You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ben Wylie <sa...@benwylie.co.uk> on 2006/08/05 15:38:56 UTC
0451.com
A question for those of you who have large databases of spam and ham to
check, do genuine emails come from the domain 0451.com or whether it is
genuinely just spam?
I get a lot of spam claiming to be from emails on this domain, and if
there really are no genuine emails coming from that domain, i can
blacklist it.
Thanks
Ben
Re: 0451.com
Posted by Nigel Frankcom <ni...@blue-canoe.net>.
On Sat, 05 Aug 2006 14:38:56 +0100, Ben Wylie
<sa...@benwylie.co.uk> wrote:
>A question for those of you who have large databases of spam and ham to
>check, do genuine emails come from the domain 0451.com or whether it is
>genuinely just spam?
>
>I get a lot of spam claiming to be from emails on this domain, and if
>there really are no genuine emails coming from that domain, i can
>blacklist it.
>
>Thanks
>Ben
If they ever do send out ham I've not seen it. I have them in my local
blacklist and have done for a long time. None of my users has
complained yet. YMMV
Nigel
Re: 0451.com
Posted by Duncan Hill <sa...@nacnud.force9.co.uk>.
On Monday 07 August 2006 15:20, Obantec Support wrote:
> What would 192.com or 118118.com do without these names?
Deal with the fact that the RFCs don't support such names, and petition for a
new RFC that accomodates their names?
Other businesses have had no issues adapting to the requirements of the RFCs,
so why they should be singled out, I don't know.
Re: 0451.com
Posted by Tony Finch <do...@dotat.at>.
On Mon, 7 Aug 2006, Hamish wrote:
> Yeah, Right... And Verisign never wildcarded domains either did they? Duh!
> right back at you.
>
> > RFC 1123 section 2.1:
> >
> > The syntax of a legal Internet host name was specified in RFC-952
>
> Hostname vs DomainName
The domain name system itself doesn't have any restrictions on labels:
they are counted binary strings and can contain embedded nul bytes or even
dots (see RFC 1035 section 5.1 for an example). Traditionally, RFC 952
host name syntax (as updated by RFC 1123) has also been used for mail
domains and delegations from TLDs.
The host name syntax described in RFC 1035 is informative, not normative.
RFC 1912 is also informative, and it obviously misinterprets RFC 1123
which clearly allows all-numeric labels.
All RFCs are not created equal and the earlier ones especially must be
interpreted intelligently.
Tony.
--
f.a.n.finch <do...@dotat.at> http://dotat.at/
FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4. FAIR. MODERATE OR
GOOD.
Re: 0451.com
Posted by Hamish <ha...@travellingkiwi.com>.
On Monday 07 August 2006 16:09, Tony Finch wrote:
> On Mon, 7 Aug 2006, Hamish Marson wrote:
> > The RFC's actually state that a domain MUST start with a letter, and
> > be any letter or digit or hyphen after. So according to the RFC's
> > purely numberic domains are illegal.
>
> No! Wrong! Totally wrong! If they were illegal they would never have been
> allocated. Duh.
>
Yeah, Right... And Verisign never wildcarded domains either did they? Duh!
right back at you.
> RFC 1123 section 2.1:
>
> The syntax of a legal Internet host name was specified in RFC-952
Hostname vs DomainName
RFC1035 is still current. never superceeded. It states Domain names. RFC1123
says hostnames... In fact RFC1035 isn't even marked as updated! (At least the
copies I'm looking at now)
AFAICS RFC1123 only mentions hostnames, nothing about domains. A small
semantic difference I know, but possibly an important one. I wonder what
Cricket has to say about domain names being all digits? Possibly it comes
under the be lenient in what you accept & rigid in what you present rule.
RFC1912 throws more wood on the fire...
