Can anyone explain why this particular URI gets tagged by WS when none of
the other URIs in the message (including several others from g.msn.com) get
tagged:
http://g.msn.MUNGEDcom/0NL34044/2531
Must be something about this particular URI string that causes the parser to
handle it differently. If someone wants to see the message this URI came
from, let me know and I'll send it to you.
Bill
With all this talk of spanking people for adding FPs, I'm not sure if I
should be careful, or buy some beer and nachos and wait to be spanked ;)
Anywho, I need a check on these guys: cwiservices.com
Spank you very much,
--Chris (The guy without AIM or ICQ!)
>-----Original Message-----
>From: Mariano Absatz [mailto:el.baby@gmail.com]
>Sent: Wednesday, August 18, 2004 2:00 AM
>To: SURBL Discussion list
>Subject: [SURBL-Discuss] FP in ws.surbl.orgdomeus_REMOVE.com /
>domeus_REMOVE.es
>
>
>Hi people, hi Bill...
>
>I just detected a FP in ws.surbl.org... and I was the one who
>submitted the domains :-(
>
>It's 2 domains: domeus_REMOVE.com / domeus_REMOVE.es
>
>It seems to be some kind of public list server with little control
>about what their users/customers subscribe.
>
>I'll look in my spamcan for the offending messages and will try to
>contact them to see if they do something about those customers.
>
>But I got the FP from a message forwarded from a completely legit
>mailing list, so I guess our policy should lead us to remove those
>domains from the list.
>
>I'll see what I can do tomorrow... I'm finishing putting in production
>MailScanner+SpamAssassin+SURBL in a mid-sized ISP... it's 3:00 AM, I
>haven't slept a wink, I broke a leg last week and my Doctor insists on
>opening it before this weekend to get the bone nailed in place... I
>won't be able to walk on my feet for a month and a half :-(
>
>Regards.
Bah! We get guys in hockey get injuries like that all the time. You will be
back next season! They always come back! Muahahahahahahahah :)
--Chris (Physical contact sport freak!)
Hell yeah! These didn't come from me or Steve! Oh that feels good to say! Of
course, I haven't checked all my SURBL emails yet :)
--Chris
>-----Original Message-----
>From: Jeff Chan [mailto:jeffc@surbl.org]
>Sent: Tuesday, August 17, 2004 9:19 PM
>To: discuss(a)lists.surbl.org
>Subject: [SURBL-Discuss] Re: FP from WS
>
>
>On Tuesday, August 17, 2004, 4:33:21 PM, Larry Rosenman wrote:
>> The following 2 URIs (and possibly a third) are FP's:
>
>> i-say-MUNGED.com
>> Surveynetworks-MUNGED.com
>
>> And possibly
>> Itracks-MUNGED.com
>
>> i-say-MUNGED is the IPSOS survey site, and seems legit, and
>> surveynetworks-MUNGED
>> Is a collection of them.
>
>> I'm not 100% certain of itracks-MUNGED, but please check.
>
>> These are all on WS.
>
>Thanks Larry,
>I checked them a little and they all look at least
>quasi-legitimate, so I whitelisted them all, plus some
>related domains:
>
>itracks.com
>ipsos-reid.com
>i-say.com
>venteinc.com
>surveynetworks.com
>
>We need to ask the ws folks how these are getting in
>and how we can stop them from doing so.
>
>Jeff C.
>
>_______________________________________________
>Discuss mailing list
>Discuss(a)lists.surbl.org
>http://lists.surbl.org/mailman/listinfo/discuss
>
I submitted from Ryan's submission. But I did check it and it looked spammy.
Also had a bunch of NANAS hits, and not just one.
I see a pattern of legit sites possibly being con'd by sleezy marketers.
Causing them to be listed. It will probably happen in the future despite our
best efforts. We can minimise of course.
But if the domain is unfamiliar, looks kind of spammy (cdbaby, come one
now!), has multiple NANAS or NANAE hits, is reported to be spamming, then
most likely it will get listed.
I had no doubts when I listed this. I'm still only going by what Jeff has
said. But I don't go by what companies quote on there website. Everything
Jeff quoted I've seen before on known spam sites.
If a site has multiple reports on NANAS, from different people, over a
stretch of time, then you bet it sends red flags up for me!
I removed then and will update file.
--Chris
>-----Original Message-----
>From: Jeff Chan [mailto:jeffc@surbl.org]
>Sent: Tuesday, August 17, 2004 6:08 PM
>To: SURBL Discuss
>Subject: [SURBL-Discuss] cdbaby.com fp whitelisted
>
>
>cdbaby.com was on ws. I've whitelisted it along with a couple
>others:
>
>_______________________________________________
>Discuss mailing list
>Discuss(a)lists.surbl.org
>http://lists.surbl.org/mailman/listinfo/discuss
>
On Wednesday, August 18, 2004, 12:14:26 AM, Joe Wein wrote:
>> Thanks, I've whitelisted:
>>
>> domeus.com
>> domeus.es
> Could you whitelist domeus.de also, just in case. I run a mailing list on
> that service.
> They are rumoured to have some problems, but basically are legitimate.
Thanks, I've whitelisted the domains on their main page:
ecircle-ag.comdomeus.com
domeus.de
domeus.co.uk
domeus.es
domeus.fr
domeus.it
Jeff C.
The following 2 URIs (and possibly a third) are FP's:
i-say-MUNGED.comSurveynetworks-MUNGED.com
And possibly
Itracks-MUNGED.com
i-say-MUNGED is the IPSOS survey site, and seems legit, and
surveynetworks-MUNGED
Is a collection of them.
I'm not 100% certain of itracks-MUNGED, but please check.
These are all on WS.
--
Larry Rosenman http://www.lerctr.org/~ler
Phone: +1 972-414-9812 E-Mail: ler(a)lerctr.org
US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
Hi people, hi Bill...
I just detected a FP in ws.surbl.org... and I was the one who
submitted the domains :-(
It's 2 domains: domeus_REMOVE.com / domeus_REMOVE.es
It seems to be some kind of public list server with little control
about what their users/customers subscribe.
I'll look in my spamcan for the offending messages and will try to
contact them to see if they do something about those customers.
But I got the FP from a message forwarded from a completely legit
mailing list, so I guess our policy should lead us to remove those
domains from the list.
I'll see what I can do tomorrow... I'm finishing putting in production
MailScanner+SpamAssassin+SURBL in a mid-sized ISP... it's 3:00 AM, I
haven't slept a wink, I broke a leg last week and my Doctor insists on
opening it before this weekend to get the bone nailed in place... I
won't be able to walk on my feet for a month and a half :-(
Regards.
--
Mariano Absatz - El Baby
el (dot) baby (AT) gmail (dot) com
el (punto) baby (ARROBA:@) gmail (punto) com
ya.com is listed in WS.
I can't find any recent NANAS reports where the domain is used in uri's.
They seem to be an ISP, with the domain showing up in footers in legit mail
when their webmail service is used.
Patrik
cdbaby.com was on ws. I've whitelisted it along with a couple
others:
cdbaby.comhostbaby.comhitmedia.com
This site claims to be the largest seller of independent musician
CDs on the web:
http://www.cdbaby.com/about
> * In business, and thriving, since March 1998. We're the
> largest seller of independent CDs on the web.
[...]
> Current Numbers:
>
> * 69,591 artists sell their CD at CD Baby.
> * 1,129,709 CDs sold online to customers.
> * $9,041,358.43 paid to artists.
>
> CD Baby Privacy Policy
>
> * We NEVER give or sell your personal info to any other
> company - EVER! (No not even your email address!)
> * Only the musician whose CD you buy will know who you are.
> * If you don't even want the musician to know about you,
> just say so at the bottom of your order form.
There's no way this domain should ever have been listed, even if
one of the artists using it DID spam.
ws folks please trace this one back. We don't want more like
this.
Is anyone researching these before they get added? Even a
cursory glance at their web page would show them to probably
be legitimate.
We really need to try to eliminate FPs or they will hurt
the project.
Jeff C.