Geocities closed

[Alex-325]

Hi all,

Thought I would pass along that geocities closed up and went home today:

http://geocities.yahoo.com/

Wondering what this means in terms of the geocities SA rules? Would
sure be nice to just block them outright at the gateway, but in
From/To header and body, no?

Anyone have an existing account that they could try to access today,
and try and send/receive an email? There isn't much on the page
detailing what happens to all their data outside of creating a new
Yahoo profile or site.

Thanks,
Alex

[Martin Gregorie-2]

On Mon, 2009-10-26 at 19:15 -0400, Alex wrote:
>
> There isn't much on the page detailing what happens to all their data
> outside of creating a new Yahoo profile or site.
>
According to a story in The Register, Yahoo couldn't care less about the
remaining data on the servers and have wiped the Geocities servers
without making backups. Here's the full story:

http://www.theregister.co.uk/2009/10/26/geocities_closes/


Martin

[Ted Mittelstaedt-2]

Martin Gregorie wrote:

> On Mon, 2009-10-26 at 19:15 -0400, Alex wrote:
>> There isn't much on the page detailing what happens to all their data
>> outside of creating a new Yahoo profile or site.
>>
> According to a story in The Register, Yahoo couldn't care less about the
> remaining data on the servers and have wiped the Geocities servers
> without making backups. Here's the full story:
>
> http://www.theregister.co.uk/2009/10/26/geocities_closes/
>
>

The Internet Archive announced months ago they were going to
archive geocities

Ted

[Mike Cardwell-16]

Alex wrote:

> Thought I would pass along that geocities closed up and went home today:
>
> http://geocities.yahoo.com/
>
> Wondering what this means in terms of the geocities SA rules? Would
> sure be nice to just block them outright at the gateway, but in
> From/To header and body, no?

Why have any geocities specific rules any more if geocities doesn't
exist? It's not as if spammers can host their websites on geocities
anymore so there's no reason why a spammer would include a geocities url
in their spam. May as well just delete the rules...

--
Mike Cardwell - IT Consultant and LAMP developer
Cardwell IT Ltd. (UK Reg'd Company #06920226) http://cardwellit.com/
Technical Blog: https://secure.grepular.com/blog/

[LuKreme]

On 27-Oct-2009, at 04:53, Mike Cardwell wrote:
> Why have any geocities specific rules any more if geocities doesn't  
> exist? It's not as if spammers can host their websites on geocities  
> anymore so there's no reason why a spammer would include a geocities  
> url in their spam. May as well just delete the rules...


If the links are still appearing in SPAM then no, don't delete the  
rules, just bump up the scores.

--
I want a party where all the women wear new dresses and all the men
        drink beer. -- Jason Gaes

On Tue, 2009-10-27 at 05:08 -0600, LuKreme wrote:

> On 27-Oct-2009, at 04:53, Mike Cardwell wrote:
> > Why have any geocities specific rules any more if geocities doesn't  
> > exist? It's not as if spammers can host their websites on geocities  
> > anymore so there's no reason why a spammer would include a geocities  
> > url in their spam. May as well just delete the rules...
>
>
> If the links are still appearing in SPAM then no, don't delete the  
> rules, just bump up the scores.
>

Would this not be almost entirely pointless? With spam the motto is
'follow the money'. if the link does not work, there is no path to the
money to follow. Other than prospecting for valid recipients {which
could be done just as easily without the link} there is no benefit for a
spammer to include a link of this nature.

[DAve-12]

richard@... wrote:

> On Tue, 2009-10-27 at 05:08 -0600, LuKreme wrote:
>> On 27-Oct-2009, at 04:53, Mike Cardwell wrote:
>>> Why have any geocities specific rules any more if geocities doesn't  
>>> exist? It's not as if spammers can host their websites on geocities  
>>> anymore so there's no reason why a spammer would include a geocities  
>>> url in their spam. May as well just delete the rules...
>>
>> If the links are still appearing in SPAM then no, don't delete the  
>> rules, just bump up the scores.
>>
>
> Would this not be almost entirely pointless? With spam the motto is
> 'follow the money'. if the link does not work, there is no path to the
> money to follow. Other than prospecting for valid recipients {which
> could be done just as easily without the link} there is no benefit for a
> spammer to include a link of this nature.

I have been scoring any mail with a geocities URL at +5 for over a year
now without a complaint. I believe I will leave the geocities rules in
place until they no longer hit mail.

