[SURBL-Discuss] LInk to add to SURBL

List Mail User track at Plectere.com
Sat May 21 04:14:16 CEST 2005

>On Wed, 18 May 2005, Jeff Chan wrote:
>> On Wednesday, May 18, 2005, 6:44:05 AM, Spam Admin wrote:
>> > spam link.
>> > http://www.kexmt.move.fresh-deals.net/go/g/31/2869/1/?3495564
>> > Dan Zachary
>> Hi Dan,
>> This is a recently registered domain (a couple weeks ago)
>> but it doesn't seem to resolve into spaces that are known
>> to be spammy.  That may just mean spammers have moved into
>> a new network space, etc.
>> However there are a number of odd things about this domain
>> from the registration, to the host's registration, etc.
>> And it doesn't seem to resolve currently.
>> Is anyone else seeing this in spams?
>> Jeff C.
>I've been getting spam containing that URL and other 'sisters'
>(such as "dealstoday.net").
>They have major spam-sign hallmarks:
>The payload is a few lines of HTML that reference images with the
>ad "message" and then massive amounts of "Bayes poison" hidden by
>HTML comments or CSS tricks (style="visibility:hidden"), bogus HTML
>(large  amounts of text after the closing </HTML> tag),
>as well as being sent to stale local addresses.
>Examples available upon request. ;)
>Dave Funk                                  University of Iowa
><dbfunk (at) engineering.uiowa.edu>        College of Engineering
>319/335-5751   FAX: 319/384-0549           1256 Seamans Center
>Sys_admin/Postmaster/cell_admin            Iowa City, IA 52242-1527
>#include <std_disclaimer.h>
>Better is not better, 'standard' is better. B{
>Discuss mailing list
>Discuss at lists.surbl.org


	Now you have your answer about how "spammy" GMB is.  (This is
them also - check the name servers, and rDNS - also, look around the
net-block for other nearby GMB sites).  Also, another partial hidden
"private" registration (i.e. dealstoday.net).

	Paul Shupak
	track at plectere.com

More information about the Discuss mailing list