Mailing List Archive

heads up for false uribl black hits
By now most of you are aware of the hostile takeover of freenode and the
mass exodus that's currently underway (if not see kline.sh for more)
[1]

Interestingly it seems uribl.com has the replacement, Im going to
obfuscate it else you wont likely see this :) just replace digits with
their alpha lib3ra dott ch4t

in their listings, interesting because they dont seem to list new
domains that way and that one is new, heh maybe andrew lee controls that
too, who knows...

Anyway if you are trying to get nickserv confirmation required email and
don't, check your junk folders.

--
Regards,
Noel Butler

This Email, including attachments, may contain legally privileged
information, therefore at all times remains confidential and subject to
copyright protected under international law. You may not disseminate
this message without the authors express written authority to do so.
If you are not the intended recipient, please notify the sender then
delete all copies of this message including attachments immediately.
Confidentiality, copyright, and legal privilege are not waived or lost
by reason of the mistaken delivery of this message.



Links:
------
[1] https://kline.sh
Re: heads up for false uribl black hits [ In reply to ]
On 2021-05-19 at 21:13:41 UTC-0400 (Thu, 20 May 2021 11:13:41 +1000)
Noel Butler <noel.butler@ausics.net>
is rumored to have said:

> By now most of you are aware of the hostile takeover of freenode and
> the mass exodus that's currently underway (if not see kline.sh for
> more) [1]
>
> Interestingly it seems uribl.com has the replacement, Im going to
> obfuscate it else you wont likely see this :) just replace digits
> with their alpha lib3ra dott ch4t
>
> in their listings, interesting because they dont seem to list new
> domains that way and that one is new, heh maybe andrew lee controls
> that too, who knows...

The new domain was NOT listed in any RHSBL at 13:55 UTC.

OTOH, they didn't like something about my usual single-venue address
pattern so I had to register with an alternative tagging pattern.

--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire
Re: heads up for false uribl black hits [ In reply to ]
On 20/05/2021 11:58, Bill Cole wrote:

> On 2021-05-19 at 21:13:41 UTC-0400 (Thu, 20 May 2021 11:13:41 +1000)
> Noel Butler <noel.butler@ausics.net>
> is rumored to have said:
>
>> By now most of you are aware of the hostile takeover of freenode and
>> the mass exodus that's currently underway (if not see kline.sh for
>> more) [1]
>>
>> Interestingly it seems uribl.com has the replacement, Im going to
>> obfuscate it else you wont likely see this :) just replace digits
>> with their alpha lib3ra dott ch4t
>>
>> in their listings, interesting because they dont seem to list new
>> domains that way and that one is new, heh maybe andrew lee controls
>> that too, who knows...
>
> The new domain was NOT listed in any RHSBL at 13:55 UTC.
>
> OTOH, they didn't like something about my usual single-venue address
> pattern so I had to register with an alternative tagging pattern.

still listed in URI
Domain Status Manage
libexxxx.cxxx Listed on URIBL black

at 02:46 UTC

someone has made a delist request about 8 hours ago though

strange that a service that has a policy of not saying why they list is
included in default SA

(btw - I have no affiliation with either party - I'm just mentioning it
here since its where I found my confirm request)

--
Regards,
Noel Butler

This Email, including attachments, may contain legally privileged
information, therefore at all times remains confidential and subject to
copyright protected under international law. You may not disseminate
this message without the authors express written authority to do so.
If you are not the intended recipient, please notify the sender then
delete all copies of this message including attachments immediately.
Confidentiality, copyright, and legal privilege are not waived or lost
by reason of the mistaken delivery of this message.
Re: heads up for false uribl black hits [ In reply to ]
Bill Cole wrote on 20/05/21 1:58 pm:
> The new domain was NOT listed in any RHSBL at 13:55 UTC.

The first of its four ip addresses, 185.199.108.153, is on
sbl.spamhaus.org but not the domain name.

That is the only match that shows up in the list of RBLs checked at
ant-abuse.org Multi-RBL Check, which seems to convert to ip address for
its checks, or maybe checks each by both name and ip address.

The domain, but not the ip address, does show up at uribl.com. They
don't provide any explanation for entries on the list.
Re: heads up for false uribl black hits [ In reply to ]
On Thu, 20 May 2021, Noel Butler wrote:

> On 20/05/2021 11:58, Bill Cole wrote:
>
>> On 2021-05-19 at 21:13:41 UTC-0400 (Thu, 20 May 2021 11:13:41 +1000)
>> Noel Butler <noel.butler@ausics.net>
>> is rumored to have said:
>>
>>> By now most of you are aware of the hostile takeover of freenode and the
>>> mass exodus that's currently underway (if not see kline.sh for more) [1]
>>>
>>> Interestingly it seems uribl.com has the replacement, Im going to
>>> obfuscate it else you wont likely see this :) just replace digits with
>>> their alpha lib3ra dott ch4t
>>>
>>> in their listings, interesting because they dont seem to list new domains
>>> that way and that one is new, heh maybe andrew lee controls that too, who
>>> knows...
>>
>> The new domain was NOT listed in any RHSBL at 13:55 UTC.
>>
>> OTOH, they didn't like something about my usual single-venue address
>> pattern so I had to register with an alternative tagging pattern.
>
> still listed in URI
> Domain Status Manage
> libexxxx.cxxx Listed on URIBL black

Odd, the URIBL website lookup tool says libera (.chat) is not listed,
and didn't yesterday when you first posted this.

https://admin.uribl.com/


Lookup Results (obfuscated just in case)
Domain Status
libera_chat NOT Listed on URIBL


Is that not working correctly?


