RE: [SAtalk] Possible FP on big evil list

[Jennifer Wheeler]

Helloo.
  
FP Notice.

FP forwarded to me this morning on an ebay "Bid Confirmed" notice.

BigEvilList_133 contains "pics.ebaystatic.com" which is in the source of
the "bid confirmed" emails from ebay auctions.  It pushed it to 8.34; we
tag at 7.0. Other custom rules contributed 0.7 to the score, default
rules SA 2.61 gave the email 4.8.  (Just to help you determine whether
or not you want to remove this from your file) 

Here is the little bugger in the source..

<snip>
<tr>
<td><a href="http://www.ebay.com/";><img
src="http://pics.ebaystatic.com/aw/pics/email/eBayLogo.gif"; border="0"
align="right"></a><font size="4" face="Verdana">
You Are the Current High Bidder
</font>
<snip>

Jennifer



> -----Original Message-----
> From: [EMAIL PROTECTED]
[mailto:spamassassin-
> [EMAIL PROTECTED] On Behalf Of Chris Santerre
> Sent: Thursday, December 04, 2003 11:59 AM
> To: 'Rich Puhek'
> Cc: Spamassassin-Talk (E-mail)
> Subject: [SAtalk] Possible FP on big evil list
> 
> CC'd to list for opinions.
> 
> OK, this one actually bothers me. The URIs hitting are Pull\.xmr3\.com
and
> xmr3\.com . Googleing on these shows many people blocking this domain.
Has
> this person signed up for this "Sams Club" newsletter? Is it UCE not
spam?
> (That is a loaded/large debate quetion right there!) I'm hesitant to
> remove
> this one. This domain might be used by spammers and legit. Argh!
> 
> Again, checking openrbl.org doesn't help much. I'm looking for spam
hosts,
> not senders.
> 
> Now I know why the dynablock guy went mad and retired ;)
> 
> --Chris (Off to grep the copri.....again!) Santerre
> 
> > -----Original Message-----
> > From: Rich Puhek [mailto:[EMAIL PROTECTED]
> > Sent: Wednesday, December 03, 2003 5:02 PM
> > To: [EMAIL PROTECTED]
> > Subject: *****SPAM***** Possible FP on big evil list
> >
> >
> > We've received a couple of complaints for the following
> > email. I haven't
> > confirmed if the email itself is legit. It hits
> > BigEvilList_138 and _175.
> >
> > Looks like I was running version 1.52 at the time the email
> > came through
> > to them... although it's also possible I was running 1.5
> > (changed late
> > this morning).
> >
> > Thanks!
> >
> > --Rich
> >
> *snip*
> >
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: IBM Linux Tutorials.
> Become an expert in LINUX or just sharpen your skills.  Sign up for
IBM's
> Free Linux Tutorials.  Learn everything from the bash shell to sys
admin.
> Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
> _______________________________________________
> Spamassassin-talk mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk