getin.to
file.to
surf.to
all reported spams the past few days.
>-----Original Message-----
>From: Steven Champeon [mailto:schampeo@hesketh.com]
>Sent: Thursday, August 26, 2004 4:47 PM
>To: SURBL Discussion list (E-mail)
>Subject: Re: [SURBL-Discuss] another new TLD?
>
>
>on Thu, Aug 26, 2004 at 04:39:21PM -0400, Chris Santerre wrote:
>> File.to
>>
>> from
>> http://File.to/ooo
>>
>> OK to add as well? Looks like spammers are …
[View More]trying to get
>around the standard
>> com, net, info , biz.
>
>Not new at all. That's Togo, who sold rights to their NIC and which TLD
>we often saw in redirection services (e.g., 'http://surf.to')
>back in the
>mid-nineties.
>
>Didn't someone post a complete list of TLDs here just recently?
>
>--
>hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w:
http://hesketh.com
Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e"
today!
http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/
_______________________________________________
Discuss mailing list
Discuss(a)lists.surbl.org
http://lists.surbl.org/mailman/listinfo/discuss
[View Less]
All,
My company has the policy of not throwing away default build from the OS install.
Therefore, all my perl libs have been compiled under /usr/local/blah/blah without doing UNINST=1.
After downloading all the necessary modules, etc, I am close to getting Spamcop URI compile.
Details: Perl 5.005_03, SpamAssassin 2.63.
perl ./Makefile.PL went through fine.
Problem w/ it is extract_url.t test script.
PERL5LIB="/usr/local/spamassassin/2.63/lib:
/usr/local/perl5lib/HTML/Parser/3.…
[View More]26/lib:
/usr/local/perl5lib/File/Spec/0.82/lib:/usr/local/perl5lib/URI/1.31/lib
/usr/local/perl5lib/Test/Simple/0.47/lib
/usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker
/usr/local/perl5lib/podlators/1.27/lib
/usr/local/perl5lib/Pod/Parser/1.28/lib
/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib
/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin
/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22"
Export PERL5LIB
The reason why I called the test script directly is because "make test" put my PERL5LIB directories as a less preferred lib and thus loaded older version of other libs that failed. I needed to circumvent by calling the test script directly.
All the test scripts passed, except extract_urls.t.
I defined "/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib" as part of PERL5LIB, since I know that SpamCopURI.pm is located at /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin/SpamCopURI.pm. Perl -V confirms that everything is defined properly.
From the error message, could it be my perl version is too old ? Please note that all other test scripts went through just fine.
bash-2.02# perl ./t/extract_urls.t
1..23
Undefined subroutine &Mail::SpamAssassin::SpamCopURI::_extract_urls called at ./t/extract_urls.t line 46.
# Looks like your test died before it could output anything.
Any input will be appreciated.
#Perl -V (output). I verify that all the dir for my PERL5LIB existed just fine.
Characteristics of this binary (from libperl):
Built under bsdos
Compiled at Oct 8 2000 21:58:54
%ENV:
PERL5LIB="/usr/local/spamassassin/current/lib:/usr/local/perl5lib/HTML/Parser/current/lib:/usr/local/perl5lib/File/Spec/current/lib:/usr/local/perl5lib/URI/current/lib:/usr/local/perl5lib/Test/Simple/current/lib:/usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker:/usr/local/perl5lib/podlators/current/lib:/usr/local/perl5lib/Pod/Parser/current/lib:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22"
@INC:
/usr/local/spamassassin/current/lib
/usr/local/perl5lib/HTML/Parser/current/lib
/usr/local/perl5lib/File/Spec/current/lib
/usr/local/perl5lib/URI/current/lib
/usr/local/perl5lib/Test/Simple/current/lib
/usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker
/usr/local/perl5lib/podlators/current/lib
/usr/local/perl5lib/Pod/Parser/current/lib
/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib
/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin
/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22
/usr/libdata/perl5/5.00503/i386-bsdos
/usr/libdata/perl5/5.00503
/usr/libdata/perl5/site_perl/i386-bsdos
/usr/libdata/perl5/site_perl
/usr/libdata/perl5/site_perl/i386-bsdos/include
.
