----- Original Message ----- From: "Kevin A. McGrail" kmcgrail@pccc.com To: "SURBL Discussion list" discuss@lists.surbl.org Sent: Saturday, August 18, 2007 5:11 PM Subject: Re: [SURBL-Discuss] RFC: Storm URI IPs to XS list?
Am I missing something ? I thought we were talking about IP's as URL's ? How many false positives are there likely to be when hardly anyone on
dynamic
IP's are going to be running a web server and hand out their IP as a URL
?
And if there WERE any false positives does anyone really care ? If they want to run a reliable web server then get a proper one. My opinion.
They aren't running it on purpose. It's a bot-network-installed web
server
that runs to then serve as a landing place for others to get the payload file. Like all those ecard emails with http://123.123.123.123/. This is someone's machine that is infected that is sending out spams and saying, here's a payload file.
Yup I know. I have 000's on file. But where are the false positives going to come from ?
All the best
Phil
_____________________________________________
Website Hosting from only £5.00 per month. www.medwayhosting.com - +44 (0)1634 856965 _____________________________________________
Digital & Traditional Printing, and much more www.medwayprint.com - +44 (0)1634 281199 _____________________________________________