Discuss May 2004

discuss@lists.surbl.org

44 participants
91 discussions

Re: ANTI-SURBL technique used by spammer
by Jeff Chan 20 May '04

20 May '04

On Wednesday, May 19, 2004, 2:22:38 PM, Fred wrote: > Jeff, > Are you aware of http://freecache.org ? > Take a look here if not: > http://slashdot.org/articles/04/05/12/1635205.shtml?tid=126&tid=95 > Thanks! > Frederic Tarasevicius Thanks for the info Fred. Sounds like akamai for the rest of us. :) Should we publish the surbl site with it? Jeff C.

1 0

RE: [SURBL-Discuss] DNS for dummies
by rleonard＠opto22.com 19 May '04

19 May '04

:) I hate to ask.. but which perl module? -----Original Message----- From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] Sent: Wednesday, May 19, 2004 1:00 PM To: SURBL Discussion list Subject: RE: [SURBL-Discuss] DNS for dummies Hi! > Thank you! I really appreciate your help. > > I'll check in a day or so to see if my traffic outbound to the Internet has > decreased.. I'm hoping it will! :) > And a 'service named start' > > It will pickup things, the caching-nameserver is only a config and some > zones for bind... Also be sure you are using the latest version of the perl module, thats also helping to lower traffic, less lookups. Bye, Raymond. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

RE: [SURBL-Discuss] DNS for dummies
by rleonard＠opto22.com 19 May '04

19 May '04

Thank you! I really appreciate your help. I'll check in a day or so to see if my traffic outbound to the Internet has decreased.. I'm hoping it will! :) -----Original Message----- From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] Sent: Wednesday, May 19, 2004 12:45 PM To: SURBL Discussion list Subject: RE: [SURBL-Discuss] DNS for dummies Hi! > I think I got it.. I added.. > > chkconfig --level 2345 named on > and > I modified the resolv.conf to point to localhost first... > > I installed caching-nameserver.. > > Do I need to do anything else? Does bind automatically know about > 'caching-nameserver'? And a 'service named start' It will pickup things, the caching-nameserver is only a config and some zones for bind... Bye, Raymond. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

RE: [SURBL-Discuss] DNS for dummies
by rleonard＠opto22.com 19 May '04

19 May '04

I think I got it.. I added.. chkconfig --level 2345 named on and I modified the resolv.conf to point to localhost first... I installed caching-nameserver.. Do I need to do anything else? Does bind automatically know about 'caching-nameserver'? Thanks! -----Original Message----- From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] Sent: Wednesday, May 19, 2004 10:29 AM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] DNS for dummies Hi! > Hi all.. I'm a wanna be Linux guy who somehow, even with my own ineptitude, > managed to get SA 2.63 with Qmail up and running on Redhat 9.0! Recently I > got the SURBL's working and they have helped a LOT (I have a very weak box > that is running SA.. so the lookups saved a lot of processing time!).. > however.. What version of the URI are you using ? > I have noticed my outgoing traffic on our T1 has shot through the roof. I > currently have the Linux box using our ISP's DNS server for lookups.. I'm > guessing it would be much more efficient if I had the linux box do it, cache > it.. I've even read about having it transfer the SURBL zones directly so > that lookups remain local.. > > Has anybody written a "HOWTO DNS" for dummies.. that could help walk me > through setting this up on my Linux box? Ohw on your local box its simple: Install (via RPM) bind and caching-nameserver Start bind, and edit your /etc/resolve.conf to look on localhost first. Bye, Raymond. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

EarthLink phishing list?
by Rich Graves 19 May '04

19 May '04

I just saw this in a banner ad: http://www.earthlink.net/earthlinktoolbar/download/ I don't have Windows. If someone else who does can reverse engineer it, that might be useful. -- Rich Graves <rcgraves(a)brandeis.edu> UNet Systems Administrator

1 0

RE: [SURBL-Discuss] mbox parser
by Chris Santerre 19 May '04

19 May '04

>-----Original Message----- >From: Ted Deppner [mailto:tdeppner@surewest.net] >Sent: Tuesday, May 18, 2004 4:53 PM >To: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] mbox parser > > >On Tue, May 18, 2004 at 10:58:15AM -0400, Chris Santerre wrote: >> For what it is worth, I have abandoned all script >extractions of URLs. It is >> NOT reliable. The human eye is better, and almost as fast. >Simply look at >> the email source and search for every instance of HTTP. >Then, using your >> firing synapse and some of the jedi force powers, decide if >what you are >> looking at is a legit link. Then report it. :-) >> >> Then a team of squirrels on crack will take that submission >and run it >> through numerous test of validity. Then it will be listed. >> >> To go forwards, we had to go backwards. > >Ugh. You'll miss %xx encodings, Mime messages, and so forth. I scan using outlook (don't ask!). So everything is decoded. >No way you >can analyze 45,000 messages in any reasonable amount of time. Thanks to RBLs, and spammers realising they shouldn't send my company email or they get listed to bigevil, my spam numbers are going down. Also I've found that for every domain I add, there are 10 more spam with the same one that can be deleted straight off. So it goes pretty fast, when I get my lazy butt in gear to do it ;) > >We collect bounce messages and analyze those in aggregate. Very simple >and high volume stuff floats to the top. You are correct on that. I did have some great success with the scripts. Mining the domains and working by hand might be ok, but I like to see the whole email. So while time consuming, this is the best method for me to get close to zero FPs. Goes back to the old saying: "Faster, better, and cheaper. Pick only 2." --Chris

1 0

Re: ANNOUNCE: Mail::SpamAsssassin::SpamCopURI 0.16
by Jeff Chan 19 May '04

19 May '04

[moving announcement reply to discussion list] Subject: RE: ANNOUNCE: Mail::SpamAsssassin::SpamCopURI 0.16 Date: Mon, 17 May 2004 13:18:07 +0200 From: <Rikhardur.EGILSSON(a)oecd.org> To: <jeffc(a)surbl.org>, <announce(a)lists.surbl.org> Cc: <spamassassin-users(a)incubator.apache.org> For those of you who have to use a http_proxy, you should add this patch : --- lib/Mail/SpamAssassin/SpamCopURI.pm.orig 2004-05-17 13:13:18.541107920 +0200 +++ lib/Mail/SpamAssassin/SpamCopURI.pm 2004-05-17 13:13:34.878624240 +0200 @@ -45,6 +45,7 @@ # do this since we never want the content $ua->max_size(0); $ua->timeout($LWP_TIMEOUT); + $ua->env_proxy; dbg("redirect resolving: $url"); Or else, it won't work .. - Ríkharður -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: 15 May, 2004 11:54 AM To: SURBL Announce Cc: SpamAssassin Users Subject: ANNOUNCE: Mail::SpamAsssassin::SpamCopURI 0.16 Eric Kolve has released SpamCopURI version 0.16 which fixes the handling of the few URIs which use numeric IP addresses. http://sourceforge.net/projects/spamcopuri If you're using SpamCopURI, please upgrade to this new version.

1 0

RE: [SURBL-Discuss] mbox parser
by Chris Santerre 18 May '04

18 May '04

For what it is worth, I have abandoned all script extractions of URLs. It is NOT reliable. The human eye is better, and almost as fast. Simply look at the email source and search for every instance of HTTP. Then, using your firing synapse and some of the jedi force powers, decide if what you are looking at is a legit link. Then report it. :-) Then a team of squirrels on crack will take that submission and run it through numerous test of validity. Then it will be listed. To go forwards, we had to go backwards. --Chris >-----Original Message----- >From: David Coulson [mailto:david@davidcoulson.net] >Sent: Monday, May 17, 2004 8:08 PM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] mbox parser > > >I've got a decent mailbox containing a variety of spam e-mail. >Is there >a nice little Perl script out there which will spit out the URLs so I >can submit them to Bill's list? > >David > >-- >David Coulson email: >d(a)vidcoulson.com >Linux Developer / web: >http://davidcoulson.net/ >Network Engineer phone: >(216) 533-6967 > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

mbox parser
by David Coulson 18 May '04

18 May '04

I've got a decent mailbox containing a variety of spam e-mail. Is there a nice little Perl script out there which will spit out the URLs so I can submit them to Bill's list? David -- David Coulson email: d(a)vidcoulson.com Linux Developer / web: http://davidcoulson.net/ Network Engineer phone: (216) 533-6967

5 4

Re: finding RegEx for extracting URIs
by Jeff Chan 18 May '04

18 May '04

Hello Rob, I'm forwarding your message to the SURBL discussion and SpamAssassin developers lists. All, Rob is looking for regular expressions to extract URIs form message bodies. As we know this is a little more complex than it may appear at first, given MIME decoding, weird cases, deliberate obfuscation, etc. Jeff C. __ On Monday, May 17, 2004, 6:01:57 PM, Rob McEwen wrote: > Jeff: > Thanks for the resources you provided. At the least, these will give me a > rough roadmap. The reason that these won't do much more for me than this is > because I program using a different platform, different filtering software, > a different mail server, and in an entirely different programming language > (not perl or php). Some of this stuff does not translate very well and, > frankly, some of it looks like "greek" to me. > I program in Visual Basic.NET using the Microsoft .NET platform. Given that > I'm also decent at C# programming, I think I could have done better if these > examples were written in Java, for example. > Nevertheless, my original question... the search for a really good regular > expression for extracting URIs... is a VERY platform-independent issue. > Finding the best regular expression for this could assist a variety of > people using a variety of programming platforms and programming languages > who might also attempt to write software to work with SURBL. > Therefore, please consider posting this question on your website in the > hopes that someone will provide a solution. I wouldn't be surprised if > someone has already discovered the best Regular Expression for extracting > URIs. Also, I believe that posting the answer on your site will be very > helpful to others in my same predicament. > (Note that it is easy to find Regular Expressions which extract the full URL > where the URL is preceded by an "href". But this is obviously not enough. > I'd like to find one which takes into account the country codes for > determining whether two or three levels are needed and then only extracts > what SURBL actually needs. Also, I fully admit that I'd have this one solved > if Regular Expressions were my specialty. They are not!) > Thanks for your consideration. Feel free to quote some or all of this e-mail > at will. > Rob McEwen > PowerView Systems > rob(a)PowerViewSystems.com > (478) 475-9032 > -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Monday, May 17, 2004 5:45 PM > To: Rob McEwen > Cc: jeffc(a)surbl.org; webmaster(a)PowerViewSystems.com > Subject: Re: finding RegEx for extracting URIs > On Monday, May 17, 2004, 5:22:50 AM, Rob McEwen wrote: >> I'm trying to find a good regular expression for extracting URIs from the >> raw text of an e-mail message. This would help tremendously for > programming >> a SURBL based filter. Do you know of any such regular expression? The ones >> I've found on the internet so far are not very good, for numerous reasons. > Hi Rob, > I think your best best would be to copy the code from urirhsbl in > SpamAssassin URIDNSBL or SpamCopURI's code: > http://spamassassin.org/full/3.0.x/dist/lib/Mail/SpamAssassin/Plugin/URIDNSB > L.pm > http://sourceforge.net/projects/spamcopuri/ > Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss May 2004