Thanks,
------------------------
Rob Robin
Network Analyst
Green Apple, Inc.
740-653-9890
rrobin(a)greenapple.com
www.greenapple.com
Internet access, hosting and development solutions since 1995.
[View Less]
Older Steve submission. Yup same file. And I can see why these guys would
have been added. Looks like spammers were using a spacer.gif image from them
in theis spams. Hence lots of NANAS hits. This was before we looked for
posion like this.
Removed.
--Chris
>-----Original Message-----
>From: Jeff Chan [mailto:jeffc@surbl.org]
>Sent: Wednesday, August 18, 2004 9:52 PM
>To: SURBL Discussion list
>Subject: Re: [SURBL-Discuss] Strange happenings...
>
>
>On Wednesday, …
[View More]August 18, 2004, 6:17:26 PM, Bill Landry wrote:
>
>> Replying to my own post. I see now that the URI above gets
>redirected to:
>
>>
>http://qspace.iplace.MUNGEDcom/cobrands/41/?sc=1452NLCRamp;&CM=
MHHNewsletterServices&CE=TextArea3
>
>> and "iplace.com" is listed in WS. So my next questions is, should
>> "iplace.com" be listed in WS?
>
>Probably not. Anyone know if these guys are spammers or why it's
>on WS?
>
>Name: icreditreport.com
>Address: 205.180.159.210
>Aliases: qspace.iplace.com
>
>If this appeared in a legitimate message, then we probably should
>whitelist. Was it in a ham?
>
>Comments?
>
>Jeff C.
>
>_______________________________________________
>Discuss mailing list
>Discuss(a)lists.surbl.org
>http://lists.surbl.org/mailman/listinfo/discuss
>
[View Less]
I've never seen this TLD???
www.sdlkjfdd.it.tt
Can I add to surbl?
Chris Santerre
System Admin and SARE Ninja
http://www.rulesemporium.comhttp://www.surbl.org
'It is not the strongest of the species that survives,
not the most intelligent, but the one most responsive to change.'
Charles Darwin
http://media.greenfieldonline.com/images/sample/greenrtop.jpghttp://media.greenfieldonline.com/images/sample/first600.jpg
"Free chances to win cash and prizes by filling surveys
------------------------------------------------------
$$$ (added 11/6/2000) Free Sweepstakes
GreenfieldOnline.com is a survey-based site that wants
your input on consumer products and services. Register
for free to fill out their surveys and you could win any
of their great cash and prize giveaways.
http://www.…
[View More]bonustree.com/freebies/greenfield.html
"
http://signup.greenfieldonline.com/welcome.asp?wm=3823
And after all that... I actually feel like they are legit. Go figure!
remove, no whitelist. (RNW - new term?)
+1 RNW
--Chris
>-----Original Message-----
>From: Jeff Chan [mailto:jeffc@surbl.org]
>Sent: Thursday, August 26, 2004 4:52 AM
>To: SURBL Discuss
>Subject: [SURBL-Discuss] WS FP greenfieldonline.com
>
>
>WS folks, please consider removing greenfieldonline.com
>
>Looks white hat.
>
>Jeff C.
>__
>
>From: Jeff Chan
>To: "Bill Landry"
>Date: Thursday, August 26, 2004, 1:07:10 AM
>Subject: WS FP?
>
>===8<==============Original message text===============
>On Thursday, August 26, 2004, 12:19:32 AM, Bill Landry wrote:
>> Jeff, I am sending this directly to you since the list will
>not deliver HTML
>> e-mail attachments. Anyway, here is another MSN newsletter
>with a redirect
>> to greenfieldonline.MUNGEDcom that is listed in WS. The
>actual link can be
>> found under "Hot Offers" near the top right side of the
>e-mail: "Win $2,500
>> cash for a vacation"
>
>> Thoughts on this one?
