Discuss

discuss@lists.surbl.org

2 participants
1873 discussions

20050615 embedded image spam
by Sean Sowell 16 Jun '05

16 Jun '05

Hello --- Below is a fresh list of dates and domains. All times are Pacific (GMT - 7). Kind regards, Sean Sowell 20050614-0137 virtualcitycasino.com 20050614-0242 sererih.com 20050614-0314 ltoptout.com 20050614-0619 radiocarbodatin.com 20050614-0621 radiocarbodatin.com 20050614-0824 donmehme.com 20050614-0925 dmgy.com 20050614-0925 totalgiveaway.com 20050614-1007 scottyoungwq.net 20050614-1033 clickboothlnk.com 20050614-1332 hcsyd.com 20050614-1332 highlifeplastic.com 20050614-1417 primaryads.ca 20050614-1417 startyoursavingstoday.ca 20050614-1516 getbestofitnesstothisitem.com 20050614-1625 clickboothlnk.com 20050614-1823 freecdsuperstore.com 20050614-1823 optit.com 20050614-1914 thfirshuman.com 20050614-1958 thfirshuman.com 20050614-2129 soonerwe.com 20050615-0022 colocolofh.com 20050615-0200 creditapplications.info 20050615-0200 fxfn.com 20050615-0200 impulsemg.com 20050615-0402 luckyemperor.com 20050615-0406 donlittlbiof.com 20050615-0409 donlittlbiof.com 20050615-0513 i-cami.com 20050615-0532 duffha.com 20050615-0955 irq12.com 20050615-0955 petcarerx.com 20050615-1104 qualitymba.info 20050615-1112 qualitymba.info 20050615-1131 dvdmegapacks.com 20050615-1132 ccs44.com 20050615-1132 inphonic.com 20050615-1137 nyclearcut.com 20050615-1310 livemercial.com 20050615-1348 byonbard.com 20050615-1348 heatn.com 20050615-1348 lifeonaclick.com 20050615-1451 prima11.com 20050615-1505 urchoise.com 20050615-1517 flourishnutrition.com 20050615-1517 healthsitesinc.com 20050615-1551 beirahc.com 20050615-1557 actma.com 20050615-1617 creditapplications.info 20050615-1617 fxfn.com 20050615-1617 impulsemg.com 20050615-1655 urchoise.com 20050615-1737 investmystock.com 20050615-1737 onlinestocktrading.ws 20050615-1800 i-cami.com 20050615-1823 prima11.com 20050615-1823 rewardsgateway.com 20050615-2306 sasthear.com 20050615-2309 sasthear.com

1 0

Whitelist: multiply.com
by Robert Menschel 16 Jun '05

16 Jun '05

Hello Jeff, All, Just received some spam today from a site that needs to be whitelisted on SURBL -- multiply.com Valid community-based, free (adv sponsored), social networking, email-generating system. We've received valid emails from people using the system as it is intended. However, even when used as intended, it's liable to a domino/cascade effect. Emails sent to person A's contact list which includes B, C, and D, can be automatically forwarded to their contact lists, their contacts' contacts' contacts, etc. That's the spam received today -- email once removed, where A's contact list would be appropriate, but we're on B's contact list, and have no interest in this email from A. Think of it as the forward of a forward of a forward problem, where it's not a matter of that last forward being sent mindlessly -- it was sent automatically. I'll be adding this to the SARE rules system somewhere, but it's too early now to predict how large or small a score it will have. Bob Menschel

2 1

new phishing URI deutsch-bank.net
by wolfgang 16 Jun '05

16 Jun '05

>From the invalid sender address Support(a)db.com we are just receiving a flood of phishing mails here is a quote with the URI in question Bitte, <strong><a href=3d"http://deutsch-bank=2enet/mod/WebObject= s/dbpbc=2ewoa?lang=3dde">schauen</a></strong> Sie Internet Banking, um di= i will submit samples to the web interfaces in a minute cheers, wolfgang

3 2

phishing URI
by wolfgang 13 Jun '05

13 Jun '05

postbank-deutschland.com this is a phishing URL that tries to fool postbank.de bank account owners to enter PIN and TAN data. I just submitted it to black.uribl and ws.surbl via webform too, the faster it's listed, the better ... cheers, wolfgang

2 3

RE: [SURBL-Discuss] Re: spam from Cricket Liu via postsnet/campai gner (FW: Webinar: Active Directory Best Practices for DNS)
by Chris Santerre 13 Jun '05

