Re: URIBL_RHS_DOB high hits

[Reindl Harald]

Am 12.10.2014 um 02:20 schrieb Karsten Bräckelmann:

On Sun, 2014-10-12 at 01:28 +0200, Reindl Harald wrote:

Am 12.10.2014 um 01:09 schrieb Karsten Bräckelmann:

it hits again and i doubt that sourceforge is a new domain

However, what I am much more annoyed about is your rambling, claiming
DOB would list sourceforge.net -- and by that, particularly with this
thread's topic, giving the impression of DOB again listing the world.
Which it doesn't.

it seems to hit randomly which is even more worse because listing the
world is more obvious - i claim that it is not trustable currently, not
more and not less, may anybody make his own decision, i told mine and
there is nothing worng with that

You have exactly one false positive listing. That is not even close to
"hit randomly".

URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread)
[URIs: goo.gl]

Domain Name: goo.gl
Domain ID: Imp619-GL
WHOIS Server:
Referral URL:
Updated Date: 2013-12-02T19:11:52.689Z
Creation Date: 2005-06-22T02:00:00.000Z

well, i can't verify the other hits because don't have access to other users email - the follwoing is another one and that *is* the definition of randomly - in doubt such a list must not answer when there is not verified data instead hit a FP

Please stop the repeated, false accusations on this list.

point out that it is not trustable currently is not a accusation and frankly http://support-intelligence.com/dob/ itself states "The list is currently in BETA and should be used accordingly. We still have some kinks in it and occasionally domains older than five days, or other important domains end up in the list"

Obviously, you did not check facts or investigate the issue at all.

don't get me wrong, there ist not much to investigate if it hits legit
mailing-list messages

Correct, there is not much to investigate. The *only* thing would be to
verify *which* domain hit the DOB listing, and whether it actually is a
bad or warranted listing. Besides, that one is absolutely crucial to
check before claiming a false positive.

A single thing to verify. You did not

if it hits a regular mailing list thread it is problematic and as said if there are no data for whatever reason the answer should be NXDOMAIN and not 127.0.0.1 in doubt because FP does more harm than FN

signature.asc
Description: OpenPGP digital signature