[SURBL-Discuss] FP help please

Chris Santerre csanterre at merchantsoverseas.com
Mon Aug 23 11:47:58 CEST 2004


I would REMOVE spinpalace only. Do not whitelist. Place on watch list. I
agree with your other whitelists. 

>-----Original Message-----
>From: Jeff Chan [mailto:jeffc at surbl.org]
>Sent: Monday, August 23, 2004 4:53 AM
>To: SURBL Discuss
>Cc: postmaster at outblaze.com
>Subject: Re: [SURBL-Discuss] FP help please
>
>
>On Sunday, August 22, 2004, 10:18:03 PM, Jeff Chan wrote:
>> Can I get some research help in deciding which of the
>> following FPs to whitelist?
>
>OK I did some of my own research and whitelisted most of
>these:
>
>>> Date: Sat, 21 Aug 2004 10:06:57 -0400
>>> From: John Lundin <lundin at cavtel.net>
>>> To: SURBL Discussion list <discuss at lists.surbl.org>
>>> Subject: [SURBL-Discuss] more possible FPs (2 OB, 4 WS and 2 DS)
>
>>> Eight possible FPs. These were taken from items reported as 
>non-spam.
>>> The "nanas" number is raw matches on the domain from google groups.
>>> Use your own judgement...
>>> 
>>> OB: www.mercenariesthegameMUNGED.com (nanas 0)
>>>   mentioned in a lucasarts review
>
>Apparently a LucasArts game.  Lucas are probably not
>spammers.  Whitelisting:
>
>thx.com
>lucasfilm.com
>lucasarts.com
>mercenariesthegame.com
>
>>> OB: www.jmiequityMUNGED.com (nanas 0)
>>>   mentioned in a Dow Jones newsletter
>>>   The original wasn't caught by OB, but it shows up now.
>
>A stock fund of an investment company whose original domain
>was registered in 1995.  Probably not spammers.  Whitelisting:
>
>jmi-inc.com
>jmiequity.com
>
>>> WS: Wireless.VentureReporterMUNGED.net (nanas 9) A stock newsletter.
>>>   I checked back: it really had been subscribed to.
>
>Belongs to Dow Jones.  Unlikely to be spammers.  Whitelisting:
>
>dowjones.com
>siliconalleydaily.com
>venturereporter.net
>
>>> WS: nmailerMUNGED.com (nanas 36)  Design center newsletter.
>>>   http://ellington.nmailerMUNGED.com/mailman/listinfo/dtgnews
>
>Belongs to graphics design folks with a 1995 domain registration.
>Whitelisting:
>
>graphic-design.com
>graphic-design.net
>nmailer.com
>
>>> WS: www.imakenewsMUNGED.com (nanas 42)  organization newsletter.
>>>   http://www.imakenewsMUNGED.com/cabf/ (+ cleaned user tracking)
>>>   imakenews makes me nervous... intrusive html.
>
>Whitelisting; 1999 registration:
>
>imakenews.com
>
>>> WS: ntcrMUNGED.us (nanas 43, some similar)  Jupitermedia Web Events.
>>>   (origin of mailing list -- appearance in unsubscribe disclaimer)
>>>   (Site won't display for me, insufficiently motivated to 
>find out why
>>>   it said "Your Web browser must have cookies enabled" regardless.)
>
>Belongs to netcreations.com.  Are they a spamhaus?
>
>
>> DS: surveyhelp.harrispollonlineMUNGED.com (nanas 19)
>>   http://www.harrispollonlineMUNGED.com/sweeps.asp
>>   (sigh) yes, they subscribed to it.
>
>Legitimate pollsters.  Whitelisting:
>
>harrisinteractive.com
>harrispollonline.com
>
>> DS: www.winxpnewsMUNGED.com (nanas 42)
>>   http://www.winxpnewsMUNGED.com/issues.cfm
>>   Single reference in a tech newsletter...
>
>Looks like a legitimate tech newsletter.  Whitelisting:
>
>winxpnews.com
>
>
>
>The next domains were in WS:
>
>>> Date: Saturday, August 21, 2004, 12:37:45 PM
>>> Subject: fps
>>> 
>>> bridgetrack.com (used by nytimes.com)
>
>Looks like a legitimate web tracking operation.  Whitelisting:
>
>planninggroup.com
>bridgetrack.com
>
>Some of their tracking image URIs may have appeared in spams
>but it's probably from citi phishers copying them from real
>messages.
>
>Comments?
>
>>> elabs.com (EASTERN LABORATORIES INC.)
>
>1995 registration, whitelisting:
>
>elabs.com
>
>>> mfcreative.com (ancestry.com/myfamily.com/rootsweb.com, 
>Genealogy ad)
>
>Looks legit.  Whitelisting:
>
>myfamily.net
>myfamilyinc.com
>mfcreative.com
>
>>> secureserver.net (in message containing godaddy.com)
>
>Used by legitimate registrars like dotster and godaddy.
>Whitelisting:
>
>secureserver.net
>securepaynet.net
>
>>> dnews.com (Moscow-Pullman Daily News)
>
>Small local newspaper in Idaho.  Probably not a major spammer.
>Whitelisting:
>
>dnews.com
>
>>> spinpalace.com (appeared in xe.com currency update mailing list)
>
>Online casino.  Appears in marginally spammy places.  Does anyone
>have any info about them?
>
>
>It would be nice to distribute some of the work of checking
>FPs in future.
>
>
>WS and OB folks may want to remove some of these ones from their
>respective lists, and/or share their research with us.
>
>Jeff C.
>
>_______________________________________________
>Discuss mailing list
>Discuss at lists.surbl.org
>http://lists.surbl.org/mailman/listinfo/discuss
>


More information about the Discuss mailing list