DAve


--
"Posterity, you will know how much it cost the present generation to
preserve your freedom.  I hope you will make good use of it.  If you
do not, I shall repent in heaven that ever I took half the pains to
preserve it." John Quincy Adams

http://appleseedinfo.org

[LuKreme]

On 27-Oct-2009, at 06:42, richard@... wrote:

> On Tue, 2009-10-27 at 05:08 -0600, LuKreme wrote:
>> On 27-Oct-2009, at 04:53, Mike Cardwell wrote:
>>> Why have any geocities specific rules any more if geocities doesn't
>>> exist? It's not as if spammers can host their websites on geocities
>>> anymore so there's no reason why a spammer would include a geocities
>>> url in their spam. May as well just delete the rules...
>>
>> If the links are still appearing in SPAM then no, don't delete the
>> rules, just bump up the scores.
>>
> Would this not be almost entirely pointless? With spam the motto is
> 'follow the money'. if the link does not work, there is no path to the
> money to follow. Other than prospecting for valid recipients {which
> could be done just as easily without the link} there is no benefit  
> for a
> spammer to include a link of this nature.

Sure. that has nothing to do with what I said.

If it still shows up in spam, score it higher.

It would be stupid to remove the rules if they are still hitting.

--
Personal isn't the same as important

[John Rudd]

On Tue, Oct 27, 2009 at 05:42, richard@...
<richard@...> wrote:

> On Tue, 2009-10-27 at 05:08 -0600, LuKreme wrote:
>> On 27-Oct-2009, at 04:53, Mike Cardwell wrote:
>> > Why have any geocities specific rules any more if geocities doesn't
>> > exist? It's not as if spammers can host their websites on geocities
>> > anymore so there's no reason why a spammer would include a geocities
>> > url in their spam. May as well just delete the rules...
>>
>>
>> If the links are still appearing in SPAM then no, don't delete the
>> rules, just bump up the scores.
>>
>
> Would this not be almost entirely pointless? With spam the motto is
> 'follow the money'. if the link does not work, there is no path to the
> money to follow. Other than prospecting for valid recipients {which
> could be done just as easily without the link} there is no benefit for a
> spammer to include a link of this nature.

You're assuming that spammers will perfectly update all existing spam.
 There might be crud floating around out there for a while to come.
And, any messages that contain that crud are just as likely to be spam
as they were before.

My suggestion: proceed as normal.  Adjust the scores for geocities
spam as the analysis tools on currnet/live* spam suggest, until such
time as there are no more spam messages showing up that are hitting
the geocities rules ... for at least 1-3 months.  Once they stop
showing up in the wild for a substantial period of time (ie. my 1-3
months suggestion), THEN remove them from the rules.  Not before.

(*  not the corpus of past/historical/stale spam)

On Tue, 2009-10-27 at 05:50 -0700, John Rudd wrote:

> On Tue, Oct 27, 2009 at 05:42, richard@...
> <richard@...> wrote:
> > On Tue, 2009-10-27 at 05:08 -0600, LuKreme wrote:
> >> On 27-Oct-2009, at 04:53, Mike Cardwell wrote:
> >> > Why have any geocities specific rules any more if geocities doesn't
> >> > exist? It's not as if spammers can host their websites on geocities
> >> > anymore so there's no reason why a spammer would include a geocities
> >> > url in their spam. May as well just delete the rules...
> >>
> >>
> >> If the links are still appearing in SPAM then no, don't delete the
> >> rules, just bump up the scores.
> >>
> >
> > Would this not be almost entirely pointless? With spam the motto is
> > 'follow the money'. if the link does not work, there is no path to the
> > money to follow. Other than prospecting for valid recipients {which
> > could be done just as easily without the link} there is no benefit for a
> > spammer to include a link of this nature.
>
> You're assuming that spammers will perfectly update all existing spam.
>  There might be crud floating around out there for a while to come.

I'm not assuming anything John. Spam with no endgame is pointless spam.
All spam has a point and purpose - or it would not exist. Most spammers
staging or springboarding from such places turn their links around
mighty fast - they know they wont be up for long, so whilst I sure there
may be the odd 'floater' around, the enemy is formidable and ahead of
the game.

> My suggestion: proceed as normal.  Adjust the scores for geocities
> spam as the analysis tools on currnet/live* spam suggest, until such
> time as there are no more spam messages showing up that are hitting
> the geocities rules ... for at least 1-3 months.  Once they stop
> showing up in the wild for a substantial period of time (ie. my 1-3
> months suggestion), THEN remove them from the rules.  Not before.
>
> (*  not the corpus of past/historical/stale spam)
John I agree. I don't think there is any need to rush to do anything. It
would make sense to phase out the rule in a period of time. A few extra
lines of regex is not going to kill most machines - but long term there
will probably be little benefit keeping it in.

