Pete,
I just checked real quick hitting several DNS servers (mine and others) and
I am not seeing this - are you still seeing this now?
C:\>nslookup 2.0.0.127.multi.surbl.org
Server: nscache5.bflony.adelphia.net
Address: 68.168.224.180
Non-authoritative answer:
Name: 2.0.0.127.multi.surbl.org
Address: 127.0.0.126
C:\>nslookup declude.com.multi.surbl.org
Server: nscache5.bflony.adelphia.net
Address: 68.168.224.180
*** nscache5.bflony.adelphia.net can't find declude.com.multi.surbl.org:
Non-exi
stent domain
C:\>nslookup w3.org.multi.surbl.org
Server: nscache5.bflony.adelphia.net
Address: 68.168.224.180
*** nscache5.bflony.adelphia.net can't find w3.org.multi.surbl.org:
Non-existent
domain
Darrell
------------------------------------------------------------------------
Check out http://www.invariantsystems.com for utilities for Declude And
Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.
----- Original Message -----
From: "Matt" <[EMAIL PROTECTED]>
To: <sniffer@SortMonster.com>
Sent: Tuesday, January 17, 2006 7:21 AM
Subject: Re: [sniffer] Watch out... SURBL & SORBS full of large ISPs and
Antispamprovidres.
Pete,
w3.org would be a huge problem because Outlook will insert this in the XML
headers of any HTML generated E-mail.
If you could give us an idea of when this started and possibly ended, that
would help in the process of review.
Thanks,
Matt
Pete McNeil wrote:
Hello Sniffer Folks,
Watch out for false positives. This morning along with the current
spam storm we discovered that SURBL and SORBs are listing a large
number of ISP domains and anti-spam service/software providers.
As a result, many of these were tagged by our bots due to spam
arriving at our system with those domains and IPs. Most IPs and
domains for these services are coded with "nokens" in our system to
prevent this kind of thing, but a few slipped through.
We are aggressively hunting any more that might have arrived.
You may want to temporarily reduce the weight of the experimental IP
and experimental ad-hoc rule groups until we have identified and
removed the bad rules we don't know about yet.
Please also do your best to report any false positives that you do
identify so that we can remove any bad rules. I don't expect that
there will be too many, but I do want to clear them out quickly if
they are there.
Please also, if you haven't already, review the false positive
procedures:
http://www.sortmonster.com/MessageSniffer/Help/FalsePositivesHelp.html
Pay special attention to the rule-panic procedure and feature in
case you are one of the services hit by these bad entries.
An example of some that we've found in SURBL for example are
declude.com, usinternet.com, and w3.org
It's not clear yet how large the problem is, but I'm sure it will be
resolved soon.
Hope this helps,
Thanks,
_M
Pete McNeil (Madscientist)
President, MicroNeil Research Corporation
Chief SortMonster (www.sortmonster.com)
Chief Scientist (www.armresearch.com)
This E-Mail came from the Message Sniffer mailing list. For information
and (un)subscription instructions go to
http://www.sortmonster.com/MessageSniffer/Help/Help.html
This E-Mail came from the Message Sniffer mailing list. For information
and (un)subscription instructions go to
http://www.sortmonster.com/MessageSniffer/Help/Help.html
This E-Mail came from the Message Sniffer mailing list. For information and
(un)subscription instructions go to
http://www.sortmonster.com/MessageSniffer/Help/Help.html