Discuss

discuss@lists.surbl.org

1 participants
1868 discussions

{Spam?} FP in WS,OB
by Larry Rosenman 19 Aug '04

19 Aug '04

Storage Pipeline Newsletter wrote: > Spam detection software, running on the system "lerami.lerctr.org", > has identified this incoming email as possible spam. The original > message has been attached to this so you can view it (if it isn't > spam) or label similar future email. If you have any questions, see > ler(a)lerctr.org for details. > > Content preview: STORAGE PIPELINE NEWSLETTER > http://www.StoragePipeline.com/ Thursday, August 19, 2004 1. > Editor's Note 2. Only The Best Storage News 3. Special Report: > Microsoft's Next Storage Play 4. Storage Spotlight: Hewlett-Packard > In Turmoil 5. Check Some Boxes, Win $500 6. Top Trend: Study Shows > Bright Future For Utility Computing 7. FUDBusters: Serial ATA > Storage Drives 8. Voting Booth: SMI-S Purchasing Plans 9. Discover > NAS Appliances In Product Finder 10. Check Out The Storage Pipeline > Topic Centers - Storage Software - Storage Hardware - SAN/NAS - > Storage Services 11. Tell A Colleague About Storage Pipeline > Newsletter 12. Have You Discovered The Other Pipelines? 13. > Subscribe To The Storage Pipeline RSS Feed > 14. Change Your Subscription Options [...] > > Content analysis details: (8.3 points, 5.0 required) > > pts rule name description > ---- ---------------------- > -------------------------------------------------- > -0.4 BAYES_05 BODY: Bayesian spam probability is 1 to 5% > [score: 0.0377] > 1.7 RCVD_IN_RFC_IPWHOIS RBL: Sent via a relay in > ipwhois.rfc-ignorant.org [$ has > inaccurate or missing WHOIS data at the] > [RIR] > 3.0 URIBL_WS_SURBL Contains a URL listed in the WS SURBL > blocklist [URIs: survey.com] > 4.0 URIBL_OB_SURBL Contains a URL listed in the OB SURBL > blocklist [URIs: messagingpipeline.com advancedippipeline.com > bizintelligencepipeline.com enterpriseappspipeline.com] This is from the CMP storagepipline list. Why are they on OB? And also WS? -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 972-414-9812 E-Mail: ler(a)lerctr.org US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749

2 1

ws.surbl.org entry lag
by Alex Broens 19 Aug '04

19 Aug '04

Jeff, Bill has mentioned that he updates the ws.surbl.org data every 15 minutes. how often/hour is this data loaded into the ws.surbl.org zone? Thanks Alex

2 2

Strange happenings...
by Bill Landry 19 Aug '04

19 Aug '04

Can anyone explain why this particular URI gets tagged by WS when none of the other URIs in the message (including several others from g.msn.com) get tagged: http://g.msn.MUNGEDcom/0NL34044/2531 Must be something about this particular URI string that causes the parser to handle it differently. If someone wants to see the message this URI came from, let me know and I'll send it to you. Bill

2 4

hat check
by Chris Santerre 18 Aug '04

18 Aug '04

With all this talk of spanking people for adding FPs, I'm not sure if I should be careful, or buy some beer and nachos and wait to be spanked ;) Anywho, I need a check on these guys: cwiservices.com Spank you very much, --Chris (The guy without AIM or ICQ!)

1 0

RE: [SURBL-Discuss] FP in ws.surbl.org domeus_REMOVE.com / domeus _REMOVE.es
by Chris Santerre 18 Aug '04

18 Aug '04

>-----Original Message----- >From: Mariano Absatz [mailto:el.baby@gmail.com] >Sent: Wednesday, August 18, 2004 2:00 AM >To: SURBL Discussion list >Subject: [SURBL-Discuss] FP in ws.surbl.org domeus_REMOVE.com / >domeus_REMOVE.es > > >Hi people, hi Bill... > >I just detected a FP in ws.surbl.org... and I was the one who >submitted the domains :-( > >It's 2 domains: domeus_REMOVE.com / domeus_REMOVE.es > >It seems to be some kind of public list server with little control >about what their users/customers subscribe. > >I'll look in my spamcan for the offending messages and will try to >contact them to see if they do something about those customers. > >But I got the FP from a message forwarded from a completely legit >mailing list, so I guess our policy should lead us to remove those >domains from the list. > >I'll see what I can do tomorrow... I'm finishing putting in production >MailScanner+SpamAssassin+SURBL in a mid-sized ISP... it's 3:00 AM, I >haven't slept a wink, I broke a leg last week and my Doctor insists on >opening it before this weekend to get the bone nailed in place... I >won't be able to walk on my feet for a month and a half :-( > >Regards. Bah! We get guys in hockey get injuries like that all the time. You will be back next season! They always come back! Muahahahahahahahah :) --Chris (Physical contact sport freak!)

