On Friday, May 28, 2004, 3:20:41 AM, Duncan Hill wrote: > On Friday 28 May 2004 10:16, [EMAIL PROTECTED] wrote:
>> http://starmintaka. com/go/8961790304181035 >> http://hyperlink. sales-source.com/cgi-bin/default2.asp?4ORt2h05T7EJd6AN0dAZ >>BA N0C4F1H889UaCveD=8ZYGz4 >> http://www.luvoo. com/index.php?page=registration >> So there is actually one "Redirect link" in the Spam, and you have to click >> somewhere on the resulting page to get to the real site that is being >> promoted. > It might dodge the known redirector stuff, but the starmintaka link would > probably get learnt by Spamcop et al as a bad site, and promptly defeat all > of the dodging. Or, we could notice that starmintaka.com resolves to: Name: starmintaka.com Address: 66.249.104.91 which in turn belongs to the /20 of a known spam operation: > Ref: SBL14959 > > 66.249.96.0/20 is listed on the Spamhaus Block List (SBL) > > 07-Apr-2004 01:48 GMT | SR08 > > Stargate2000 / RW Management / Robert Wagner / Hector Sectzer > 66.249.96.0/20 is listed on the Register Of Known Spam > Operations (ROKSO) database as being assigned to, under the > control of, or providing service to a known professional spam > operation run by Stargate2000 / RW Management / Robert Wagner / > Hector Sectzer. > nwig.net > Only network announced by AS32121; AS32121 is Stargate2000 (see ROK3452). > The domain nwig.net is currently dead (nameservers do not respond). > > OrgName: NW Internet Group, INC > OrgID: NIG-7 > Address: 2050 Russett Way > City: Carson City > StateProv: NV > PostalCode: 89703 > Country: US > > NetRange: 66.249.96.0 - 66.249.111.255 > CIDR: 66.249.96.0/20 ... And I could blacklist starmintaka.com in sc.surbl.org, which I just did, which should now catch messages containing that redirection site..... If anyone spots any others, please let me know. :-) Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