--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
355 days since the first private commercial manned orbital mission (SpaceX)
Re: heads up for false uribl black hits [ In reply to ]
On 2021-05-20 16:28, John Hardin wrote:
> On Thu, 20 May 2021, Noel Butler wrote:

> Odd, the URIBL website lookup tool says libera (.chat) is not listed,
> and didn't yesterday when you first posted this.

> Is that not working correctly?

only place i find it https://spameatingmonkey.com/lookup/libera.chat
Re: heads up for false uribl black hits [ In reply to ]
On 20/05/21 18:59, Benny Pedersen wrote:

>
>> Is that not working correctly?
>
> only place i find it https://spameatingmonkey.com/lookup/libera.chat

Hi,

by checking: http://multirbl.valli.org/lookup/libera.chat.html

it looks like that is indeed listed on URIBL too:
http://lookup.uribl.com/?domain=libera.chat

Ot at least it is *now* , maybe it comes and goes for some reasons

--
Best regards,
Riccardo Alfieri

Spamhaus Technology
https://www.spamhaustech.com/
Re: heads up for false uribl black hits [ In reply to ]
On Thu, 20 May 2021, Riccardo Alfieri wrote:

> On 20/05/21 18:59, Benny Pedersen wrote:
>
>>
>>> Is that not working correctly?
>>
>> only place i find it https://spameatingmonkey.com/lookup/libera.chat
>
> Hi,
>
> by checking: http://multirbl.valli.org/lookup/libera.chat.html
>
> it looks like that is indeed listed on URIBL too:
> http://lookup.uribl.com/?domain=libera.chat
>
> Ot at least it is *now* , maybe it comes and goes for some reasons

...and now it's listed at https://admin.uribl.com/ as well.


--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
To be civilized is to restrain the ability to commit mayhem.
To be incapable of committing mayhem is not the mark of the
civilized, merely the domesticated. -- Trefor Thomas
-----------------------------------------------------------------------
355 days since the first private commercial manned orbital mission (SpaceX)
Re: heads up for false uribl black hits [ In reply to ]
John Hardin wrote on 21/05/21 2:28 am:
>
> Odd, the URIBL website lookup tool says libera (.chat) is not listed,
> and didn't yesterday when you first posted this.
>
> https://admin.uribl.com/
>
>
> Lookup Results (obfuscated just in case)
> Domain Status
> libera_chat NOT Listed on URIBL
>
>
> Is that not working correctly?
>
>

I just tried again, both on https://uribl.com that I used before and
admin.uribl.com like you did, both with identical results, same as I got
yesterday with the addition of a second "pending removal from block"

Lookup Results
Domain Status Manage
libra_chat Listed on URIBL black

Pending Removal from black Pending Removal from black (details)
Pending Removal from black Pending Removal from black (details)

I wonder if their removal requests are processed automatically and their
adding to the block list also happens automatically from the
sbc.spamhaus list? So it will keep popping on and off?
Re: heads up for false uribl black hits [ In reply to ]
Benny Pedersen wrote on 21/05/21 4:59 am:
> only place i find it https://spameatingmonkey.com/lookup/libe****hat
>

Spameatingmonkey lists it as "This domain was first registered within
the last 30 days Listings automatically expire in less than 30 days"

It was registered on April 23. Maybe see how it looks next week in case
that's the problem with the other listings.
Re: heads up for false uribl black hits [ In reply to ]
On 21/05/2021 00:28, John Hardin wrote:

> On Thu, 20 May 2021, Noel Butler wrote:
>
> On 20/05/2021 11:58, Bill Cole wrote:
>
> On 2021-05-19 at 21:13:41 UTC-0400 (Thu, 20 May 2021 11:13:41 +1000)
> Noel Butler <noel.butler@ausics.net>
> is rumored to have said:
>
> By now most of you are aware of the hostile takeover of freenode and
> the mass exodus that's currently underway (if not see kline.sh for
> more) [1]
>
> Interestingly it seems uribl.com has the replacement, Im going to
> obfuscate it else you wont likely see this :) just replace digits with
> their alpha lib3ra dott ch4t
>
> in their listings, interesting because they dont seem to list new
> domains that way and that one is new, heh maybe andrew lee controls
> that too, who knows...
> The new domain was NOT listed in any RHSBL at 13:55 UTC.
>
> OTOH, they didn't like something about my usual single-venue address
> pattern so I had to register with an alternative tagging pattern.

still listed in URI
Domain Status Manage
libexxxx.cxxx Listed on URIBL black
Odd, the URIBL website lookup tool says libera (.chat) is not listed,
and didn't yesterday when you first posted this.

https://admin.uribl.com/

Lookup Results (obfuscated just in case)
Domain Status
libera_chat NOT Listed on URIBL

Is that not working correctly?

Nope

(this screeny is 5 mins old)

--
Regards,
Noel Butler

This Email, including attachments, may contain legally privileged
information, therefore at all times remains confidential and subject to
copyright protected under international law. You may not disseminate
this message without the authors express written authority to do so.
If you are not the intended recipient, please notify the sender then
delete all copies of this message including attachments immediately.
Confidentiality, copyright, and legal privilege are not waived or lost
by reason of the mistaken delivery of this message.