1 0

RE: [SURBL-Discuss] Re: FP from WS
by Chris Santerre 18 Aug '04

18 Aug '04

Hell yeah! These didn't come from me or Steve! Oh that feels good to say! Of course, I haven't checked all my SURBL emails yet :) --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 17, 2004 9:19 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] Re: FP from WS > > >On Tuesday, August 17, 2004, 4:33:21 PM, Larry Rosenman wrote: >> The following 2 URIs (and possibly a third) are FP's: > >> i-say-MUNGED.com >> Surveynetworks-MUNGED.com > >> And possibly >> Itracks-MUNGED.com > >> i-say-MUNGED is the IPSOS survey site, and seems legit, and >> surveynetworks-MUNGED >> Is a collection of them. > >> I'm not 100% certain of itracks-MUNGED, but please check. > >> These are all on WS. > >Thanks Larry, >I checked them a little and they all look at least >quasi-legitimate, so I whitelisted them all, plus some >related domains: > >itracks.com >ipsos-reid.com >i-say.com >venteinc.com >surveynetworks.com > >We need to ask the ws folks how these are getting in >and how we can stop them from doing so. > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

RE: [SURBL-Discuss] cdbaby.com fp whitelisted
by Chris Santerre 18 Aug '04

18 Aug '04

I submitted from Ryan's submission. But I did check it and it looked spammy. Also had a bunch of NANAS hits, and not just one. I see a pattern of legit sites possibly being con'd by sleezy marketers. Causing them to be listed. It will probably happen in the future despite our best efforts. We can minimise of course. But if the domain is unfamiliar, looks kind of spammy (cdbaby, come one now!), has multiple NANAS or NANAE hits, is reported to be spamming, then most likely it will get listed. I had no doubts when I listed this. I'm still only going by what Jeff has said. But I don't go by what companies quote on there website. Everything Jeff quoted I've seen before on known spam sites. If a site has multiple reports on NANAS, from different people, over a stretch of time, then you bet it sends red flags up for me! I removed then and will update file. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 17, 2004 6:08 PM >To: SURBL Discuss >Subject: [SURBL-Discuss] cdbaby.com fp whitelisted > > >cdbaby.com was on ws. I've whitelisted it along with a couple >others: > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Re: [SURBL-Discuss] FP in ws.surbl.org domeus_REMOVE.com /domeus_REMOVE.es
by Jeff Chan 18 Aug '04

18 Aug '04

On Wednesday, August 18, 2004, 12:14:26 AM, Joe Wein wrote: >> Thanks, I've whitelisted: >> >> domeus.com >> domeus.es > Could you whitelist domeus.de also, just in case. I run a mailing list on > that service. > They are rumoured to have some problems, but basically are legitimate. Thanks, I've whitelisted the domains on their main page: ecircle-ag.com domeus.com domeus.de domeus.co.uk domeus.es domeus.fr domeus.it Jeff C.

1 0

FP from WS
by Larry Rosenman 18 Aug '04

18 Aug '04

The following 2 URIs (and possibly a third) are FP's: i-say-MUNGED.com Surveynetworks-MUNGED.com And possibly Itracks-MUNGED.com i-say-MUNGED is the IPSOS survey site, and seems legit, and surveynetworks-MUNGED Is a collection of them. I'm not 100% certain of itracks-MUNGED, but please check. These are all on WS. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 972-414-9812 E-Mail: ler(a)lerctr.org US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749

5 10

[SURBL-Discuss] FP in ws.surbl.org domeus_REMOVE.com / domeus_REMOVE.es
by Mariano Absatz 18 Aug '04

18 Aug '04

Hi people, hi Bill... I just detected a FP in ws.surbl.org... and I was the one who submitted the domains :-( It's 2 domains: domeus_REMOVE.com / domeus_REMOVE.es It seems to be some kind of public list server with little control about what their users/customers subscribe. I'll look in my spamcan for the offending messages and will try to contact them to see if they do something about those customers. But I got the FP from a message forwarded from a completely legit mailing list, so I guess our policy should lead us to remove those domains from the list. I'll see what I can do tomorrow... I'm finishing putting in production MailScanner+SpamAssassin+SURBL in a mid-sized ISP... it's 3:00 AM, I haven't slept a wink, I broke a leg last week and my Doctor insists on opening it before this weekend to get the bone nailed in place... I won't be able to walk on my feet for a month and a half :-( Regards. -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss