enemieslist.com: spamNEWS 2010-03-10T22:15:33Z tag:enemieslist.com,2010:/news//2 Movable Type Copyright (c) 2010, schampeo Links Roundup 2010-03-10T22:15:33Z 2010-03-10T22:08:55Z tag:enemieslist.com,2010:/news//2.1398 2010-03-10T22:08:55Z Fighting Bots Is Everybody's Business Trust And Safety Anonymous Whois List Twitter Has Spammers, Too Spamhaus: Microsoft's botnet cull had little effect RSA 2010: Researchers dissect ZeuS botnet blueprintBuild your own botnet for $2500 Intelligence Slideshow: Spam Rules the... schampeo http://enemieslist.com/ schampeo@hesketh.com
  • Fighting Bots Is Everybody's Business
  • Trust And Safety
  • Anonymous Whois List
  • Twitter Has Spammers, Too
  • Spamhaus: Microsoft's botnet cull had little effect
  • RSA 2010: Researchers dissect ZeuS botnet blueprint
    Build your own botnet for $2500
  • Intelligence Slideshow: Spam Rules the World
  • A very young industry
  • Spamming Botnets - Strategies welcome
  • Is Online Anonymity a Bad Thing?
  • U.S. pinpoints code writer behind Google attack: report
  • CONSUMER ADVOCATE SUED BY SUBJECT OF BAD REVIEW CASE IMPACTS ALL BLOGGERS
  • SILICON ALLEY INSIDER: WARNING: GOOGLE BUZZ HAS A HUGE PRIVACY FLAW
    • ]]>     new pats posted - 20100304 (maintenance pats release) 2010-03-04T21:16:27Z 2010-03-04T21:11:41Z tag:enemieslist.com,2010:/news//2.1397 2010-03-04T21:11:41Z 50279 patterns, 11586 right anchor strings, 204673 test IPs. Some more contribs and updates from a new feed, and a few from a new data set. There were several other minor releases since 20100226; sorry to go so long without... schampeo http://enemieslist.com/ schampeo@hesketh.com 50279 patterns, 11586 right anchor strings, 204673 test IPs.

    Some more contribs and updates from a new feed, and a few from a new
    data set. There were several other minor releases since 20100226; sorry
    to go so long without posting release notices. I realize now that when I
    don't do the notices, people think I'm not updating the dataset, which
    is far from the case. So I'll try to post one every day I do any number
    of releases.

    Download them here:

    sendmail:
    http://enemieslist.com/downloads/sendmail_access_db
    http://enemieslist.com/downloads/rightanchors

    postfix:
    http://enemieslist.com/downloads/postfix_regexp_table
    http://enemieslist.com/downloads/postfix_regexp_table-20100304

    exim:
    http://enemieslist.com/downloads/exim_hosts
    http://enemieslist.com/downloads/exim_hosts-20100304

    ]]>     new pats posted - 20100226 (maintenance pats release) 2010-02-26T19:37:04Z 2010-02-26T19:34:09Z tag:enemieslist.com,2010:/news//2.1396 2010-02-26T19:34:09Z 50097 patterns, 11574 right anchor strings, 203530 test IPs. Some more contribs and updates from a new feed, and a few from a new data set. There were several other minor releases since 20100205; sorry to go so long without... schampeo http://enemieslist.com/ schampeo@hesketh.com 50097 patterns, 11574 right anchor strings, 203530 test IPs.

    Some more contribs and updates from a new feed, and a few from a new
    data set. There were several other minor releases since 20100205; sorry
    to go so long without posting release notices. I realize now that when I
    don't do the notices, people think I'm not updating the dataset, which
    is far from the case. So I'll try to post one every day I do any number
    of releases.

