Author Topic: Fake DNSBL uncovered: nszones.com  (Read 2691 times)

0 Members and 1 Guest are viewing this topic.

August 12, 2010, 08:30:15 am
Read 2691 times

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Quote
Spamhaus has uncovered a fake spam filter company which was pirating and selling DNSBL data stolen from major anti-spam systems including Spamhaus, CBL and SURBL, republishing the stolen data under the name "nszones.com".

Nszones operates a 'remove your IP' scam charging naive internet users to be removed from the pirated nszones DNSBLs. Nszones also attempts to sell 'commercial subscriptions' to the pirated nszones DNSBLs.

Owned by Liberian-registered Aegeas Enterprises S.A., based in Greece, nszones.com was discovered pirating DNSBL data via rsync from Spamhaus, CBL and SURBL and republishing the pirated data under the hostnames 'bl.nszones.com, sbl.nszones.com, dyn.nszones.com and ubl.nszones.com' which nszones.com was then selling as its own work. Secret seed data which Spamhaus inserts into Spamhaus DNSBL zones to catch data pirates was found in bl.nszones.com, sbl.nszones.com and dyn.nszones.com.

Similarly, the whitelist wl.nszones.com contains data verified to have been wholly pirated from DNSWL.org.

Read more
http://www.spamhaus.org/organization/statement.lasso?ref=8

See also;

http://www.dnsbl.com/2010/03/beware-fake-blacklist-at-nszonescom.html
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net