[John Rudd]

On Tue, Oct 27, 2009 at 06:06, richard@...
<richard@...> wrote:

> On Tue, 2009-10-27 at 05:50 -0700, John Rudd wrote:
>> On Tue, Oct 27, 2009 at 05:42, richard@...
>> <richard@...> wrote:
>> > On Tue, 2009-10-27 at 05:08 -0600, LuKreme wrote:
>> >> On 27-Oct-2009, at 04:53, Mike Cardwell wrote:
>> >> > Why have any geocities specific rules any more if geocities doesn't
>> >> > exist? It's not as if spammers can host their websites on geocities
>> >> > anymore so there's no reason why a spammer would include a geocities
>> >> > url in their spam. May as well just delete the rules...
>> >>
>> >>
>> >> If the links are still appearing in SPAM then no, don't delete the
>> >> rules, just bump up the scores.
>> >>
>> >
>> > Would this not be almost entirely pointless? With spam the motto is
>> > 'follow the money'. if the link does not work, there is no path to the
>> > money to follow. Other than prospecting for valid recipients {which
>> > could be done just as easily without the link} there is no benefit for a
>> > spammer to include a link of this nature.
>>
>> You're assuming that spammers will perfectly update all existing spam.
>>  There might be crud floating around out there for a while to come.
>
> I'm not assuming anything John. Spam with no endgame is pointless spam.
> All spam has a point and purpose - or it would not exist. Most spammers
> staging or springboarding from such places turn their links around
> mighty fast - they know they wont be up for long, so whilst I sure there
> may be the odd 'floater' around, the enemy is formidable and ahead of
> the game.
>
>> My suggestion: proceed as normal.  Adjust the scores for geocities
>> spam as the analysis tools on currnet/live* spam suggest, until such
>> time as there are no more spam messages showing up that are hitting
>> the geocities rules ... for at least 1-3 months.  Once they stop
>> showing up in the wild for a substantial period of time (ie. my 1-3
>> months suggestion), THEN remove them from the rules.  Not before.
>>
>> (*  not the corpus of past/historical/stale spam)
> John I agree. I don't think there is any need to rush to do anything. It
> would make sense to phase out the rule in a period of time. A few extra
> lines of regex is not going to kill most machines - but long term there
> will probably be little benefit keeping it in.

I agree -- long term, there should be little to no benefit to keeping it.

Just have to figure out what the dividing line between "near term" and
"long term" is :-)

[Matus UHLAR - fantomas]

> On Tue, 2009-10-27 at 05:50 -0700, John Rudd wrote:
> > You're assuming that spammers will perfectly update all existing spam.
> >  There might be crud floating around out there for a while to come.

On 27.10.09 13:06, richard@... wrote:
> I'm not assuming anything John. Spam with no endgame is pointless spam.
> All spam has a point and purpose - or it would not exist. Most spammers
> staging or springboarding from such places turn their links around
> mighty fast - they know they wont be up for long, so whilst I sure there
> may be the odd 'floater' around, the enemy is formidable and ahead of
> the game.

Are we talking that the spam should not exist or about the spam still
exists?

The fact is, that if we get old spam, we should detect it, regardless if
spammers make money on it or not.

--
Matus UHLAR - fantomas, uhlar@... ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Windows 2000: 640 MB ought to be enough for anybody

[Dan Schaefer-3]

Matus UHLAR - fantomas wrote:

On Tue, 2009-10-27 at 05:50 -0700, John Rudd wrote:
    

You're assuming that spammers will perfectly update all existing spam.
 There might be crud floating around out there for a while to come.
      

On 27.10.09 13:06, richard@... wrote:
  

I'm not assuming anything John. Spam with no endgame is pointless spam.
All spam has a point and purpose - or it would not exist. Most spammers
staging or springboarding from such places turn their links around
mighty fast - they know they wont be up for long, so whilst I sure there
may be the odd 'floater' around, the enemy is formidable and ahead of
the game.
    

Are we talking that the spam should not exist or about the spam still
exists?

The fact is, that if we get old spam, we should detect it, regardless if
spammers make money on it or not. 

  

I was about to write something to that effect. Not all spam is created to make money. There is the annoyance factor as well. After the geocities rules are not enforced anymore (and I'm sure Spammers are monitoring this list and the the SA rules), the spammers could start up the geocities spam again just to annoy the users and admins, even though they will be broken links. SA is going to have to re-instate the rules at some point.