    Download them here:

    sendmail:
    http://enemieslist.com/downloads/sendmail_access_db
    http://enemieslist.com/downloads/rightanchors

    postfix:
    http://enemieslist.com/downloads/postfix_regexp_table
    http://enemieslist.com/downloads/postfix_regexp_table-20100226

    exim:
    http://enemieslist.com/downloads/exim_hosts
    http://enemieslist.com/downloads/exim_hosts-20100226

    ]]>     Why Netprospex Data is Worthless 2010-02-26T16:50:19Z 2010-02-25T22:56:39Z tag:enemieslist.com,2010:/news//2.1395 2010-02-25T22:56:39Z So, in this down economy, I've seen the amount of spam mail received here spike - and most of it is obviously being sent to addresses from purchased lists. Here are some sample Subject lines from some of this stuff:... schampeo http://enemieslist.com/ schampeo@hesketh.com So, in this down economy, I've seen the amount of spam mail received here spike - and most of it is obviously being sent to addresses from purchased lists. Here are some sample Subject lines from some of this stuff:

    Sept. 2, 2009: The Rich Media Marketer
Act Now and Save $100 on a Job Posting (Monster.com)
Patient Condition* (419/phish)
Change-Growth-Strategic Refocusing of Executive Talent (Barron/Carlington)
Are you prepared? (from my former colo, but they bought the address)
Linked-In Essentials for Executives - teleseminar - Two Days Left
Your keyword banners advertising demo - Place billboard on top of Google
Information Systems Opportunities (NETSHARE invite)
Conference call request (Thoughbot)
IT Consultants Onsite (hispeedstaffing.com)
Hi Steve I have a question for you (SEO Experts Inc.)
Evaluation of CRM solution (birlasoft.com)
2010 budget planning (openmetrik.com)
Business meeting invitation with Hesketh.com (Oxagile)
Complimentary Subscription Notification (businesswatchnetwork.com)
Reminder about your invitation from Epro Tech (via LinkedIn)
Current and Future EMC Celerra Customers (Graham Magnetics)
Limited Time Offer - Buy Two Job Postings and Save $135 (Monster.com)
FREE Webcast Invitation - "Thought Leadership Roundtable Webcast
        - Data Leakage" - CPE Credits - Register Now! (WhiteHatWorld.com)
The Post Office Now Brings Cake for the Holidays (postcake.com)

    This month has included Victoria's Secret Valentine's day spam, energy tax credits for window replacement, lots of recruiter/staffing companies, lead management software, network services, the usual Indian "request for meeting" outsourcing crap, diploma mill stuff, capital advisors, business phone solutions, WAN management software demos, wireless telecom services, Liberty Direct insurance, medical billing degrees, "Green IT Economic Summit" invite, Six Sigma workshops at Dartmouth, Sharepoint developer outsourcing, cheap auto insurance, free (actually "complementary", >snicker<) cruise, Prudential Financial insurance, Blue Star Infotech, "e-billboards" SEO spam, Singlesnet, satellite TV, Ziff Davis Enterprise spam, Dish Network, new cars, home warranties, term life insurance, more Dish Network, more auto insurance, and tax refund services.

    several of which even contained references to the address of our office from 2000-2005 (we've moved twice since then).

    How do I know the lists are purchased? Because the address that has seen nearly a fifth of the spam received here this month:

    • has never been used to send mail
    • has never been used to sign up for any mailing list
    • is an obvious e-pended creation from names and initials
    • has been seen in prospecting email from people who admitted they bought it
    • is actually used by ESPs to vet imported lists because of these facts
    • is associated with my informal name and ostensible title
    • is the target of mail containing the address of our old offices (from which we moved in March 2005)

    I'd seen a fair bit of mail to that address from people I asked about where they bought the list, and a couple of them even admitted to buying the list (both from Lead411). So I was already aware that there are services out there that:

    • make up addresses
    • make up some information to go along with them
    • don't verify the stuff that might actually be true
    • and then sell them to idiots

    I just didn't know the scope of the problem until I read an article recently mentioning Netprospex. The usual silly marketer mentality was in full evidence (read: "of course it's okay to email people you don't know, just don't do it in bulk!") and I figured I'd better check out whether or not Netprospex was any "better" than Lead411.