>
>> Bill
>
>Hi Bill,
>They look legitimate to me so I whitelisted greenfieldonline.com
>
>Do you mind if I forward this to the discussion list? It can
>be better to do these publically.
>
>Including the newsletter could be done as a text paste of the
>raw message, but in this case it's probably not necessary.
>
>Jeff C.
>--
>Jeff Chan
>mailto:jeffc@surbl.org
>http://www.surbl.org/
>
>_______________________________________________
>Discuss mailing list
>Discuss(a)lists.surbl.org
>http://lists.surbl.org/mailman/listinfo/discuss
>
[View Less]
WS folks, please consider removing greenfieldonline.com
Looks white hat.
Jeff C.
__
From: Jeff Chan
To: "Bill Landry"
Date: Thursday, August 26, 2004, 1:07:10 AM
Subject: WS FP?
===8<==============Original message text===============
On Thursday, August 26, 2004, 12:19:32 AM, Bill Landry wrote:
> Jeff, I am sending this directly to you since the list will not deliver HTML
> e-mail attachments. Anyway, here is another MSN newsletter with a redirect
> to greenfieldonline.…
[View More]MUNGEDcom that is listed in WS. The actual link can be
> found under "Hot Offers" near the top right side of the e-mail: "Win $2,500
> cash for a vacation"
> Thoughts on this one?
> Bill
Hi Bill,
They look legitimate to me so I whitelisted greenfieldonline.com
Do you mind if I forward this to the discussion list? It can
be better to do these publically.
Including the newsletter could be done as a text paste of the
raw message, but in this case it's probably not necessary.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
[View Less]
>-----Original Message-----
>From: Jeff Chan [mailto:jeffc@surbl.org]
>Sent: Wednesday, August 25, 2004 2:52 PM
>To: SURBL Discuss
>Subject: Re: [SURBL-Discuss] Need help classifying a domain,
>solis2.365media.com
>
>
>On Wednesday, August 25, 2004, 7:51:13 AM, Chris Santerre wrote:
>> Here is a link from a pure spam! No doubt in my mind it is
>spam. However I'm
>> not sure if the domain has legit purposes.
>
>> http://solis2.365media.com/…
[View More]galepublishing/AWDD/public/signin.asp
>
>365media.com was registered in 1998 and is in the U.S.
>Chances are that they would probably not have survived
>this long if they were a spam gang.
>
>To me a "pure spam" comes from a zombie and points to
>a site at a spam-friendly ISP in China, Korea or Brazil. 1/2 ;-)
>
After further investigation, I have to go run over the head of marketing
with my sports car. *sigh* it isn't a spam domain at all.
An ISP in asia is blocking our company as a spammer :) IT would be funnier
if a few of our vendors were not on that ISP :/
--Chris
[View Less]
>-----Original Message-----
>From: Jeff Chan [mailto:jeffc@surbl.org]
>Sent: Tuesday, August 24, 2004 9:40 PM
>To: SURBL Discuss
>Subject: Re: [SURBL-Discuss] Fw: Your August eNewsletter from U.S. Bank
>
>
>On Tuesday, August 24, 2004, 5:41:36 PM, Bill Landry wrote:
>> ----- Original Message -----
>> From: "Jeff Chan" <jeffc(a)surbl.org>
>> To: "Bill Landry" <billl(a)pointshare.com>
>> Sent: Tuesday, August 24, 2004 5:28 PM
>> …
[View More]Subject: Re: [SURBL-Discuss] Fw: Your August eNewsletter
>from U.S. Bank
>
>
>>> Hi Bill,
>>> Can you forward it to me dierctly?
>
>> Oh, an one other key component as part of my test, I didn't
>actually receive
>> the newsletter that I forwarded to you until after I logged
>onto my US Bank
>> online account and subscribed it on the official US Bank web site.
>
>OK That's pretty important. You actually opted in and got the
>newsletter with those references.
>
>Jeff C.
Yes, I officially go on record as saying usbank and usbank-email should both
be whitelisted.
--Chris
[View Less]