13 Jun '05

> >If you simply bought the list, you may want to familiarize yourself and >your marketing team with basic netiquette and guidelines for >responsible >(as opposed to merely "legal") email marketing. It's 2005 - anyone >purchasing so-called "opt-in" lists in this day and age is begging to >get blacklisted and have their reputation tarnished. > >I realize that if you purchased the list you probably can't get me >removed from the original - I've come to expect my address to >be traded. >Frankly, I'm astounded to see someone as apparently net-savvy as you >just accepting the idea of purchasing mailing lists. I'm very, very >disappointed. > >Steve Freaking genius Steve! Great email to him. I hope they *get it*. --Chris

2 1

Re: [SURBL-Discuss] Re[2]: More whitelist.cf
by List Mail User 12 Jun '05

12 Jun '05

> >Hi Paul, >What is their hat color please? > >Jeff C. >-- >Don't harm innocent bystanders. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Jeff, I'm pretty sure that 1&1 is a definite "white hat", just so large that like any large ISP (at least most without zero-tolerance policies), they get abused from time to time - actually so large, it a not uncommon. I'm not sure how large, but their presence in Europe seems to be almost on the order of a "Earthlink" or certainly larger than "Lycos" mail or other second tier providers - I liken them to RoadRunner, large with more customers than they can support well, and overly slow to act (but they do act). It does seem that abuse is more common for 1and1 than the European domains (1und1.tld, oneandone.tld seems mostly corporate and large customers - I haven't seen more than a very few cases of "questionable" emails from oneandone - but a lot of forgeries). I simply suspect that whitelisting them might be like whitelisting any particular address from Yahoo! - not something I would trust without a statement that they check and/or reserve that address for their own use only (i.e. no customer could use it). Also, note that the most common form of abuse I have seen is the use of "dropboxes" at 1&1, not mailings from their network (just like for Yahoo!). They definitely do respond to complaints, but more slowly than I would like, and often there seems to be a language barrier (which is rare among the large multi-nationals which I have dealt with). Possible someone from Germany has further opinions and/or data to be shared. (Please, please - somebody from Germany speak up.) I would not put them in with t-dialin.net/t-online.de, who I would call "grey" - i.e. most customers are average people, but they make no attempt to act upon complaints (and are abused constantly - almost daily even for a small site like mine). Paul Shupak track(a)plectere.com

1 0

Re: [SURBL-Discuss] Re[2]: More whitelist.cf
by List Mail User 12 Jun '05

12 Jun '05

>... > >RM> ... more whitelist entries ... > >... > >whitelist_from_rcvd no.reply(a)1and1.com kundenserver.de # 1and1 Hosting & ISP >http://survey.1and1.com > >... > I'm not so sure that 1&1 is immune from forgery, but if you list it, you should also list the four domains oneandone.{com,net} and 1und1.{com,net}. They are all the same company and forward responses to abuse@ and to postmaster@ queries through the same server (the problem is that *some* customer email also seems to go through that server occasionally, and they have had abusive customers in the past - so a forgery seems possible, even if unlikely). Paul Shupak track(a)plectere.com

3 2

First SURBL whitelist submissions from SARE whitelist.cf
by sare＠menschel.net 12 Jun '05

12 Jun '05

Hello Jeff, Saturday, May 28, 2005, 12:39:12 AM, you wrote: JC> On Friday, May 27, 2005, 4:13:22 PM, Robert Menschel wrote: >> Friday, May 27, 2005, 1:06:46 AM, you wrote: JC>>> On Thursday, May 26, 2005, 5:58:02 PM, Robert Menschel wrote: JC>>>>> 2. Would they be appropriate to whitelist (i.e. exclude from JC>>>>> listing) in SURBLs? >>>> Unlikely, since the web sites mentioned in the emails are rarely the >>>> same as the From address or routing server. However, the primary web >>>> sites within those emails might be good candidates for the SURBL >>>> whitelist. JC>>> Fair enough. You don't happen to have a list of those JC>>> corresponding websites do you? :-) >> Not readily handy, but if you can find me a few extra hours :-), I can >> scan my corpus and put together a partial list. JC> No rush, but if you can get them sometime that would be great! JC> :-) At the rate things are going, I'll never have the time needed to do a full list. So maybe I can work through whitelist.cf line by line, and send you a couple at a time, on occasion... whitelist_from_rcvd *(a)ashkenaz.com roving.com Ashkenaz Music & Dance Community Center In addition to http://ashkenaz.com, their emails have links to http://ui.constantcontact.com ConstantContact is occasionally abused, but is used by a lot of ham newsletters, so probably should be whitelisted if not already. whitelist_from_rcvd calmt(a)calmt.pmail.biz amsnet.com California Musical Theatre (Sacramento) http://calmt.pmail.biz whitelist_from_rcvd *(a)centurytheatres.com centurytheatres.com Century Theatres http://www.centurytheatres.com and http://www.fandango.com It's a start... Bob Menschel

