surge of "new message" spams hitting NANOG

Sun Oct 25 03:04:02 UTC 2015

I just checked the all the spammy domains found on tonight's surge of 
spams that hit NANOG ...I checked them at http://multirbl.valli.org to 
see *which* DNS blacklists had each domain in the clickable link of each 
spam blacklisted. I did that check about an hour after those were sent, 
which was went I sat down at my computer and saw that.

Here are the results:

africancichlidphotos DOT com
--listed on ivmURI
--listed on HostKarma

africameetsafrica DOT com
--listed on ivmURI

arpitshah DOT co DOT in
--listed on ivmURI
--listed on SpamHaus DBL

dinkinsautoservice.com
--listed on ivmURI
--listed on HostKarma

electronicstradingllc DOT com
--listed on ivmURI

hutsonlegal DOT com
--listed on ivmURI
--listed on HostKarma

janatyachar.org
--listed on ivmURI
--listed on URIBL
--listed on HostKarma

marketingdeguerrilla DOT net
--listed on ivmURI
--listed on URIBL
--listed on SURBL

micheleruiz DOT com
--listed on ivmURI
--listed on HostKarma

ogdenautomotiveinc DOT com
--listed on ivmURI

pilotsref DOT com
--listed on ivmURI

photographytoday DOT org
--listed on ivmURI
--listed on HostKarma

probeautystudios DOT com
--listed on ivmURI

purefitnesslincoln DOT com
--listed on ivmURI

rosasmedley DOT com
--listed on ivmURI
--listed on HostKarma

thomasanthonyguerriero DOT co
--listed on ivmURI

throughaglassdarkly DOT net
--listed on ivmURI

signranch DOT com
--listed on ivmURI
--listed on SpamHaus DBL

stillbontechnology DOT com
--listed on ivmURI

studioprodutora DOT com DOT br
--listed on ivmURI

urbanfoodstrategies DOT com
--listed on ivmURI

As shown, I was happy to see that my own ivmURI blacklist was 21 for 21, 
and nothing else came close to that. (I also verified that ALL of the 
ivmURI listings happened BEFORE those spams were sent to NANOG).

Keep in mind... this isn't a true measure of any one of those domain 
blacklists' overall effectiveness since this is just one tiny metric of 
one small type of very sneaky spam. So please don't think I'm trying to 
say that ivmURI is a replacement for SpamHaus' DBL list or SURBL or 
URIBL, etc... because those lists do likewise catch some spammy domains 
that ivmURI misses or hadn't gotten to yet. But it was still very 
satisfying to see this success. If it would help, I'll be happy to 
provide the operator of NANOG complementary access if so desired.

PS - if the "hits" on other blacklists for these domains suddenly 
expands, that would be due to added listings which happened AFTER those 
spams were sent to the NANOG list. (and after I did this check)

-- 
Rob McEwen
+1 478-475-9032