Posts in news.lists.filters direct us to
https://pasdenom.info/nocem.en.html
To get the pgp however the site times out.
What's the use of posting nocem messages if nobody can use them?
Ref: message-id uim0br$uu$[email protected]
On Nov 11, 2023 at 1:19:45 AM CST, "Nigel Reed" <[email protected]> wrote:
Posts in news.lists.filters direct us to
https://pasdenom.info/nocem.en.html
To get the pgp however the site times out.
What's the use of posting nocem messages if nobody can use them?
Ref: message-id uim0br$uu$[email protected]
Site loads fine here.
On Nov 11, 2023 at 1:19:45?AM CST, "Nigel Reed" <[email protected]> wrote:
Posts in news.lists.filters direct us to
https://pasdenom.info/nocem.en.html
To get the pgp however the site times out.
What's the use of posting nocem messages if nobody can use them?
Ref: message-id uim0br$uu$[email protected]
Site loads fine here.
NoceM issued by pasdenom.info[end quote]
[email protected] sends NoCems of the type:
site -> rare manual notices
spam -> 99.99% spam
spam2 -> spam with rare false positives
spam3 -> spam with false positives
spam4 -> spam with slightly more false positives
The types spam, spam2, spam3 and spam4 get a score from spamassassin,
the higher the number the lower the threshold, the greater the risk
of a legitimate article being considered spam.
The public key can be imported from:nono.asc >https://pasdenom.info/gpg/nono.asc
Here is an example of a note
http://al.howardknight.net/?ID=165087803400
On Nov 11, 2023 at 1:19:45 AM CST, "Nigel Reed"
<[email protected]> wrote:
Posts in news.lists.filters direct us to
https://pasdenom.info/nocem.en.html
To get the pgp however the site times out.
What's the use of posting nocem messages if nobody can use them?
Ref: message-id uim0br$uu$[email protected]
Site loads fine here.
Nigel Reed wrote:
On Sat, 11 Nov 2023 11:28:04 -0000 (UTC)
Jesse Rehmer <[email protected]> wrote:
On Nov 11, 2023 at 1:19:45 AM CST, "Nigel Reed"
<[email protected]> wrote:
Posts in news.lists.filters direct us to
https://pasdenom.info/nocem.en.html
To get the pgp however the site times out.
What's the use of posting nocem messages if nobody can use them?
Ref: message-id uim0br$uu$[email protected]
Site loads fine here.
Add, I tried it on a couple of browsers on a couple of operating
systems and no dice. I tried lynx on a a different server and it pulls
up. Maybe my IP block is firewalled or something.
What does traceroute say?
It won't be incredibly helpful, I did a "ping -c 4 pasdenom.info" and
saw that the site appears to eat "ping" requests.
sudo traceroute pasdenom.info
[sudo] password for root:
traceroute to pasdenom.info (82.66.60.35), 30 hops max, 60 byte packets
1 192.168.178.1 (192.168.178.1) 0.343 ms 0.284 ms 0.381 ms
2 * * *
3 [city gateway for my ISP] 12.066 ms 12.033 ms 17.131 ms
4 145.253.48.220 (145.253.48.220) 19.395 ms 25.272 ms 19.327 ms
5 decix.proxad.net (80.81.192.223) 18.085 ms 18.051 ms 17.071 ms
And that was it. My browser was happy connecting to the site during
these tests and I assume my problem is that the site rejects pings.
On Sat, 11 Nov 2023 11:28:04 -0000 (UTC)
Jesse Rehmer <[email protected]> wrote:
On Nov 11, 2023 at 1:19:45 AM CST, "Nigel Reed"
<[email protected]> wrote:
Posts in news.lists.filters direct us to
https://pasdenom.info/nocem.en.html
To get the pgp however the site times out.
What's the use of posting nocem messages if nobody can use them?
Ref: message-id uim0br$uu$[email protected]
Site loads fine here.
Add, I tried it on a couple of browsers on a couple of operating
systems and no dice. I tried lynx on a a different server and it pulls
up. Maybe my IP block is firewalled or something.
Nigel Reed wrote:
On Sat, 11 Nov 2023 11:28:04 -0000 (UTC)
Jesse Rehmer <[email protected]> wrote:
On Nov 11, 2023 at 1:19:45 AM CST, "Nigel Reed" <[email protected]> wrote:
Posts in news.lists.filters direct us to
https://pasdenom.info/nocem.en.html
To get the pgp however the site times out.
What's the use of posting nocem messages if nobody can use them?
Ref: message-id uim0br$uu$[email protected]
Site loads fine here.
Add, I tried it on a couple of browsers on a couple of operating
systems and no dice. I tried lynx on a a different server and it pulls
up. Maybe my IP block is firewalled or something.
What does traceroute say?
