Discuss

discuss@lists.surbl.org

1 participants
1864 discussions

Help checking a few FPs
by Jeff Chan 05 Oct '04

05 Oct '04

Got some more FPs from hams: /home/gorilla/black-gorilla-8_04.txt:servebeer.com /web/antispam/outblaze.domains.sort:pacmanhattan.com /web/antispam/mailsecurity.spam.domains:romp.com /home/prolocation/black-prolocation-master:romp.com These all seem to have legitimate uses to me. servebeer.com belongs to dynamic DNS provider No-IP.com so obviously it's subject to some abuse, but it also seems to have legitimate uses. pacmanhattan.com is apparently a university student project to play Pacman on city steets with people. romp.com appears to be a National Lampoon movie site. I'd like to whitelist all of these but would like to hear from Chris, David, Outblaze and Raymond about why they listed them. None have SBL hits. romp and pacman have no NANAS, and as expected serverbeer has 29 NANAS. The full list from the 5 source hams includes the three probable FPs above and some others which are not in SURBLs, but which should probably be whitelisted since they appear in things like Debian Linux newsletters. catb.org debian.org debianforum.de ffii.org gnu.org harddisk-recovery.nl heise.de infodrom.org kitenet.net leidenuniv.nl linuxtag.org opensource.org pacmanhattan.com romp.com servebeer.com spi-inc.org uu.nl wallsplash.net xtronics.com Comments please, Jeff C. -- "If it appears in hams, then don't list it."

4 7

RE: [SURBL-Discuss] Whitelist kit . net
by Chris Santerre 05 Oct '04

05 Oct '04

>-----Original Message----- >From: Yves Junqueira [mailto:yves.junqueira@gmail.com] >Sent: Monday, October 04, 2004 12:04 PM >To: Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] Whitelist kit . net > > >On Mon, 4 Oct 2004 07:29:14 -0700, Jeff Chan <jeffc(a)surbl.org> wrote: >> The policy is: if it has legitimate uses, then don't list. >> >> Can you provide some examples of legitimate sites on kit.net >> (preferably in English)? >> >> Jeff C. > >Sorry, I couldn't find any in english. > >http://www.tmabc.kit.net - >http://www.1mais1.kit.net - They seem good people. They are a group >of volunteers that assist home less people. Doesn't seem to be a scam. > >I'd suggest whitelisting kit.net if, and only if, you are really >strict to the policy. They do host many trojans and scam sites there. > Why not treat them like the tld is 'kit.net' and list on subdomains? --Chris

3 2

RE: [SURBL-Discuss] Help checking a few FPs
by Chris Santerre 04 Oct '04

04 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, October 04, 2004 9:31 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Help checking a few FPs > > >On Monday, October 4, 2004, 6:17:09 AM, Alex Broens wrote: >> Jeff Chan wrote: > >>> catb.org >>> debian.org >>> debianforum.de >>> ffii.org >>> gnu.org >>> harddisk-recovery.nl >>> heise.de >>> infodrom.org >>> kitenet.net >>> leidenuniv.nl >>> linuxtag.org >>> opensource.org >>> pacmanhattan.com >>> romp.com >>> servebeer.com >>> spi-inc.org >>> uu.nl >>> wallsplash.net >>> xtronics.com > >> the .de are very ugly FPs, especially heise ...... wow > >Actually to clarify, that's the full list that appeared >in hams that had some FPs, but the FPs were only the >first three: > >>> servebeer.com belongs to dynamic DNS provider No-IP.com >>> so obviously it's subject to some abuse, but it also >>> seems to have legitimate uses. >>> >>> pacmanhattan.com is apparently a university student >>> project to play Pacman on city steets with people. >>> >>> romp.com appears to be a National Lampoon movie site. > >In other words those other domains appeared in messages >that had the three FPs. The others are not FPs, but >probably should be whitelisted since they appeared in >things like legitimate Linux newsletters. > >Hope this clarifies things. > serverbeer has 8 reported spams in a 9 month period. What was this link pointing to in the newsletter? --Chris

3 2

RE: [SURBL-Discuss] Help checking a few FPs
by Chris Santerre 04 Oct '04

04 Oct '04

>-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Monday, October 04, 2004 11:02 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Help checking a few FPs > > >Chris Santerre wrote: >>>-----Original Message----- >>>From: Jeff Chan [mailto:jeffc@surbl.org] >>>Sent: Monday, October 04, 2004 10:34 AM >>>To: SURBL Discuss >>>Subject: Re: [SURBL-Discuss] Help checking a few FPs >>> >>> >>>On Monday, October 4, 2004, 7:24:08 AM, Chris Santerre wrote: >>> >>>>>From: Jeff Chan [mailto:jeffc@surbl.org] >>> >>>>>>>servebeer.com belongs to dynamic DNS provider No-IP.com >>>>>>>so obviously it's subject to some abuse, but it also >>>>>>>seems to have legitimate uses. >>> >>>>serverbeer has 8 reported spams in a 9 month period. >>> >>>>What was this link pointing to in the newsletter? >>> >>>It was in a Debian bug report: >>> >>> http://lists.debian.org/debian-wnpp/2004/06/msg00434.html >>> >>> >>>>From: Florian Ragwitz <florian(a)mookooh.org> >>>>To: Debian Bug Tracking System <submit(a)bugs.debian.org> >>>>Subject: ITP: wmibam -- dockapp to monitor the apm status using ibam >>>>X-Mailer: reportbug 2.58 >>>>Date: Tue, 25 May 2004 18:26:36 +0200 >>>>X-Debbugs-Cc: debian-devel(a)lists.debian.org >>>>Message-Id: <20040525162643.17303184E2(a)godsmacker.servebeer.com> >>>>Delivered-To: submit(a)bugs.debian.org >>>>X-Spam-Checker-Version: SpamAssassin >2.60-bugs.debian.org_2004_03_25 >>>> (1.212-2003-09-23-exp) on spohr.debian.org >>>>X-Spam-Status: No, hits=-11.0 required=4.0 >>> >>>tests=BAYES_00,HAS_PACKAGE, >>> >>>> X_DEBBUGS_CC autolearn=ham >>> >>>version=2.60-bugs.debian.org_2004_03_25 >>> >>>>X-Spam-Level: >>>> >>>>Package: wnpp >>>>Severity: wishlist >>>> >>>>* Package name : wmibam >>>> Version : 0.0.1 >>>> Upstream Author : Florian Ragwitz <florian(a)mookooh.org> >>>>* URL : >> >> http://godsmacker.servebeer-MUNGED.com/~florian/wmibam/ >> >>>* License : GPL >>> Description : dockapp to monitor the apm status using ibam >>> >>> wmibam is a dockapp that monitors the apm status using the >intellegent >>> battery monitor (ibam) by Sebastian Ritterbusch. It can be used with >>> window managers like WindowMaker, AfterStep, BlackBox or >>> Enlightenment. >> >> >> >> The link is dead. Perhaps they boot ham'rs from their network? ;) >> > >go the feeling the guy miss-spelt. Probably meant >servebeer.com which is >a dyndns domain offered by no-ip.com. > Yes....which will not let you connect. -Chris

