Discuss January 2006

discuss@lists.surbl.org

24 participants
14 discussions

RE: Google search as spam URI
by Dallas L. Engelken 04 Jan '06

04 Jan '06

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: Wednesday, January 04, 2006 3:56 AM > To: SpamAssassin Users; SURBL Discuss > Subject: Google search as spam URI > > This drug spam message body seems problematic, since the URI is > google, being used to search for the spammer's. Naturally the > actual spammer domain bluevallet.com is blacklisted. This > showed up Tue, 03 Jan 2006 14:45:48 +0100 > > __ Also FWIW, we auto-listed bluevallet.com on black.uribl.com at bluevallet.com Listed: 2006-01-03 06:38:02 CDT (-0500 UTC) What I'm wondering is "how", since this shouldn't be showing up in the dns query stream if people were not using the google redirector pattern.... D

2 1

RE: Google search as spam URI
by Chris Santerre 04 Jan '06

04 Jan '06

> -----Original Message----- > From: Dallas L. Engelken [mailto:dallase@nmgi.com] > Sent: Wednesday, January 04, 2006 9:30 AM > To: Jeff Chan; SpamAssassin Users; SURBL Discuss > Subject: RE: Google search as spam URI > > > adding a redirector_pattern will catch this. > > redirector_pattern > /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9 > \-\.]+)$/I > > > Thanks, > Dallas Should this be a standard redirect added to SA or should SARE add the a rule to 70_Specific.cf? Also I don't know how it got added to URIBL, as the only NANAS hits show them using this redir. --Chris

1 0

RE: Google search as spam URI
by Dallas L. Engelken 04 Jan '06

04 Jan '06

> -----Original Message----- > From: Dallas L. Engelken [mailto:dallase@nmgi.com] > Sent: Wednesday, January 04, 2006 8:30 AM > To: Jeff Chan; SpamAssassin Users; SURBL Discuss > Subject: RE: Google search as spam URI > > adding a redirector_pattern will catch this. > > redirector_pattern > /^https?:\/\/(?:www\.)?google\.com\/search\?q=site:([A-Za-z0-9 > \-\.]+)$/I > Notice the 'I' at the end should be 'i'. Damn outlook, I know what I want to say! D