It won't be incredibly helpful, I did a "ping -c 4 pasdenom.info" and saw that
the site appears to eat "ping" requests.
sudo traceroute pasdenom.info
[sudo] password for root:
traceroute to pasdenom.info (82.66.60.35), 30 hops max, 60 byte packets
1 192.168.178.1 (192.168.178.1) 0.343 ms 0.284 ms 0.381 ms
2 * * *
3 [city gateway for my ISP] 12.066 ms 12.033 ms 17.131 ms
4 145.253.48.220 (145.253.48.220) 19.395 ms 25.272 ms 19.327 ms
5 decix.proxad.net (80.81.192.223) 18.085 ms 18.051 ms 17.071 ms
And that was it. My browser was happy connecting to the site during these tests and I assume my problem is that the site rejects pings.
What's the use of posting nocem messages if nobody can use them?
It seems they are intentionally attempting to make things more
difficult.
We Stand
On Sun, 12 Nov 2023 13:51:04 -0600
David Ritz <[email protected]> wrote:
It seems they are intentionally attempting to make things more
difficult.
No worries, I got to it via a different network on another server.
Thanks for the in depth debugging tho.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Monday, 13 November 2023 00:52 -0600,
in article <[email protected]>,
Nigel Reed <[email protected]> wrote:
On Sun, 12 Nov 2023 13:51:04 -0600
David Ritz <[email protected]> wrote:
It seems they are intentionally attempting to make things more
difficult.
No worries, I got to it via a different network on another server.
Thanks for the in depth debugging tho.
Some of their techniques, including a 300 second TTL for the domain,
fall within the realm of what I refer to as stupid spammer tricks.
$ dig @ns-181-c.gandi.net pasdenom.info | grep -E ^pasdenom.info.\*A pasdenom.info. 300 IN A 82.66.60.35
^^^
$ nmap -p 25,80,119,443,563 pasdenom.info
Starting Nmap 5.51 ( http://nmap.org ) at 2023-11-13 20:XX UTC
Nmap scan report for pasdenom.info (82.66.60.35)
Host is up (0.26s latency).
rDNS record for 82.66.60.35: usenet.pasdenom.info
PORT STATE SERVICE
25/tcp filtered smtp
80/tcp open http
119/tcp open nntp
443/tcp open https
563/tcp open snews
Nmap done: 1 IP address (1 host up) scanned in 3.21 seconds
While pasdenom.info is configured to receive email (Mail eXchange),
they specify no IP address from which they are designated to send, ie.
no SPF record.
$ dig +short MX pasdenom.info
50 fb.mail.gandi.net.
10 spool.mail.gandi.net.
$ dig +short TXT pasdenom.info "google-site-verification=ToBiCiESEmzVbbt0xzpJ-qRmHDlwBpytL2cgfDJMCU8"
- --
David Ritz <[email protected]>
"There will be more spam." -- Paul Vixie
-----BEGIN PGP SIGNATURE-----
iF0EARECAB0WIQSc0FU3XAVGYDjSGUhSvCmZGhLe6wUCZVKPeAAKCRBSvCmZGhLe 61TsAKCy7zv/w/zNHzk0c/QH2PxzM/vatACfUksn8UDrBD8o+nUzrebrq1Cv/jU=
=OGQx
-----END PGP SIGNATURE-----
Posts in news.lists.filters direct us to
https://pasdenom.info/nocem.en.html
On Nov 13, 2023 at 3:04:56 PM CST, "David Ritz" <[email protected]> wrote:
Some of their techniques, including a 300 second TTL for the domain,
fall within the realm of what I refer to as stupid spammer tricks.
$ dig @ns-181-c.gandi.net pasdenom.info | grep -E ^pasdenom.info.\*A
pasdenom.info. 300 IN A 82.66.60.35
AWS and other large Cloud providers would disagree as it is their
default TTL.
On Tuesday, 14 November 2023 01:31 -0000,
in article <uiuil0$2abb$[email protected]>,
Jesse Rehmer <[email protected]> wrote:
On Nov 13, 2023 at 3:04:56 PM CST, "David Ritz" <[email protected]> wrote:
[...]
Some of their techniques, including a 300 second TTL for the domain,
fall within the realm of what I refer to as stupid spammer tricks.
$ dig @ns-181-c.gandi.net pasdenom.info | grep -E ^pasdenom.info.\*A
pasdenom.info. 300 IN A 82.66.60.35
[...]
AWS and other large Cloud providers would disagree as it is their
default TTL.
DNS TTL is determined by the Name Server for the domain in question.
While AWS may provide DNS, with a default of five minute TTL, this is
far from being written in stone. For example, the dnspod.com servers
provide a default of 600 seconds (10 minutes) TTL, even when the
domain in question is hosted in the AWS cloud.
It's been a while, but I used to observe Fast Flux botnet controllers
using AWS load balancing, to be assigned a fresh IP address, every
sixty seconds, maximum. While short TTLs do not necessarily scream
bad actors, it may certainly be employed as a weighting factor.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 715 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 32:19:08 |
| Calls: | 12,109 |
| Files: | 15,006 |
| Messages: | 6,518,297 |
