Discuss May 2005

discuss@lists.surbl.org

34 participants
64 discussions

URIBL and PTR records
by wolfgang 12 May '05

12 May '05

when browsing unsubscribe links like http://www.signoffcorp.biz/uns.htm to enter a spamtrap address I just noticed that quite a few of the pages look extremely similar, DNS lookups show: $ host www.signoffcorp.biz www.signoffcorp.biz has address 217.107.217.8 $ host www.bestcds.biz www.bestcds.biz has address 217.107.217.8 $ host www.wonder-pills.com www.wonder-pills.com has address 217.107.217.8 $ host www.multimed.ws www.multimed.ws has address 217.107.217.8 $ host 217.107.217.8 8.217.107.217.in-addr.arpa is an alias for 8.0/27.217.107.217.in-addr.arpa. 8.0/27.217.107.217.in-addr.arpa domain name pointer webrider.ru. $ host webrider.ru webrider.ru has address 217.107.216.26 so i wonder if it is possible (or already done) to also list (and save) the IPs of URIBL listed domains and check newly queried, yet unlisted domains against those IPs. any comments? regards, wolfgang

2 1

Feedback on adprofile.net wanted
by Jeff Chan 11 May '05

11 May '05

adprofile.net reportedly appeared in a flowers.com ham as: <td align="middle"><a href="http://tx.adprofile.net/tx/r?CID=12&M=3&sid=800ABC123"><IMG height=90 src="http://a1234.g.akamai.net/f/1233/1234/1a/www.1800flowers.com/800f_assets/im… me too120X90.gif" width="120" NOSEND="1" border="0"></a></td> Yet it's listed on WS by Bill Stearns. This may be a false positive. Does anyone have any more information about it? Catherine Hampton says it's not on her spam radar and others have said that they may be web spammers on guestbooks, wikis, etc. but not email spammers. They seem to have some minor NANAS. Feedback wanted. :-) Jeff C. -- Don't harm innocent bystanders.

4 4

Re: [SURBL-Discuss] Feedback on adprofile.net wanted
by Robert Menschel 11 May '05

11 May '05

> Date: Mon, 9 May 2005 22:34:13 -0700 > From: Jeff Chan <jeffc(a)surbl.org> > Subject: [SURBL-Discuss] Feedback on adprofile.net wanted > To: SURBL Discuss <discuss(a)lists.surbl.org> > Message-ID: <357174725.20050509223413(a)surbl.org> > Content-Type: text/plain; charset=us-ascii > adprofile.net reportedly appeared in a flowers.com ham as: ... > Yet it's listed on WS by Bill Stearns. This may be a false > positive. Does anyone have any more information about it? I find adprofile.net within my corpus in 1) what appears to be a valid ham, angry (not quite hate) email to Mike Malloy, liberal radio talk show host, from a radical conservative listener. Email includes a copy of the 760thezone.com home page (the radio station that carries the talk show). Home page apparently contained the paid ad link: <A class=3Dportalbar=20 href=3D"http://wvw.clearchannel.com/spacer.gif?event=3D104~radio~20~~124~= Low Mortgage =Rates!~125~/hosts/index.html~121~kkzn-am~98~http://tx.adprofile.net/tx/r?= CID=3D60584&M=3D0&sid=3Dlmr"=20 target=3D_blank>Low Mortgage=20 target=3D_blank>Rates!</A> In addition to that one ham, I have 12 spam. Bob Menschel

1 0

Re: [SURBL-Discuss] Feedback on adprofile.net wanted
by List Mail User 10 May '05