[RW-15]

On Tue, 27 Oct 2009 05:08:20 -0600
LuKreme <kremels@...> wrote:

> On 27-Oct-2009, at 04:53, Mike Cardwell wrote:
> > Why have any geocities specific rules any more if geocities
> > doesn't exist? It's not as if spammers can host their websites on
> > geocities anymore so there's no reason why a spammer would include
> > a geocities url in their spam. May as well just delete the rules...
>
>
> If the links are still appearing in SPAM then no, don't delete the  
> rules, just bump up the scores.
>

I wouldn't increase them, my guess is that spammers will drop the links
very quickly, but there may be geocities links in signatures that
persist for some time.

I just found this one working:

http://uk.geocities.com/midsomerland/midsomerland_indexone.htm

so providence would suggest leaving things alone.

[Martin Gregorie-2]

On Tue, 2009-10-27 at 13:59 +0000, richard@... wrote:
> I just found this one working:
>
> http://uk.geocities.com/midsomerland/midsomerland_indexone.htm
>
> so providence would suggest leaving things alone.

The domains still exist. www.geocities.com and uk.geocities.com both
redirect at DNS level to 98.137.46.72, which is the host named
intl1.geo.vip.sp2.yahoo.com

However, there's more going on: putting www.geocities.com into a web
browser brings up the Geocities 'demolished on the 26th' web page at
www.geocities.yahoo.com while doing the same with uk.geocities.com
brings up a Yahoo login page.

>From this I'd guess that the Geocities domains may be around for quite a
while: the domain hasn't simply been abandoned with a holding page.


Martin

[Charles Gregory]

On Tue, 27 Oct 2009, richard@... wrote:
> I just found this one working:
> http://uk.geocities.com/midsomerland/midsomerland_indexone.htm
> so providence would suggest leaving things alone.

Yes, if you go to the Yahoo FAQ on the close-down, you will find that
one option available prior to Oct. 25 was if someone upgraded to their
'hosting' service, they could KEEP their old geocities link as a redirect
to their new hosting site. So we may find after a few months that
geocities links appear more frequently in ham than spam.... :)

- C

[Kelson Vibber]

Alex wrote:
> Anyone have an existing account that they could try to access today,
> and try and send/receive an email? There isn't much on the page
> detailing what happens to all their data outside of creating a new
> Yahoo profile or site.

They're not getting rid of email accounts, just web:
http://help.yahoo.com/l/us/yahoo/geocities/close/close-16.html

--
Kelson Vibber
SpeedGate Communications <www.speed.net>

[Michael Hutchinson-3]

> -----Original Message-----
> From: Mike Cardwell [mailto:spamassassin-users@...]
> Sent: Tuesday, 27 October 2009 11:54 p.m.
> To: users@...
> Subject: Re: Geocities closed
>
> Alex wrote:
>
> > Thought I would pass along that geocities closed up and went home
> today:
> >
> > http://geocities.yahoo.com/
> >
> > Wondering what this means in terms of the geocities SA rules? Would
> > sure be nice to just block them outright at the gateway, but in
> > From/To header and body, no?
>
> Why have any geocities specific rules any more if geocities doesn't
> exist? It's not as if spammers can host their websites on geocities
> anymore so there's no reason why a spammer would include a geocities
> url
> in their spam. May as well just delete the rules...

Or, on the other hand, Spammers may see it as an opportunity - assuming
that people will be doing just that - removing rules against Geocities.

Hmm. I wouldn't be doing that any time soon - after all there is nothing
stopping Spammers from faking geocities originating addresses or other
header info.

Cheers,
Michael.

[Michael Hutchinson-3]

> -----Original Message-----
> From: richard@... [mailto:richard@...]
> Sent: Wednesday, 28 October 2009 3:00 a.m.
> Cc: users@...
> Subject: Re: Geocities closed
>
> I just found this one working:
>
> http://uk.geocities.com/midsomerland/midsomerland_indexone.htm
>
> so providence would suggest leaving things alone.

Funnily enough, including that link and having no To: field in your
message was enough to have the mail treated as Spam by our gateway ;-P

I had to release it but lost the headers in the process. However, it
seems to have nearly missed being caught by some other server first:

X-Spam-Level: ****
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on stinger
X-Virus-Checked: Checked by ClamAV on apache.org
X-Old-Spam-Status: No, score=4.7 required=5.0
tests=ALL_TRUSTED,FU_UKGEOCITIES,
        MISSING_HEADERS,MISSING_SUBJECT autolearn=disabled version=3.2.5

Which is basically what our Spam gateway thought of the message, minus
the trusted part.

Cheers,
Mike