    There's a way to search for business by name, so I searched. I got three results, two of which were applicable to my company. The first, rated at "94% accuracy", and which claimed to have been "verified" (that's the CEO's tagline for Netprospex, remember) on October 23, 2009, was the name of our former CFO, who left the company altogether in early 2007. The second, rated at "61% accuracy", was for me, ostensibly the "Chief Technology Officer" of our tiny Web dev shop, and claimed to have been "verified" August 24, 2009. I didn't feel like spending $1.50 to download my own contact information, especially since they have us classified as part of the "Packaged Software Industry" (we build Web applications for not-for-profits, FWIW, you be the judge) but I suspect the address they have is incorrect.

    You can click through any contact, however, so I did - and got a popup showing our area code, the first digits of our former office's street address (we moved in June of 2008). Laughing uncontrollably at the train wreck that is Netprospex now, I clicked through the "94% accurate" and recently "verified" contact for our CFO - yes, they have the two-offices-ago address for her.

    Oh, and despite all the obvious effort they've gone through to collect and maintain this information about our company's officers, they don't have a record for our CEO and founder, after whom the company is named.

    In other words, Netprospex data is basically nothing more than comically embellished bullshit. Which you can pay for!

    ]]>     new pats posted - 20100205 (maintenance pats release) 2010-02-05T19:30:02Z 2010-02-05T19:28:17Z tag:enemieslist.com,2010:/news//2.1394 2010-02-05T19:28:17Z 48628 patterns, 11541 right anchor strings, 200106 test IPs. Some more contribs and updates from a new feed, and a few from a new data set. There were several other minor releases since 20100121; sorry to go so long without... schampeo http://enemieslist.com/ schampeo@hesketh.com 48628 patterns, 11541 right anchor strings, 200106 test IPs.

    Some more contribs and updates from a new feed, and a few from a new
    data set. There were several other minor releases since 20100121; sorry
    to go so long without posting release notices.

    Download them here:

    sendmail:
    http://enemieslist.com/downloads/sendmail_access_db
    http://enemieslist.com/downloads/rightanchors

    postfix:
    http://enemieslist.com/downloads/postfix_regexp_table
    http://enemieslist.com/downloads/postfix_regexp_table-20100205

    exim:
    http://enemieslist.com/downloads/exim_hosts
    http://enemieslist.com/downloads/exim_hosts-20100205

    ]]>     new pats posted - 20100121 (maintenance pats release) 2010-01-21T17:22:39Z 2010-01-21T17:19:26Z tag:enemieslist.com,2010:/news//2.1393 2010-01-21T17:19:26Z 48056 patterns, 11535 right anchor strings, 197381 test IPs. Some more contribs and updates from a new feed. There were several other minor releases since 20100114. Download them here: sendmail: http://enemieslist.com/downloads/sendmail_access_db http://enemieslist.com/downloads/rightanchors postfix: http://enemieslist.com/downloads/postfix_regexp_table http://enemieslist.com/downloads/postfix_regexp_table-20100121 exim: http://enemieslist.com/downloads/exim_hosts http://enemieslist.com/downloads/exim_hosts-20100121... schampeo http://enemieslist.com/ schampeo@hesketh.com 48056 patterns, 11535 right anchor strings, 197381 test IPs.

    Some more contribs and updates from a new feed. There were several other
    minor releases since 20100114.

    Download them here:

    sendmail:
    http://enemieslist.com/downloads/sendmail_access_db
    http://enemieslist.com/downloads/rightanchors

    postfix:
    http://enemieslist.com/downloads/postfix_regexp_table
    http://enemieslist.com/downloads/postfix_regexp_table-20100121

    exim:
    http://enemieslist.com/downloads/exim_hosts
    http://enemieslist.com/downloads/exim_hosts-20100121