10 May '05

>... > >on Mon, May 09, 2005 at 10:34:13PM -0700, Jeff Chan wrote: >> adprofile.net reportedly appeared in a flowers.com ham as: >> >> <td align="middle"><a href="http://tx.adprofile.net/tx/r?CID=12&M=3&sid=800ABC123"><IMG height=90 >> src="http://a1234.g.akamai.net/f/1233/1234/1a/www.1800flowers.com/800f_assets/im… me >> too120X90.gif" width="120" NOSEND="1" border="0"></a></td> >> >> Yet it's listed on WS by Bill Stearns. This may be a false >> positive. Does anyone have any more information about it? > >Seen here tonight in spam for idiotclimber.com et al.: > ><center> If you wish to stop future >messages from Christianfamilyloans, please <a >href="http://tx.adprofile.net/tx/r?CID=46505&ADTBID=EMAIL604"> follow this link ></a> or contact us at: Christianfamilyloans, P.O. Box 78361, San >Francisco, CA 94107-8361. > > >Note that the other CAN-SPAM mention is commented out at the top of >the HTML message, so who knows? > >This email is a commercial advertisement sent in compliance with the >CANSPAM Act of 2003. We have no desire to send you information that is >not wanted, therefore, if you wish to be excluded from future mailings, >please use the link at the bottom of the page. > >This is an email promotion being sent to you by idiotclimber.com. To >stop all future mailings, follow the link below or send your email >address to: > > Member Services > 242 W. 36th St,12th floor New York, NY 10018 > (866) 872-6022 > >http://www.idiotclimber.com/cgi-bin/unsubscr.cgi?email=445273&cid=34&pid= > >Other domains: > >ibidclause.com >idiotclimber.com >idoiclamp.com >iflager.com >indigocraze.com >instepluck.com >interchairs.com >intercheeze.com >interestlone.com >iratelamp.com >iratelounge.com >ironcleets.com >ironiclever.com >ironlaser.com >itchinglover.com > >-- >hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com >join us! http://hesketh.com/about/careers/account_manager.html join us! >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Very interesting, "legal" spam; Especially since the domain christianfamilyloans. com (may be totally unrelated - hard to tell with "private" registration) is an unrepentant, hard-core spammer (very "christian" of them)! Paul Shupak track(a)plectere.com

1 0

Re: [SURBL-Discuss] Feedback on adprofile.net wanted
by List Mail User 10 May '05

10 May '05

>... > >adprofile.net reportedly appeared in a flowers.com ham as: > ><td align="middle"><a href="http://tx.adprofile.net/tx/r?CID=12&M=3&sid=800ABC123"><IMG height=90 >src="http://a1234.g.akamai.net/f/1233/1234/1a/www.1800flowers.com/800f_assets/im… me >too120X90.gif" width="120" NOSEND="1" border="0"></a></td> > >Yet it's listed on WS by Bill Stearns. This may be a false >positive. Does anyone have any more information about it? > >Catherine Hampton says it's not on her spam radar and others >have said that they may be web spammers on guestbooks, wikis, >etc. but not email spammers. They seem to have some minor >NANAS. > >Feedback wanted. :-) > >Jeff C. >-- >Don't harm innocent bystanders. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Slime, but not an email spammer to my knowledge - They do redirect you (always) through portland.co. uk, who is slime also (and worse, but still not an email spammer as far as I know). BTW, they both will gladly sell your name, email address and IP (and probably whatever else they can collect). Chris, if your reading this, you should now have two more "grey" entries for URIBL; But these both seem like FPs for SURBL. Paul Shupak track(a)plectere.com P.S. This is probaly the wrond list, but for those using URIBL, what scores are you using (mine are pretty low)? Reply on the URIBL list if it seems more appropriate (likely it is).

1 0

Spam dispersed across multiple messages
by Matthew Wilson 10 May '05

10 May '05

Has anyone seen any spams that use two (or more) messages to catch the recipient's eye? E.g.: The first message has cutesy CSS-obfuscated text and maybe a graphic or two, and informs/commands the user to watch for the follow-up email from the same person and with a certain given catchphrase in the subject line The second followup message that arrives a minute or two later is perhaps marked with an identical From: name (but not an identical from address), and perhaps the prophesied catchphrase in the subject line. The payload (a URL or phone number or whatever), would be in the body or even subject line of the email message. Comments?

2 1

Re: [SURBL-Discuss] multi.surbl.org.rbldnsd Update Times
by Jeff Chan 10 May '05

10 May '05

[off list reply published with Eric's permission] On Monday, May 9, 2005, 9:33:12 AM, Eric Smith wrote: > Found out this morning it was an error in the way we were reporting file > times. Everything is good now. We were piping modified times out to an > HTML page every hour then we check if the page had changed at all in the > last 12 hours. > /E. Cool. BTW if you want to know the actual timestamp of the data, the best way is to look at the zone file serial number. Those are generated from the number of epoch seconds at UTC when the file is created. For example: % dig multi.surbl.org soa [...] multi.surbl.org. 15M IN SOA a.surbl.org. zone.surbl.org. ( 1115680902 ; serial 10M ; refresh 5M ; retry 1W ; expiry 15M ) ; minimum % % date -u -r 1115680902 Mon May 9 23:21:42 UTC 2005 Jeff C. -- Don't harm innocent bystanders.

1 0

RE: [SURBL-Discuss] newly registered domains
by Chris Santerre 09 May '05

09 May '05

Because they don't take to kindly to anyone doing tons of whois looksups an hour. Trust me ;) --Chris >-----Original Message----- >From: Matthew Wilson [mailto:matthew@boomer.com] >Sent: Monday, May 09, 2005 9:44 AM >To: SURBL Discussion list >Subject: RE: [SURBL-Discuss] newly registered domains > > >Why not integrate a whois date lookup directly into SURBL or URIBL? >Design an encoding system whereby >suspectedspammydomain.spammertld.dr.surbl.org (or uribl.com) would >return the date somehow regex encoded in the IP address. Then write a >nice SA rule that decodes it, also using regex. Are there any regex >geniuses out there that could encode a date in an IP address? > >-Matthew > > >> Well this has been brought up before. It is a very good idea, >> however difficult to implement. Unfortunetly the date >> returned by a whois querey comes in a wide variety of >> flavors. We (SARE) thought we had all of the returned date >> codes figured out. Nope. New ones still keep coming. >> >> uribl.com has some ideas on how to attack this very issue, >> but not sure it is worth it yet. >> >> In short, it would be wonderful to start doing whois lookups >> for every domain in an email. Lots of things could be flagged >> off of it. Think of a sort of baysien whois DB. But the >> traffic would be pretty dam big. >> >> --Chris >> _______________________________________________ >> Discuss mailing list >> Discuss(a)lists.surbl.org >> http://lists.surbl.org/mailman/listinfo/discuss >> >> >> > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

3 2

RE: [SURBL-Discuss] newly registered domains
by Chris Santerre 09 May '05

09 May '05

Exactly, and do you have any idea how many of the lookups would be needed per day? I do! Enough to get the uribl dns ip doing the lookups, blocked from the whois servers. People running the whois servers don't really play nice with others. You need to approach them very carefully. APNIC is not going to be to helpful ;) --Chris >-----Original Message----- >From: Matthew Wilson [mailto:matthew@boomer.com] >Sent: Monday, May 09, 2005 1:29 PM >To: SURBL Discussion list >Subject: RE: [SURBL-Discuss] newly registered domains > > >I wasn't talking about doing huge numbers of whois lookups; I >was saying >cache the whois lookups in the a uribl dns zone, encoded using regex. > >> -----Original Message----- >> From: discuss-bounces(a)lists.surbl.org >> [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Chris Santerre >> Sent: Monday, May 09, 2005 9:20 AM >> To: 'SURBL Discussion list' >> Subject: RE: [SURBL-Discuss] newly registered domains >> >> Because they don't take to kindly to anyone doing tons of >> whois looksups an hour. Trust me ;) >> >> --Chris >> >> >-----Original Message----- >> >From: Matthew Wilson [mailto:matthew@boomer.com] >> >Sent: Monday, May 09, 2005 9:44 AM >> >To: SURBL Discussion list >> >Subject: RE: [SURBL-Discuss] newly registered domains >> > >> > >> >Why not integrate a whois date lookup directly into SURBL or URIBL? >> >Design an encoding system whereby >> >suspectedspammydomain.spammertld.dr.surbl.org (or uribl.com) would >> >return the date somehow regex encoded in the IP address. >> Then write a >> >nice SA rule that decodes it, also using regex. Are there >any regex >> >geniuses out there that could encode a date in an IP address? >> > >> >-Matthew > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] newly registered domains
by Matthew Wilson 09 May '05

09 May '05

I wasn't talking about doing huge numbers of whois lookups; I was saying cache the whois lookups in the a uribl dns zone, encoded using regex. > -----Original Message----- > From: discuss-bounces(a)lists.surbl.org > [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Chris Santerre > Sent: Monday, May 09, 2005 9:20 AM > To: 'SURBL Discussion list' > Subject: RE: [SURBL-Discuss] newly registered domains > > Because they don't take to kindly to anyone doing tons of > whois looksups an hour. Trust me ;) > > --Chris > > >-----Original Message----- > >From: Matthew Wilson [mailto:matthew@boomer.com] > >Sent: Monday, May 09, 2005 9:44 AM > >To: SURBL Discussion list > >Subject: RE: [SURBL-Discuss] newly registered domains > > > > > >Why not integrate a whois date lookup directly into SURBL or URIBL? > >Design an encoding system whereby > >suspectedspammydomain.spammertld.dr.surbl.org (or uribl.com) would > >return the date somehow regex encoded in the IP address. > Then write a > >nice SA rule that decodes it, also using regex. Are there any regex > >geniuses out there that could encode a date in an IP address? > > > >-Matthew

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss May 2005