[SURBL-Discuss] FP?: ultimatebizsource.biz

Jeff Chan jeffc at surbl.org
Sat Oct 16 17:27:36 CEST 2004


On Saturday, October 16, 2004, 8:21:57 AM, Steven Champeon wrote:
> on Sat, Oct 16, 2004 at 08:09:52AM -0700, Jeff Chan wrote:
>> On Saturday, October 16, 2004, 7:49:16 AM, Steven Champeon wrote:
>> > on Fri, Oct 15, 2004 at 06:42:21PM -0700, Jeff Chan wrote:
>> >> On Friday, October 15, 2004, 8:24:27 AM, Alex Broens wrote:
>> >> 
>> >> >>>/home/gorilla/black-gorilla-7_04.txt in nouse-white-jeffc-dmoz
>> >> 
>> >> > medica.de= large German Medical Exhibition in Duesseldorf.
>> >> > Definitely not a spamhaus.
>> 
>> >> Can't imagine how these could get onto any list, other than
>> >> a joe job or open subscription?
>> 
>> > Please see my post WRT the "firstmlastzz" spammer. I know back in the
>> > day before I started distinguishing between blocking and tagging I'd
>> > throw the domains of any spam sender I saw into the blacklist. The list
>> > I sent Chris a few months ago was like that - full of ccTLD domains
>> > harvested from spam senders and HELOs - but I've since cleaned it up
>> > and started to distinguish between the badhelos and spammer domains.
>> 
>> Can you do a diff from an earlier version and get us a list to
>> remove from the current data?  It could help a lot.  :-)

> I've already sent this to Chris IIRC, but here's my 'badhelos' file -
> you should be able to use it as a FP test; most of the legit domains in
> it were passed as part of the firstmlastzz spamware's HELO or sender.

>  http://enemieslist.com/downloads/badhelos

Thanks.  Should we ask Chris to try to remove these from his 7/04
data?

Jeff C.
--
"If it appears in hams, then don't list it."



More information about the Discuss mailing list