4 9

Re: spam from Cricket Liu via postsnet/campaigner (FW: Webinar: Active Directory Best Practices for DNS)
by Steven Champeon 10 Jun '05

10 Jun '05

on Fri, Jun 10, 2005 at 11:37:34AM -0700, Cricket Liu wrote: > Hi, Tim. Hi, Steven. > > >On Jun 10, 2005, at 10:47 AM, Steven Champeon wrote: > > > >>FYI - there's been some question about postsnet and campaigner lately > >>on the SURBL whitelist list. > >> > >>Well, I was just subscribed to a postsnet list, managed by > >>campaigner. > >> > >>If you go to the URL to unsub, including the final '.', you get a > >>silly > >>Javascript popup saying "Your work has been saved to date however > >>your > >>session has timed out and you must re-login", hit ok, get > >>redirected to > >>gotmarketing.com thence to campaigner.com. > > Hmm. I'm not sure why that is. I'll ask our Marketing folks to look > into it. Oh, that's really simple: the copy in the message thinks URLs are words, not functional strings that should be bracketed or otherwise kept apart from punctuation. I was merely remarking that a message ostensibly sent via postsnet also involved campaigner.com and gomarketing, all of whom have been on SURBL's radar lately. We've been trying to decide whether the fact that "some" legitimate email refers to campaigner.com means that we ought to whitelist it and let the rest of the spam through. > >>Note that they explicitly say "we bought the list" below. I'm > >>surprised > >>to see Cricket Liu spamming. Guess I'll never buy another edition of > >>_DNS and BIND_. > > I'm sorry to hear that. I was extremely sorry to see that someone from whom I have learned so much over the years would stoop to purchasing address lists in order to spam people. Have you not been paying attention to the growing spam problem? Here we reject 65-90% of /all inbound mail delivery attempts/ as spam, and it's getting worse. And mainstream companies who spam (or who hire mainsleaze spam companies to spam for them) aren't helping matters at /all/. > >>My question is simple: > >> > >>Why did you subscribe me to this list without my permission? If > >>you feel > >>that you have permission from me to subscribe me to this list, may > >>I ask > >>where you think you got it? Is ORA cognizant/accepting of such stupid > >>and/or risky practices by their authors? > > I'm not even sure which list "this list" is, but I'll forward your > message to our Marketing folks and ask that, if we own this list, your > address be deleted from it. If we simply bought the list, though, > there's probably nothing we can do to delete you from the list. If you own the list, I'd be very interested to hear how my address ended up on it. You *do* maintain a log of all subscription requests, of course, and can tell me when I subscribed, when I confirmed my subscription (via an email sent to my address to confirm that the person who subbed my address was actually /me/), from what IP address, on what day and what time, etc, right? If not, you're essentially looking to get yourself blacklisted. And not just by SURBL or one of the other blacklists, but by a million private blacklists around the world, who are a harder lot to scrub. If you simply bought the list, you may want to familiarize yourself and your marketing team with basic netiquette and guidelines for responsible (as opposed to merely "legal") email marketing. It's 2005 - anyone purchasing so-called "opt-in" lists in this day and age is begging to get blacklisted and have their reputation tarnished. I realize that if you purchased the list you probably can't get me removed from the original - I've come to expect my address to be traded. Frankly, I'm astounded to see someone as apparently net-savvy as you just accepting the idea of purchasing mailing lists. I'm very, very disappointed. Steve > Again, my apologies. > > cricket -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us! http://hesketh.com/about/careers/account_manager.html join us!

1 0

Re: spam from Cricket Liu via postsnet/campaigner (FW: Webinar: Active Directory Best Practices for DNS)
by Steven Champeon 10 Jun '05

10 Jun '05

on Fri, Jun 10, 2005 at 10:55:36AM -0700, Tim O'Reilly wrote: > I don't know anything about this. I'll look into it. Thanks, Tim. I appreciate it. -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us! http://hesketh.com/about/careers/account_manager.html join us!

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss