no-reply@malwarebytes.org on Sorbs?

[Kernel Krumpet]

A different type of false positive but... just wondering if no-reply@malwarebytes.org is truly from the following IP and why would it be blacklisted on Sorbs? Or, does this happen all the time from p'd off baddies? Is this just the wrong IP from a reverse DNS check?

Exchange - current & up to date - w/Outlook 2010 client (not that it matters much at all)

Blacklist Subscribe: Sorbs, SpamHaus et al.

Exchange Spam Filter AgentLog below:

Time: 2010-10-07T00:47:47.238Z

From IP: 69.1xx.xx.xx

P1 from: no-reply@malwarebytes.org

Recipient: mbam@mydomain.com

No. Recipients: 1

Exchg Agent: Connection Filtering Agent

Event: OnRcptCommand

Action: RejectCommand

SMTP Response: 550 5.7.1 Recipient not authorized, your IP has been found on a block list

Reason: BlockListProvider

Reason Data: Sorbs

I'll keep checking my logs... hopefully I'll get a reply email through from you fine folks!

Keep up the good fight 'k!

Thanks.

FWIW: 1:30am PST - Sorbs appears down... ???

[Kernel Krumpet]

A different type of false positive but... just wondering if no-reply@malwarebytes.org is truly from the following IP ....

Time: 2010-10-07T00:47:47.238Z

From IP: 69.1xx.xx.xx

P1 from: no-reply@malwarebytes.org

SMTP Response: 550 5.7.1 Recipient not authorized, your IP has been found on a block list

Reason: BlockListProvider

Reason Data: Sorbs

All appears OK now that I check Sorbs

Looks like it was a Sorbs hiccup ..... Apologies for the miss placed alarm.

[MysteryFCM]

http://isc.sans.org/diary.html?storyid=9685

[Kernel Krumpet]

http://isc.sans.org/diary.html?storyid=9685

Yup - looked like something like that due to the - Sorbs inaccessibility. Thanks for the link. I appreciate your follow-thru.

Re: Paraphrasing from the article above, two of the only "eggs in one basket" I use are Malwarebytes for Malware catching and SpamGrabber --> SpamCop for acting Globally!

think local - act global