****************************
Allowable characters in a label for a host name are only ASCII
letters, digits, and the `-' character. Labels may not be all
numbers, but may have a leading digit (e.g., 3com.com). Labels must
end and begin only with a letter or digit. See [RFC 1035] and [RFC
1123]. (Labels were initially restricted in [RFC 1035] to start with
a letter, and some older hosts still reportedly have problems with
the relaxation in [RFC 1123].) Note there are some Internet
hostnames which violate this rule (411.org, 1776.com). The presence
of underscores in a label is allowed in [RFC 1033], except [RFC 1033]
is informational only and was not defining a standard. There is at
least one popular TCP/IP implementation which currently refuses to
talk to hosts named with underscores in them. It must be noted that
the language in [1035] is such that these rules are voluntary -- they
are there for those who wish to minimize problems. Note that the
rules for Internet host names also apply to hosts and addresses used
in SMTP (See RFC 821).
****************************
So even rfc1912 still thinks all digit domains are incorrect... But it
interprets 1123 as meaning hosts & domains. But even in 1996 it was
recognised that the registrars didn't really follow the RFC's properly...
I still think all digit domains are probably worth a point or so.
> [DNS:4]. One aspect of host name syntax is hereby changed: the
> restriction on the first character is relaxed to allow either a
> letter or a digit. Host software MUST support this more liberal
> syntax.
>
> Tony.
Re: 0451.com
Posted by Logan Shaw <ls...@emitinc.com>.
On Mon, 7 Aug 2006, Tony Finch wrote:
> On Mon, 7 Aug 2006, Hamish Marson wrote:
>> The RFC's actually state that a domain MUST start with a letter, and
>> be any letter or digit or hyphen after. So according to the RFC's
>> purely numberic domains are illegal.
>
> No! Wrong! Totally wrong! If they were illegal they would never have been
> allocated. Duh.
>
> RFC 1123 section 2.1:
>
> The syntax of a legal Internet host name was specified in RFC-952
> [DNS:4]. One aspect of host name syntax is hereby changed: the
> restriction on the first character is relaxed to allow either a
> letter or a digit. Host software MUST support this more liberal
> syntax.
Ah, I thought I remembered something along those lines but
couldn't find the reference.
Also, for what it's worth, there are some legitimate businesses
that use domains beginning with a digit. 3Com, for instance.
- Logan
Re: 0451.com
Posted by "John D. Hardin" <jh...@impsec.org>.
On Mon, 7 Aug 2006, Tony Finch wrote:
> On Mon, 7 Aug 2006, Hamish Marson wrote:
> >
> > The RFC's actually state that a domain MUST start with a letter, and
> > be any letter or digit or hyphen after. So according to the RFC's
> > purely numberic domains are illegal.
>
> No! Wrong! Totally wrong! If they were illegal they would never have been
> allocated. Duh.
>
> RFC 1123 section 2.1:
>
> The syntax of a legal Internet host name was specified in RFC-952
> [DNS:4]. One aspect of host name syntax is hereby changed: the
> restriction on the first character is relaxed to allow either a
> letter or a digit. Host software MUST support this more liberal
> syntax.
...I guess not. Dammit, when am I going to learn to read my mailbox in
*reverse* chronological order?
--
John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The difference is that Unix has had thirty years of technical
types demanding basic functionality of it. And the Macintosh has
had fifteen years of interface fascist users shaping its progress.
Windows has the hairpin turns of the Microsoft marketing machine
and that's all. -- Red Drag Diva
-----------------------------------------------------------------------
Re: 0451.com
Posted by Tony Finch <do...@dotat.at>.
On Mon, 7 Aug 2006, Hamish Marson wrote:
>
> The RFC's actually state that a domain MUST start with a letter, and
> be any letter or digit or hyphen after. So according to the RFC's
> purely numberic domains are illegal.
No! Wrong! Totally wrong! If they were illegal they would never have been
allocated. Duh.
RFC 1123 section 2.1:
The syntax of a legal Internet host name was specified in RFC-952
[DNS:4]. One aspect of host name syntax is hereby changed: the
restriction on the first character is relaxed to allow either a
letter or a digit. Host software MUST support this more liberal
syntax.
Tony.
--
f.a.n.finch <do...@dotat.at> http://dotat.at/
FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4. FAIR. MODERATE OR
GOOD.
Re: 0451.com
Posted by jdow <jd...@earthlink.net>.