1 0

Whitelist kit . net
by Yves Junqueira 04 Oct '04

04 Oct '04

Hi. kit.net is a free host provider in Brazil that hosts many phishing scams with trojans etc as sub domains. Yet, they host a few inocent sites too. According to the "if it's in ham, do not list it" policy, this one should not be listed. I had to add "kit.net" (not ".kit.net") to my local whitelist because WC was giving me many FPs. I maintain a small list of *.kit.net spam domains that could be used. What is the policy for this kind of free host servers? In my local rbl server I have all those Spamvertized domains listed, but "kit.net" itself is not. -- Yves Junqueira http://www.lynx.com.br

2 2

RE: [SURBL-Discuss] Help checking a few FPs
by Chris Santerre 04 Oct '04

04 Oct '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, October 04, 2004 10:34 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Help checking a few FPs > > >On Monday, October 4, 2004, 7:24:08 AM, Chris Santerre wrote: >>>From: Jeff Chan [mailto:jeffc@surbl.org] > >>>>> servebeer.com belongs to dynamic DNS provider No-IP.com >>>>> so obviously it's subject to some abuse, but it also >>>>> seems to have legitimate uses. > >> serverbeer has 8 reported spams in a 9 month period. > >> What was this link pointing to in the newsletter? > >It was in a Debian bug report: > > http://lists.debian.org/debian-wnpp/2004/06/msg00434.html > >> From: Florian Ragwitz <florian(a)mookooh.org> >> To: Debian Bug Tracking System <submit(a)bugs.debian.org> >> Subject: ITP: wmibam -- dockapp to monitor the apm status using ibam >> X-Mailer: reportbug 2.58 >> Date: Tue, 25 May 2004 18:26:36 +0200 >> X-Debbugs-Cc: debian-devel(a)lists.debian.org >> Message-Id: <20040525162643.17303184E2(a)godsmacker.servebeer.com> >> Delivered-To: submit(a)bugs.debian.org >> X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25 >> (1.212-2003-09-23-exp) on spohr.debian.org >> X-Spam-Status: No, hits=-11.0 required=4.0 >tests=BAYES_00,HAS_PACKAGE, >> X_DEBBUGS_CC autolearn=ham >version=2.60-bugs.debian.org_2004_03_25 >> X-Spam-Level: >> >> Package: wnpp >> Severity: wishlist >> >> * Package name : wmibam >> Version : 0.0.1 >> Upstream Author : Florian Ragwitz <florian(a)mookooh.org> >> * URL : http://godsmacker.servebeer-MUNGED.com/~florian/wmibam/ > * License : GPL > Description : dockapp to monitor the apm status using ibam > > wmibam is a dockapp that monitors the apm status using the intellegent > battery monitor (ibam) by Sebastian Ritterbusch. It can be used with > window managers like WindowMaker, AfterStep, BlackBox or > Enlightenment. The link is dead. Perhaps they boot ham'rs from their network? ;) --Chris

2 1

namesdatabase . com
by Bitz 04 Oct '04

04 Oct '04

namesdatabase . com Listed at WS. It has legit uses, should be whitelisted?

10 17

Re: [SURBL-Discuss] Re: 419 for school???
by Frank Ellermann 03 Oct '04

03 Oct '04

David B Funk wrote: [esthereki17(a)indiatimes.com} > This scammer is probably depending upon their victims to > just hit the "Reply" button. indiatimes.com.abuse.rfc-ignorant.org = 127.0.0.4 That's a known bulletproof 419 RfC ignorant. :-( Bye, Frank

1 0

Possible FP @ WS
by Bitz 03 Oct '04

03 Oct '04

phonehog . com 0 in SBL. Few sightings in NANAS, possibly due to their referral program. Domain was created on: 15-Dec-99 and does offer free long distance calls to their subscribers (i don't know what is the catch). The site looks legit and should be whitelisted, I think ;-) Jeff, I'm sending you a copy of the message off-list. Regards, -b.

2 1

FP?
by Bitz 03 Oct '04

03 Oct '04

Hello, The following domains are listed at WS, there were sightings in NANAS, some says poetry . com is a total scam :-) cellular-parts . com Created on: 30-Jul-98 poetry . com Created on 15-Oct-1996 We have customers who are actively subscribed to their lists. But just wanted to get everyones opinion whether these 2 should be whitelisted. Thanks, -b.

3 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss