I always 'LOOK' at the actually displayed message within my mailer and THEN analyze the source... but looking at this, I'd tend to report opoloves.com and netuetion.com (supposing the faxd.gif has something visible in it).
Please, people... by far the BEST thing about SURBL is its really, really, really low FP rate so you can be very comfortable scoring it high.
I have them scored at 3.5 (except for 6dos) in a VERY conservative ISP and it's doing wonderfully.
I can't offer right now 'cause I have no time at all, but I'd very much like that the SURBL lists keep being managed manually.
It'd be great if we could, at some point, form a small group of volunteers with VERY good skills at spotting guilty URIs within spam and keep the lists much like clamav maintains its virus database...
On Thu, 8 Jul 2004 16:21:45 -0400 , Chris Santerre csanterre@merchantsoverseas.com wrote:
I just wanted to share this example submitted today. (Thanks Dave!)
Can you tell which domains to report? :)
This is why scraping urls with scripts is no good.
<a href="http://opoloves.com/tp/default.asp?id=rxsavings"> <img src="http://netuetion.com/faxd.gif" border=0> </a>
<br> Up to 8<A href="http://www.impractical.org"></A>0<A href="http://www.hettie.org"></A>% Sa<A href="http ://www.sheath.org"></A>vin<A href="http://www.inhibitor.org"></A>gs on X<A href="http://www.brown.org" ></A>an<A href="http://www.shinto.org"></A>ax, Va<A href="http://www.triptych.org"></A>li<A href="http ://www.irreproducible.org"></A>um, P<A href="http://www.anonymity.org"></A>hen<A href="http://www.sire n.org"></A>term<A href="http://www.warble.org"></A>ine, V<A href="http://www.bind.org"></A>ia<A href=" http://www.volterra.org"></A>gr<A href="http://www.baccarat.org"></A>a <b><a href="http://opoloves.com/tp/default.asp?id=rxsavings"> HERE</a></b>
<br><BR><br><br>
<P align=center><FONT face="Verdana, Arial, Helvetica, sans-serif" size=1>For em<A href="http://www.della.org"></A>ail re<A href="http://www.aviate.org"></A>mov<A href="http://www.accede.org"></A>a<A href="http://www.servitor.org"></A>l, g<A href="http://www.beet.org"></A>o <A href="http://opoloves.com/er/e.asp">here.</A></FONT></P>
Wasn't that fun! :) Took a human eye about 20 seconds to find the 2 that mattered.