From: "Hamish Marson" <ha...@travellingkiwi.com>
> Duncan Hill wrote:
>> On Monday 07 August 2006 00:02, QQQQ wrote:
>>> | 2250 0733.com
>>
>>> Here are my numbers from last week:
>>>
>>> 5006 0451.com 3845 53.com
>>
>> Not seeing anywhere near as high, but this is only on my personal
>> server: 44 0733.com 34 0451.com 11 0668.com 4 023.com
>> 2 08.com 2 020.com 1 212.com 1 07770500.com 1
>> 01191.com 1 004.com
>>
>> However, the majority are already being rejected with my standard
>> rules in Postfix (like don't accept mail from certain netblocks).
>> I would have sworn there used to be a domain registration rule that
>> said pure-numeric domains were illegal, but I'm not sure.
>
> The RFC's actually state that a domain MUST start with a letter, and
> be any letter or digit or hyphen after. So according to the RFC's
> purely numberic domains are illegal.
>
> (e.g. From RFC 1035)
>
> <domain> ::= <subdomain> | " "
>
> <subdomain> ::= <label> | <subdomain> "." <label>
>
> <label> ::= <letter> [ [ <ldh-str> ] <let-dig> ]
>
> <ldh-str> ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>
>
> <let-dig-hyp> ::= <let-dig> | "-"
>
> <let-dig> ::= <letter> | <digit>
>
> <letter> ::= any one of the 52 alphabetic characters A through Z in
> upper case and a through z in lower case
>
> <digit> ::= any one of the ten digits 0 through 9
>
>
> Seems clear to me... And since RFC1035 is still current, I'm not sure why
> purely numeric domains are considered acceptable. (Apart from I can't
> think
> of a really good reason apart from pedanticness to stop them).
Well, some browsers allow you to put in "google" for the address and
will self-complete to what it thinks you wants. If there is a number
only in there the browser will likely try to interpret the number
as an 32 IP address in decimal form.
All those addresses would hit network 0, though. And that is a reserved
net number.
{^_-}
Re: 0451.com
Posted by Obantec Support <su...@obantec.net>.
----- Original Message -----
From: "Hamish Marson" <ha...@travellingkiwi.com>
To: "Duncan Hill" <sa...@nacnud.force9.co.uk>
Cc: <us...@spamassassin.apache.org>
Sent: Monday, August 07, 2006 3:11 PM
Subject: Re: 0451.com
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Duncan Hill wrote:
> > On Monday 07 August 2006 00:02, QQQQ wrote:
> >> | 2250 0733.com
> >
> >> Here are my numbers from last week:
> >>
> >> 5006 0451.com 3845 53.com
> >
> > Not seeing anywhere near as high, but this is only on my personal
> > server: 44 0733.com 34 0451.com 11 0668.com 4 023.com
> > 2 08.com 2 020.com 1 212.com 1 07770500.com 1
> > 01191.com 1 004.com
> >
> > However, the majority are already being rejected with my standard
> > rules in Postfix (like don't accept mail from certain netblocks).
> > I would have sworn there used to be a domain registration rule that
> > said pure-numeric domains were illegal, but I'm not sure.
>
> The RFC's actually state that a domain MUST start with a letter, and
> be any letter or digit or hyphen after. So according to the RFC's
> purely numberic domains are illegal.
>
> (e.g. From RFC 1035)
>
> <domain> ::= <subdomain> | " "
>
> <subdomain> ::= <label> | <subdomain> "." <label>
>
> <label> ::= <letter> [ [ <ldh-str> ] <let-dig> ]
>
> <ldh-str> ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>
>
> <let-dig-hyp> ::= <let-dig> | "-"
>
> <let-dig> ::= <letter> | <digit>
>
> <letter> ::= any one of the 52 alphabetic characters A through Z in
> upper case and a through z in lower case
>
> <digit> ::= any one of the ten digits 0 through 9
>
>
> Seems clear to me... And since RFC1035 is still current, I'm not sure why
> purely numeric domains are considered acceptable. (Apart from I can't
> think
> of a really good reason apart from pedanticness to stop them).
>
> Hamish,
>
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFE10oj/3QXwQQkZYwRAiq3AJ9aPoHZ7M6Bdmhf2E093xX8iOlCMACePBe8
> pgAwacs61+KKqglxUcMr9vs=
> =kn09
> -----END PGP SIGNATURE-----
>
What would 192.com or 118118.com do without these names?
Mark
Re: 0451.com
Posted by "John D. Hardin" <jh...@impsec.org>.
On Mon, 7 Aug 2006, Hamish Marson wrote:
> The RFC's actually state that a domain MUST start with a letter, and
> be any letter or digit or hyphen after. So according to the RFC's
> purely numberic domains are illegal.
Should this be worth a point or so in the base ruleset?
--
John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The difference is that Unix has had thirty years of technical
types demanding basic functionality of it. And the Macintosh has
had fifteen years of interface fascist users shaping its progress.
Windows has the hairpin turns of the Microsoft marketing machine
and that's all. -- Red Drag Diva
-----------------------------------------------------------------------
Re: 0451.com
Posted by Hamish Marson <ha...@travellingkiwi.com>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Duncan Hill wrote:
> On Monday 07 August 2006 00:02, QQQQ wrote:
>> | 2250 0733.com
>
>> Here are my numbers from last week:
>>
>> 5006 0451.com 3845 53.com
>
> Not seeing anywhere near as high, but this is only on my personal
> server: 44 0733.com 34 0451.com 11 0668.com 4 023.com
> 2 08.com 2 020.com 1 212.com 1 07770500.com 1
> 01191.com 1 004.com
>
> However, the majority are already being rejected with my standard
> rules in Postfix (like don't accept mail from certain netblocks).
> I would have sworn there used to be a domain registration rule that
> said pure-numeric domains were illegal, but I'm not sure.
The RFC's actually state that a domain MUST start with a letter, and
be any letter or digit or hyphen after. So according to the RFC's
purely numberic domains are illegal.
(e.g. From RFC 1035)
<domain> ::= <subdomain> | " "
<subdomain> ::= <label> | <subdomain> "." <label>
<label> ::= <letter> [ [ <ldh-str> ] <let-dig> ]
<ldh-str> ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>
<let-dig-hyp> ::= <let-dig> | "-"
<let-dig> ::= <letter> | <digit>
<letter> ::= any one of the 52 alphabetic characters A through Z in
upper case and a through z in lower case
<digit> ::= any one of the ten digits 0 through 9
Seems clear to me... And since RFC1035 is still current, I'm not sure why
purely numeric domains are considered acceptable. (Apart from I can't
think
of a really good reason apart from pedanticness to stop them).
Hamish,
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFE10oj/3QXwQQkZYwRAiq3AJ9aPoHZ7M6Bdmhf2E093xX8iOlCMACePBe8
pgAwacs61+KKqglxUcMr9vs=
=kn09
-----END PGP SIGNATURE-----
RE: 0451.com
Posted by "Gary D. Margiotta" <ga...@tbe.net>.
On Mon, 7 Aug 2006, Sietse van Zanen wrote:
> OK than let's put this in another 'political' context:
>
> Caring about 'legitimate' e-mail coming from those domains would be like
> caring for the few 'legitimate' bombs dropped over Iraq, Afghanistan or
> Lebanon.
>
> It would indeed be better to have no bombs at all........
>
> -Sietse
>
First off, STOP top-posting.
Secondly, let's keeps the political contexts, views, and any other
personal beliefs off of this technical mailing list. No, I am not saying
this to express my beliefs on what you're talking about either way, this
is no place for that type of discussion.
If you want to talk politics or whether your take on any conflict is
right, just, "leitimate", or whatever, then take it to a political
discussion board and you can talk all day long.
Now, back on topic please.
-Gary
> ________________________________
>
> From: Tony Finch on behalf of Tony Finch
> Sent: Mon 07-Aug-06 13:26
> To: Sietse van Zanen
> Cc: users@spamassassin.apache.org
> Subject: RE: 0451.com
>
>
>
> On Mon, 7 Aug 2006, Sietse van Zanen wrote:
>
>> Caring about 'legitimate' e-mail coming from these domains would be like
>> caring about the 'legitimate' claims of Bush saying he is a true
>> christian.......
>
> All-numeric domains are popular in China because they are easier for
> people to deal with than alphabetic domains. For example, 263.com is
> China's second-largest ISP. You can't just assume that an all-numeric
> domain is necessarily abusive, any more so than Yahoo or Fastmail.
>
> Tony.
> --
> f.a.n.finch <do...@dotat.at> http://dotat.at/
> FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4. FAIR. MODERATE OR
> GOOD.
>
>
RE: 0451.com
Posted by Sietse van Zanen <si...@wizdom.nu>.
OK than let's put this in another 'political' context:
Caring about 'legitimate' e-mail coming from those domains would be like caring for the few 'legitimate' bombs dropped over Iraq, Afghanistan or Lebanon.
It would indeed be better to have no bombs at all........
-Sietse
________________________________
From: Tony Finch on behalf of Tony Finch
Sent: Mon 07-Aug-06 13:26
To: Sietse van Zanen
Cc: users@spamassassin.apache.org
Subject: RE: 0451.com
On Mon, 7 Aug 2006, Sietse van Zanen wrote:
> Caring about 'legitimate' e-mail coming from these domains would be like
> caring about the 'legitimate' claims of Bush saying he is a true
> christian.......
All-numeric domains are popular in China because they are easier for
people to deal with than alphabetic domains. For example, 263.com is
China's second-largest ISP. You can't just assume that an all-numeric
domain is necessarily abusive, any more so than Yahoo or Fastmail.
Tony.
--
f.a.n.finch <do...@dotat.at> http://dotat.at/
FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4. FAIR. MODERATE OR
GOOD.
Re: 0451.com
Posted by Ralf Hildebrandt <Ra...@charite.de>.
* Nigel Frankcom <ni...@blue-canoe.net>:
> http://en.wikipedia.org/wiki/263
>
> A few options there... - though it could as easily be their building
> address...
I'd rather go for http://en.wikipedia.org/wiki/263_(number)
and then settle for http://en.wikipedia.org/wiki/Chen_prime
--
Ralf Hildebrandt (i.A. des IT-Zentrums) Ralf.Hildebrandt@charite.de
Charite - Universitätsmedizin Berlin Tel. +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-Berlin Fax. +49 (0)30-450 570-962
IT-Zentrum Standort CBF send no mail to spamtrap@charite.de
Re: 0451.com
Posted by Nigel Frankcom <ni...@blue-canoe.net>.
On Thu, 10 Aug 2006 18:04:06 -0400, Bill Horne
<sa...@billhorne.homelinux.org> wrote:
>On Mon, Aug 07, 2006 at 01:29:36PM +0200, Ralf Hildebrandt wrote:
>> * Tony Finch <do...@dotat.at>:
>>
>> > All-numeric domains are popular in China because they are easier for
>> > people to deal with than alphabetic domains. For example, 263.com is
>> > China's second-largest ISP. You can't just assume that an all-numeric
>> > domain is necessarily abusive, any more so than Yahoo or Fastmail.
>>
>> Is there any meaning to "263" in Chinese?
>
>It's either the average annual wage of a Wal-Mart supplier, or the
>number of years that Mao predicted it would take the Revolution to
>destroy the Great Satan[tm].
>
>YMMV.
>
>William
>
http://en.wikipedia.org/wiki/263
A few options there... - though it could as easily be their building
address...
Re: 0451.com
Posted by Bill Horne <sa...@billhorne.homelinux.org>.
On Mon, Aug 07, 2006 at 01:29:36PM +0200, Ralf Hildebrandt wrote:
> * Tony Finch <do...@dotat.at>:
>
> > All-numeric domains are popular in China because they are easier for
> > people to deal with than alphabetic domains. For example, 263.com is
> > China's second-largest ISP. You can't just assume that an all-numeric
> > domain is necessarily abusive, any more so than Yahoo or Fastmail.
>
> Is there any meaning to "263" in Chinese?
It's either the average annual wage of a Wal-Mart supplier, or the
number of years that Mao predicted it would take the Revolution to
destroy the Great Satan[tm].
YMMV.
William
Re: 0451.com
Posted by Ralf Hildebrandt <Ra...@charite.de>.
