On Saturday, October 16, 2004, 8:21:57 AM, Steven Champeon wrote:
on Sat, Oct 16, 2004 at 08:09:52AM -0700, Jeff Chan wrote:
On Saturday, October 16, 2004, 7:49:16 AM, Steven Champeon wrote:
on Fri, Oct 15, 2004 at 06:42:21PM -0700, Jeff Chan wrote:
On Friday, October 15, 2004, 8:24:27 AM, Alex Broens wrote:
>/home/gorilla/black-gorilla-7_04.txt in nouse-white-jeffc-dmoz
medica.de= large German Medical Exhibition in Duesseldorf. Definitely not a spamhaus.
Can't imagine how these could get onto any list, other than a joe job or open subscription?
Please see my post WRT the "firstmlastzz" spammer. I know back in the day before I started distinguishing between blocking and tagging I'd throw the domains of any spam sender I saw into the blacklist. The list I sent Chris a few months ago was like that - full of ccTLD domains harvested from spam senders and HELOs - but I've since cleaned it up and started to distinguish between the badhelos and spammer domains.
Can you do a diff from an earlier version and get us a list to remove from the current data? It could help a lot. :-)
I've already sent this to Chris IIRC, but here's my 'badhelos' file - you should be able to use it as a FP test; most of the legit domains in it were passed as part of the firstmlastzz spamware's HELO or sender.
Thanks. Should we ask Chris to try to remove these from his 7/04 data?
Jeff C. -- "If it appears in hams, then don't list it."