL-Discuss] LInk to add to SURBL

David B Funk dbfunk at engineering.uiowa.edu
Sat May 21 03:51:26 CEST 2005


On Wed, 18 May 2005, Jeff Chan wrote:

> On Wednesday, May 18, 2005, 6:44:05 AM, Spam Admin wrote:
> > spam link.
>
> > http://www.kexmt.move.fresh-deals.net/go/g/31/2869/1/?3495564
>
> > Dan Zachary
>
> Hi Dan,
> This is a recently registered domain (a couple weeks ago)
> but it doesn't seem to resolve into spaces that are known
> to be spammy.  That may just mean spammers have moved into
> a new network space, etc.
>
> However there are a number of odd things about this domain
> from the registration, to the host's registration, etc.
> And it doesn't seem to resolve currently.
>
> Is anyone else seeing this in spams?
>
> Jeff C.

Jeff,
I've been getting spam containing that URL and other 'sisters'
(such as "dealstoday.net").

They have major spam-sign hallmarks:

The payload is a few lines of HTML that reference images with the
ad "message" and then massive amounts of "Bayes poison" hidden by
HTML comments or CSS tricks (style="visibility:hidden"), bogus HTML
(large  amounts of text after the closing </HTML> tag),
as well as being sent to stale local addresses.

Examples available upon request. ;)

-- 
Dave Funk                                  University of Iowa
<dbfunk (at) engineering.uiowa.edu>        College of Engineering
319/335-5751   FAX: 319/384-0549           1256 Seamans Center
Sys_admin/Postmaster/cell_admin            Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{


More information about the Discuss mailing list