* Tony Finch <do...@dotat.at>:
> All-numeric domains are popular in China because they are easier for
> people to deal with than alphabetic domains. For example, 263.com is
> China's second-largest ISP. You can't just assume that an all-numeric
> domain is necessarily abusive, any more so than Yahoo or Fastmail.
Is there any meaning to "263" in Chinese?
--
Ralf Hildebrandt (i.A. des IT-Zentrums) Ralf.Hildebrandt@charite.de
Charite - Universitätsmedizin Berlin Tel. +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-Berlin Fax. +49 (0)30-450 570-962
IT-Zentrum Standort CBF send no mail to spamtrap@charite.de
RE: 0451.com
Posted by Tony Finch <do...@dotat.at>.
On Mon, 7 Aug 2006, Sietse van Zanen wrote:
> Caring about 'legitimate' e-mail coming from these domains would be like
> caring about the 'legitimate' claims of Bush saying he is a true
> christian.......
All-numeric domains are popular in China because they are easier for
people to deal with than alphabetic domains. For example, 263.com is
China's second-largest ISP. You can't just assume that an all-numeric
domain is necessarily abusive, any more so than Yahoo or Fastmail.
Tony.
--
f.a.n.finch <do...@dotat.at> http://dotat.at/
FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4. FAIR. MODERATE OR
GOOD.
RE: 0451.com
Posted by Sietse van Zanen <si...@wizdom.nu>.
Caring about 'legitimate' e-mail coming from these domains would be like caring about the 'legitimate' claims of Bush saying he is a true christian.......
-Sietse
________________________________
From: Nigel Frankcom [mailto:nigel@blue-canoe.net]
Sent: Mon 07-Aug-06 11:32
To: users@spamassassin.apache.org
Subject: Re: 0451.com
On Mon, 7 Aug 2006 08:21:41 +0100, Duncan Hill
<sa...@nacnud.force9.co.uk> wrote:
>On Monday 07 August 2006 00:02, QQQQ wrote:
>> | 2250 0733.com
>
>> Here are my numbers from last week:
>>
>> 5006 0451.com
>> 3845 53.com
>
>Not seeing anywhere near as high, but this is only on my personal server:
>44 0733.com
>34 0451.com
>11 0668.com
>4 023.com
>2 08.com
>2 020.com
>1 212.com
>1 07770500.com
>1 01191.com
>1 004.com
>
>However, the majority are already being rejected with my standard rules in
>Postfix (like don't accept mail from certain netblocks). I would have sworn
>there used to be a domain registration rule that said pure-numeric domains
>were illegal, but I'm not sure.
Daily stats for 0451.com... we are by no means a large mail operation.
Pretty safe to say they don't send any legitimate mail out I think.
Date Count
060701 = 146
060702 = 152
060703 = 121
060704 = 419
060705 = 479
060706 = 135
060707 = 81
060708 = 77
060709 = 48
060710 = 30
060711 = 270
060712 = 128
060713 = 53
060714 = 111
060715 = 56
060716 = 100
060717 = 74
060718 = 71
060719 = 103
060720 = 86
060721 = 186
060722 = 85
060723 = 107
060724 = 90
060725 = 15
060726 = 114
060727 = 86
060728 = 110
060729 = 103
060730 = 102
060731 = 117
060801 = 119
060802 = 63
060803 = 83
060804 = 153
060805 = 132
060806 = 149
------------------------
Total = 4554
Re: 0451.com
Posted by Nigel Frankcom <ni...@blue-canoe.net>.
On Mon, 7 Aug 2006 08:21:41 +0100, Duncan Hill
<sa...@nacnud.force9.co.uk> wrote:
>On Monday 07 August 2006 00:02, QQQQ wrote:
>> | 2250 0733.com
>
>> Here are my numbers from last week:
>>
>> 5006 0451.com
>> 3845 53.com
>
>Not seeing anywhere near as high, but this is only on my personal server:
>44 0733.com
>34 0451.com
>11 0668.com
>4 023.com
>2 08.com
>2 020.com
>1 212.com
>1 07770500.com
>1 01191.com
>1 004.com
>
>However, the majority are already being rejected with my standard rules in
>Postfix (like don't accept mail from certain netblocks). I would have sworn
>there used to be a domain registration rule that said pure-numeric domains
>were illegal, but I'm not sure.
Daily stats for 0451.com... we are by no means a large mail operation.
Pretty safe to say they don't send any legitimate mail out I think.
Date Count
060701 = 146
060702 = 152
060703 = 121
060704 = 419
060705 = 479
060706 = 135
060707 = 81
060708 = 77
060709 = 48
060710 = 30
060711 = 270
060712 = 128
060713 = 53
060714 = 111
060715 = 56
060716 = 100
060717 = 74
060718 = 71
060719 = 103
060720 = 86
060721 = 186
060722 = 85
060723 = 107
060724 = 90
060725 = 15
060726 = 114
060727 = 86
060728 = 110
060729 = 103
060730 = 102
060731 = 117
060801 = 119
060802 = 63
060803 = 83
060804 = 153
060805 = 132
060806 = 149
------------------------
Total = 4554
Re: 0451.com
Posted by Duncan Hill <sa...@nacnud.force9.co.uk>.
On Monday 07 August 2006 00:02, QQQQ wrote:
> | 2250 0733.com
> Here are my numbers from last week:
>
> 5006 0451.com
> 3845 53.com
Not seeing anywhere near as high, but this is only on my personal server:
44 0733.com
34 0451.com
11 0668.com
4 023.com
2 08.com
2 020.com
1 212.com
1 07770500.com
1 01191.com
1 004.com
However, the majority are already being rejected with my standard rules in
Postfix (like don't accept mail from certain netblocks). I would have sworn
there used to be a domain registration rule that said pure-numeric domains
were illegal, but I'm not sure.
Re: 0451.com
Posted by QQQQ <qq...@usermail.com>.
| 2250 0733.com
| 1882 0451.com
| 89 072.com
| 62 006.com
| 58 1039.com
| 52 163.com
| 32 0668.com
| 31 004.com
| 19 126.com
| 13 mail.0451.com
|
| Panagiotis
Here are my numbers from last week:
5006 0451.com
3845 53.com
2253 0733.com
440 mail.0451.com
204 006.com
146 004.com
133 61.187.98.10
118 08.com
101 072.com
Re: 0451.com
Posted by "John D. Hardin" <jh...@impsec.org>.
On Sun, 6 Aug 2006, Panagiotis Christias wrote:
> and not only them according to our daily sendmail logs:
>
> 2484 0733.com
> 2449 0451.com
...etc
I've also seen 0541.com in my logs.
--
John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Windows Genuine Advantage (WGA) means that now you use your
computer at the sufferance of Microsoft Corporation. They can
kill it remotely without your consent at any time for any reason.
-----------------------------------------------------------------------
Re: 0451.com
Posted by Panagiotis Christias <ch...@gmail.com>.
and not only them according to our daily sendmail logs:
# egrep '@[0-9]+\.com' YESTERDAY | sed -e 's/^.*@//' -e 's/>.*$//' |
sort | uniq -c | sort -rn | head
2484 0733.com
2449 0451.com
100 072.com
66 1039.com
52 006.com
51 0668.com
40 004.com
37 163.com
18 126.com
15 mail.0451.com
# egrep '@[0-9]+\.com' TODAY | sed -e 's/^.*@//' -e 's/>.*$//' | sort
| uniq -c | sort -rn | head
2250 0733.com
1882 0451.com
89 072.com
62 006.com
58 1039.com
52 163.com
32 0668.com
31 004.com
19 126.com
13 mail.0451.com
Panagiotis
Re: 0451.com
Posted by Obantec Support <su...@obantec.net>.
----- Original Message -----
From: "Ben Wylie" <sa...@benwylie.co.uk>
To: <us...@spamassassin.apache.org>
Sent: Saturday, August 05, 2006 2:38 PM
Subject: 0451.com
> A question for those of you who have large databases of spam and ham to
> check, do genuine emails come from the domain 0451.com or whether it is
> genuinely just spam?
>
> I get a lot of spam claiming to be from emails on this domain, and if
> there really are no genuine emails coming from that domain, i can
> blacklist it.
>
> Thanks
> Ben
>
>
>
Only ever seen spam from 0451.com so i have them discarded in my sendmail
access.db
Mark