1 0

Google search as spam URI
by Jeff Chan 04 Jan '06

04 Jan '06

This drug spam message body seems problematic, since the URI is google, being used to search for the spammer's. Naturally the actual spammer domain bluevallet.com is blacklisted. This showed up Tue, 03 Jan 2006 14:45:48 +0100 __ Proecia Xana Pail VALIM from $1.21 IAGRA from $3.33 IALIS from $3.75 eridia Abien Soa Levtra =20 http://www.google.com/search?q=3Dsite:bluevallet.com <http://www.google.com/search?q=3Dsite:bluevallet.com>=20 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"> <META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT face=3DArial size=3D3>Pro<IMG = src=3D"cid:000101c6106b$c54633bd$66c5a8c0@printingmachine">ecia</FONT></DIV> <DIV><FONT face=3DArial size=3D3>Xana<IMG = src=3D"cid:000201c6106b$c54633bd$66c5a8c0@printingmachine"></FONT></DIV> <DIV><FONT face=3DArial size=3D3>Pa<IMG = src=3D"cid:000201c6106b$c54633bd$66c5a8c0@printingmachine">il</FONT></DIV> <DIV><FONT face=3DArial size=3D3>VALI<IMG = src=3D"cid:000301c6106b$c54633bd$66c5a8c0@printingmachine">M <STRONG>from = $1.21</STRONG></FONT></DIV> <DIV><FONT face=3DArial size=3D3><IMG = src=3D"cid:000401c6106b$c54633bd$66c5a8c0@printingmachine">IAGRA <STRONG>from = $3.33</STRONG></FONT></DIV> <DIV><FONT face=3DArial size=3D3><IMG = src=3D"cid:000501c6106b$c54633bd$66c5a8c0@printingmachine">IALIS <STRONG>from = $3.75</STRONG></FONT></DIV> <DIV><FONT face=3DArial size=3D3><IMG = src=3D"cid:000601c6106b$c54633bd$66c5a8c0@printingmachine">eridia</FONT></DIV> <DIV><FONT face=3DArial size=3D3>A<IMG = src=3D"cid:000701c6106b$c54633bd$66c5a8c0@printingmachine">bien</FONT></DIV> <DIV><FONT face=3DArial size=3D3>So<IMG = src=3D"cid:000701c6106b$c54633bd$66c5a8c0@printingmachine">a</FONT></DIV> <DIV><FONT face=3DArial size=3D3>Lev<IMG = src=3D"cid:000801c6106b$c54633bd$66c5a8c0@printingmachine">tra</FONT></DIV> <DIV><FONT face=3DArial size=3D3></FONT> </DIV> <DIV><FONT face=3DArial size=3D3><A = href=3D"http://www.google.com/search?q=3Dsite:bluevallet.com"><FONT = face=3DArial = size=3D3>http://www.google.com/search?q=3Dsite:bluevallet.com</FONT></A><= /FONT></DIV></BODY></HTML> R0lGODdhDQAMAOMAAP///wUTCMDEwWJrZCQwJt/h4KGmooKJg0NORQAAAAAAAAAAAAAAAAAAAAAA AAAAACwAAAAADQAMAAAEMRBIMUggo8htiNFFp0kFMW4Hsg3HtoWb6c5SQNP27cq6xN6GF4/TQnlA KZoAEbgUJREAOw== R0lGODdhDgAZAOMAAP///wUCDkNBSqGgpN/f4CQhLIKAhmJgaMC/wgAAAAAAAAAAAAAAAAAAAAAA AAAAACwAAAAADgAZAAAESxDISau9OOvNu/9gKHLCcA3CFAhERRSBOhiVYcRSXFQFgQOxg0kyOABV AERKIkAcc5Jecvd8GowHWhX36kK/gIPACP4hAs4yhfyNAAA7 R0lGODdhDQAXAMIAAP///wANER8rLt/g4V9nar/Cw5+kpQAAACwAAAAADQAXAAADMgi63P4wykmr vRiGt1dvHxB6zKiEplhyq4Oyi+AM8kIUjUEwtDEAA4PgxyMIAgICUZEAADs= R0lGODdhDAAVAOMAAP///wgOEMHCwyYsLYOGh2RoaeDg4aKkpUVKSwAAAAAAAAAAAAAAAAAAAAAA AAAAACwAAAAADAAVAAAENhDISau9OOvNu5/CcA2CRFbhRBRVQUyGSAUGVRzTgaC7hJSVQS12IbyM F6IQg9BlDgNcRkaJAAA7 R0lGODdhBQANAIAAAP///w0KDywAAAAABQANAAACDIQfp2uJ6hqcr0pTAAA7 R0lGODdhDgANAMIAAP///xIJC6aioy8nKcPBwk1GSOHg4IiEhSwAAAAADgANAAADJwi63P4wShXE CIPYUFcoBnB8oRB4hBdSHnO2LBwD70zLt1zn8+4rCQA7 R0lGODdhCgAVAOMAAP///xMPD6alpTAtLcTDw2tpaeHh4YmHh05LSwAAAAAAAAAAAAAAAAAAAAAA AAAAACwAAAAACgAVAAAELRDISau9OOvNu/9AIAzBQFCBCBDmpEpC4RqTMbhVMNe39AIxV4tF8x1I iCIgAgA7 R0lGODdhCQAVAMIAAP///wQKA2JlYaCjoN/g3yMoIgAAAAAAACwAAAAACQAVAAADJQi63P4wykmr XWKsIRQpBPCFCgdkjaA6REAyaseYqAeK96mVcgIAOw== __ SpamAssassin 3.0.1 did not catch this one, though the sender IP was on the SpamCop BL (that was all it caught). Jeff C. -- Don't harm innocent bystanders.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss January 2006