    ]]>     Links Roundup 2010-01-20T21:55:32Z 2010-01-20T21:46:00Z tag:enemieslist.com,2010:/news//2.1392 2010-01-20T21:46:00Z ISPs could cut spam easily, says expertNL and TR have seen drops in the number of botnetted PCs? Really? Comcast and e360 settle lawsuit Settlement in Comcast v. e360Insight How is this a win for Comcast? Virus attack hits... schampeo http://enemieslist.com/ schampeo@hesketh.com
  • ISPs could cut spam easily, says expert
    NL and TR have seen drops in the number of botnetted PCs? Really?
  • Comcast and e360 settle lawsuit
  • Settlement in Comcast v. e360Insight
  • How is this a win for Comcast?
  • Virus attack hits Vista machines, cripples university network
  • How could I not? I am the hoopiest frood that ever lived.
  • Security architects fear savvy botnet attacks, IPv6 security issues
  • Why 2010 Could Be A Bad Year For 'Worst-Practice' Marketers
  • An "apples to apples" comparison of the top providers of email marketing software.
  • The Devil’s Dictionary, InfoSec Edition
  • China pays Web users to find porn amid crackdown
  • Do you know where your towel is?
  • GOODMAIL AND iCONTACT PARTNER TO OPTIMIZE EMAIL MARKETING CAMPAIGNS
    • ]]>     Links Roundup 2010-01-18T22:59:30Z 2010-01-18T22:44:16Z tag:enemieslist.com,2010:/news//2.1390 2010-01-18T22:44:16Z Whoa, dude! Whoa!HIL AR I OUS (more here.) Key ministry officials asked not to use Blackberry for emails MSNBOT must die! McAfee: Attackers on U.S. firms exploited new IE hole Researchers identify command servers behind Google attack I was... schampeo http://enemieslist.com/ schampeo@hesketh.com
  • Whoa, dude! Whoa!
    HIL AR I OUS (more here.)
  • Key ministry officials asked not to use Blackberry for emails
  • MSNBOT must die!
  • McAfee: Attackers on U.S. firms exploited new IE hole
  • Researchers identify command servers behind Google attack
  • I was a Doctor at an online pharmacy. I did not graduate High School. AMAA
  • Easiest Prediction Ever: Spam Will Suck in 2010
  • Targeted Attacks Against Google
  • Fraud U: Toppling a Bogus-Diploma Empire
  • Lethic botnet knocked out by security researchers
  • F-Secure's Exploit Shield blocks the "Aurora" exploit
  • AP Exclusive: Network flaw causes scary Web error
  • Microsoft confirms IE zero-day behind Google attack
  • U.S. to rebuke Chinese government over Google incident
    • ]]>     new pats posted - 20100114 (maintenance pats release) 2010-01-14T23:00:03Z 2010-01-14T22:27:26Z tag:enemieslist.com,2010:/news//2.1389 2010-01-14T22:27:26Z 47846 patterns, 11529 right anchor strings, 196960 test IPs. Some more contribs and updates from a new feed. There were several other minor releases since 20100111. By request from a licensee, I've changed the way we're classifying several mail servers;... schampeo http://enemieslist.com/ schampeo@hesketh.com 47846 patterns, 11529 right anchor strings, 196960 test IPs.

    Some more contribs and updates from a new feed. There were several other
    minor releases since 20100111.

    By request from a licensee, I've changed the way we're classifying
    several mail servers; this and subsequent releases will tag certain
    outmx patterns with the following "tech" keywords (currently only
    applies to Yahoo!, yahoo.com and yahoo.co.jp):

    commercial - this IP sends business-to-consumer mail
    corporate - this IP is a corporate mail server
    isp - this IP is a hosted/outsourced email service for an ISP

    I'll be using these where appropriate from now on, and going back to
    look at various ESPs' patterns, etc. and reclassifying them, too.

    Download them here:

    sendmail:
    http://enemieslist.com/downloads/sendmail_access_db
    http://enemieslist.com/downloads/rightanchors

    postfix:
    http://enemieslist.com/downloads/postfix_regexp_table
    http://enemieslist.com/downloads/postfix_regexp_table-20100114

    exim:
    http://enemieslist.com/downloads/exim_hosts
    http://enemieslist.com/downloads/exim_hosts-20100114

    ]]>     A New Metric for Gauging the Uselessness of a Given WHOIS Server 2010-01-11T22:33:47Z 2010-01-11T22:23:01Z tag:enemieslist.com,2010:/news//2.1388 2010-01-11T22:23:01Z I've decided that I am from now on going to rank WHOIS servers by the percentage of actual useful data returned in a query response to the amount of useless boilerplate cruft returned in the same query response. Right now,... schampeo http://enemieslist.com/ schampeo@hesketh.com I've decided that I am from now on going to rank WHOIS servers by the percentage of actual useful data returned in a query response to the amount of useless boilerplate cruft returned in the same query response. Right now, the .name WHOIS server is ranking near dead last.

    Nota bene: CIRA, by returning little useful information for many queries, but keeping its boilerplate/disclaimerese to a minimum, is screwing with my "rank by percentage" approach, but still.

    ]]>     new pats posted - 20100111 (maintenance pats release) 2010-01-11T18:02:50Z 2010-01-11T17:53:20Z tag:enemieslist.com,2010:/news//2.1387 2010-01-11T17:53:20Z 47616 patterns, 11529 right anchor strings, 196476 test IPs. Some more contribs and updates from a new feed. There were several other minor releases since 20091228. By request from a licensee, I've changed the way we're classifying several mail servers;... schampeo http://enemieslist.com/ schampeo@hesketh.com 47616 patterns, 11529 right anchor strings, 196476 test IPs.

    Some more contribs and updates from a new feed. There were several other
    minor releases since 20091228.

    By request from a licensee, I've changed the way we're classifying
    several mail servers; this and subsequent releases will tag certain
    outmx patterns with the following "tech" keywords (currently only
    applies to Yahoo!, yahoo.com and yahoo.co.jp):

    commercial - this IP sends business-to-consumer mail
    corporate - this IP is a corporate mail server
    isp - this IP is a hosted/outsourced email service for an ISP

    I'll be using these where appropriate from now on, and going back to
    look at various ESPs' patterns, etc. and reclassifying them, too.

    Download them here:

    sendmail:
    http://enemieslist.com/downloads/sendmail_access_db
    http://enemieslist.com/downloads/rightanchors

    postfix:
    http://enemieslist.com/downloads/postfix_regexp_table
    http://enemieslist.com/downloads/postfix_regexp_table-20100111

    exim:
    http://enemieslist.com/downloads/exim_hosts
    http://enemieslist.com/downloads/exim_hosts-20100111

    ]]>     Unhelpful 2010-01-03T18:12:53Z 2010-01-03T18:10:28Z tag:enemieslist.com,2010:/news//2.1386 2010-01-03T18:10:28Z 183.87.5.131.static-dynamic.nivyah.com [183.87.5.131] Looks like someone needs a dictionary.... schampeo http://enemieslist.com/ schampeo@hesketh.com 183.87.5.131.static-dynamic.nivyah.com [183.87.5.131]

    Looks like someone needs a dictionary.

    ]]>     new pats posted - 20091228 (maintenance pats release) 2009-12-28T14:07:44Z 2009-12-28T14:06:02Z tag:enemieslist.com,2009:/news//2.1384 2009-12-28T14:06:02Z 47396 patterns, 11503 right anchor strings, 194016 test IPs. Some more contribs and updates from a new feed. There were several other minor releases since 20091223. By request from a licensee, I've changed the way we're classifying several mail servers;... schampeo http://enemieslist.com/ schampeo@hesketh.com 47396 patterns, 11503 right anchor strings, 194016 test IPs.

    Some more contribs and updates from a new feed. There were several other
    minor releases since 20091223.

    By request from a licensee, I've changed the way we're classifying
    several mail servers; this and subsequent releases will tag certain
    outmx patterns with the following "tech" keywords (currently only
    applies to Yahoo!, yahoo.com and yahoo.co.jp):

    commercial - this IP sends business-to-consumer mail
    corporate - this IP is a corporate mail server
    isp - this IP is a hosted/outsourced email service for an ISP

    I'll be using these where appropriate from now on, and going back to
    look at various ESPs' patterns, etc. and reclassifying them, too.

    Download them here:

    sendmail:
    http://enemieslist.com/downloads/sendmail_access_db
    http://enemieslist.com/downloads/rightanchors

    postfix:
    http://enemieslist.com/downloads/postfix_regexp_table
    http://enemieslist.com/downloads/postfix_regexp_table-20091228

    exim:
    http://enemieslist.com/downloads/exim_hosts
    http://enemieslist.com/downloads/exim_hosts-20091228

    ]]>     new pats posted - 20091223 (maintenance pats release) 2009-12-23T17:04:08Z 2009-12-23T17:02:33Z tag:enemieslist.com,2009:/news//2.1383 2009-12-23T17:02:33Z 47348 patterns, 11498 right anchor strings, 193795 test IPs. Some more contribs and updates from a new feed. There were several other minor releases since 20091218. By request from a licensee, I've changed the way we're classifying several mail servers;... schampeo http://enemieslist.com/ schampeo@hesketh.com 47348 patterns, 11498 right anchor strings, 193795 test IPs.

    Some more contribs and updates from a new feed. There were several other
    minor releases since 20091218.

    By request from a licensee, I've changed the way we're classifying
    several mail servers; this and subsequent releases will tag certain
    outmx patterns with the following "tech" keywords (currently only
    applies to Yahoo!, yahoo.com and yahoo.co.jp):

    commercial - this IP sends business-to-consumer mail
    corporate - this IP is a corporate mail server
    isp - this IP is a hosted/outsourced email service for an ISP

    I'll be using these where appropriate from now on, and going back to
    look at various ESPs' patterns, etc. and reclassifying them, too.

    Download them here:

    sendmail:
    http://enemieslist.com/downloads/sendmail_access_db
    http://enemieslist.com/downloads/rightanchors

    postfix:
    http://enemieslist.com/downloads/postfix_regexp_table
    http://enemieslist.com/downloads/postfix_regexp_table-20091223

    exim:
    http://enemieslist.com/downloads/exim_hosts
    http://enemieslist.com/downloads/exim_hosts-20091223

    ]]>     new pats posted - 20091218 (maintenance pats release) 2009-12-18T20:52:46Z 2009-12-18T20:51:02Z tag:enemieslist.com,2009:/news//2.1382 2009-12-18T20:51:02Z 47167 patterns, 11502 right anchor strings, 193332 test IPs. Some more contribs and updates from a new feed. There were several other minor releases on 20091216 and yesterday. By request from a licensee, I've changed the way we're classifying several... schampeo http://enemieslist.com/ schampeo@hesketh.com 47167 patterns, 11502 right anchor strings, 193332 test IPs.

    Some more contribs and updates from a new feed. There were several other
    minor releases on 20091216 and yesterday.

    By request from a licensee, I've changed the way we're classifying
    several mail servers; this and subsequent releases will tag certain
    outmx patterns with the following "tech" keywords (currently only
    applies to Yahoo!, yahoo.com and yahoo.co.jp):

    commercial - this IP sends business-to-consumer mail
    corporate - this IP is a corporate mail server
    isp - this IP is a hosted/outsourced email service for an ISP

    I'll be using these where appropriate from now on, and going back to
    look at various ESPs' patterns, etc. and reclassifying them, too.

    Download them here:

    sendmail:
    http://enemieslist.com/downloads/sendmail_access_db
    http://enemieslist.com/downloads/rightanchors

    postfix:
    http://enemieslist.com/downloads/postfix_regexp_table
    http://enemieslist.com/downloads/postfix_regexp_table-20091218

    exim:
    http://enemieslist.com/downloads/exim_hosts
    http://enemieslist.com/downloads/exim_hosts-20091218

    ]]>