https://bugzilla.wikimedia.org/show_bug.cgi?id=42792
--- Comment #10 from Platonides <[email protected]> --- Short version: Alexandr, the cbl claims that you are infected with the festi spambot. Long version: The ip is listed in spamhaus: 139.152.66.217.xbl.spamhaus.org. 127.0.0.4 [this means it comes from CBL] It can be consulted on http://www.spamhaus.org/query/bl?ip=217.66.152.139 It appears both in the pbl (for emails) and in the xbl (the one used by wikidata). The entry in the xbl is there due to appearing in the cbl: http://cbl.abuseat.org/lookup.cgi?ip=217.66.152.139 «IP Address 217.66.152.139 is listed in the CBL. It appears to be infected with a spam sending trojan, proxy or some other form of botnet. It was last detected at 2012-12-11 12:00 GMT (+/- 30 minutes), approximately 9 hours, 30 minutes ago. This IP is infected (or NATting for a computer that is infected) with the festi spambot. In other words, it's participating in a botnet. If you simply remove the listing without ensuring that the infection is removed (or the NAT secured), it will probably relist again. This IP is infected (or NATting for a computer that is infected) with a spam-sending infection. In other words, it's participating in a botnet. If you simply remove the listing without ensuring that the infection is removed (or the NAT secured), it will probably relist again. » It's interesting however that the CBL purpose is for email only «The CBL is intended to be used only on inbound email from the Internet.» (see the more lengthy explanation there) Also see http://cbl.abuseat.org/tandc.html point 7 The faq for the XBL http://www.spamhaus.org/faq/section/Spamhaus%20XBL#155 seems less unhappy about it being used with non-email (although it is still recommending captchas, not blocks). -- You are receiving this mail because: You are on the CC list for the bug. You are watching all bug changes. _______________________________________________ Wikibugs-l mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
