Discuss

discuss@lists.surbl.org

1 participants
1864 discussions

Re: Anti-SURBL technique ?
by Jeff Chan 28 May '04

28 May '04

On Friday, May 28, 2004, 3:48:15 AM, Rikhardur EGILSSON wrote: > From: jdow [mailto:jdow@earthlink.net] See: http://article.gmane.org/gmane.mail.spam.spamassassin.general/50187 >> If it hurts when you put your finger in the pencil sharpener and turn the >> crank don't do it. >> Simply cancel all redirects as spam. If someone legitimate is not courteous >> enough to send it "clear" then "scroom." > Good point, but how do I do that ? > If I understand the SURBL documentation corectly > "spamcop_uri_resolve_open_redirects" will only work on those domains > explicitly named in "open_redirect_list_spamcop_uri" not every spammer > throwaway domain.. We could probably put together a small paper on the subject of redirection sites. First thing to note is that there are different types. Some like the yahoo redirection site show the destination URI clearly contained within the original URI. Others like tinyurl or the spammer redirection site you found encode the destination site so that it's not plainly visible in the original URI. The latter have been called "opaque" and the former "open" redirections. Probably there are other names also, but you get the idea. urirhsbl in SA 3.0 will check all the domains visible in the URI against the SURBL it's called on (perhaps up to some limited number of URIs), including checking the redirection sites themselves. If the "redirect resolution" feature is enabled, SpamCopURI in SA 2.63 will attempt to resolve the Location header using the redirection server, but I'm not sure whether it can do so on an opaque redirection or not. All of the previous answers also apply. Reporting spams to SpamCop which have any visible black hat redirection sites will get them into sc.surbl.org unless we specifically whitelist them, which we would not do for purely spammer redirectors such as the one you found. In that way, even an opaque redirection site will get listed if it's a bad guy redirection site, as opposed to a mostly legitimate one like Yahoo's. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Some issues with get_uri_list
by Yusuf Goolamabbas 28 May '04

28 May '04

Hi, Since SURBL relies extensively on SA's get_uri_list/uri_to_domain I thought it might be appropiate to discuss possible FP's/FN's on this list so as to alert other members to bugs/spammer tricks etc and also be able to provide reduced testcases/fixes to SA developers upstream. One example I've recently filed in SA's bugzilla is http://bugzilla.spamassassin.org/show_bug.cgi?id=3427 Regards, Yusuf

1 0

RE: [SURBL-Discuss] Problems installing SPAMCOP_URI - Make test e rror
by Martin Lyberg 28 May '04

28 May '04

Hi Eric, That is correct, if this is the message you mean? perl Makefile.PL # SAPATH /usr/lib/perl5/site_perl/5.8.0 # installsitelib /usr/lib/perl5/site_perl/5.8.0 # INSTALLDIRS site Warning: prerequisite URI 1.28 not found. We have 1.21. Writing Makefile for Mail::SpamAssassin::SpamCopURI Which URI package do i need to download through CPAN in this case? Thanks in advance / Martin -----Original Message----- From: Eric Kolve To: SURBL Discussion list Sent: 5/27/2004 6:34 PM Subject: Re: [SURBL-Discuss] Problems installing SPAMCOP_URI - Make test e rror You need the URI package from CPAN. You should have received a warning when you attempted to install (if not let me know). --eric On Thu, May 27, 2004 at 02:52:28PM +0200, Martin Lyberg wrote: > Hi! > > I solved the problem by this thread: > > http://lists.surbl.org/pipermail/discuss/2004-May/000522.html > > But now i can't get through 'make test'. This gives me the following: > > make test > > ---snip--- > > Failed 9/9 tests, 0.00% okay > t/whitelist........Can't locate URI/QueryParam.pm in @INC (@INC contains: > /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib > /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/arch > /usr/lib/perl5/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.0 > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.0 > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl > /usr/lib/perl5/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 . > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 .) at > /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib/Mail/SpamAssassin/SpamC opUR > I.pm line 5. > BEGIN failed--compilation aborted at > /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib/Mail/SpamAssassin/SpamC opUR > I.pm line 5. > Compilation failed in require at t/whitelist.t line 6. > BEGIN failed--compilation aborted at t/whitelist.t line 6. > # Looks like your test died before it could output anything. > t/whitelist........dubious > > Test returned status 2 (wstat 512, 0x200) > DIED. FAILED tests 1-6 > Failed 6/6 tests, 0.00% okay > Failed Test Stat Wstat Total Fail Failed List of Failed > ------------------------------------------------------------------------ ---- > --- > t/blacklist.t 2 512 4 4 100.00% 1-4 > t/dnsrbl.t 2 512 6 6 100.00% 1-6 > t/extract_urls.t 2 512 15 15 100.00% 1-15 > t/mailto.t 2 512 1 1 100.00% 1 > t/open_redirect.t 2 512 5 5 100.00% 1-5 > t/spamcopuri.t 2 512 9 9 100.00% 1-9 > t/whitelist.t 2 512 6 6 100.00% 1-6 > Failed 7/7 test scripts, 0.00% okay. 46/46 subtests failed, 0.00% okay. > make: *** [test_dynamic] Error 2 > > Any solution to this problem? Just before i did upgrade Net::DNS through > CPAN. > > Thank you. > > / Martin > > > > : -----Ursprungligt meddelande----- > : Från: Eric Kolve [mailto:ekolve@comcast.net] > : Skickat: den 27 maj 2004 14:11 > : Till: SURBL Discussion list > : Ämne: Re: [SURBL-Discuss] Problems installing SPAMCOP_URI > : > : > : On Thu, May 27, 2004 at 01:44:02PM +0200, Martin Lyberg wrote: > : > : Hi > : > : > : > : I've been reading alot about SURBL in SA-mailinglist, now > : > : i've decided to give it a try. But im having trouble > : > : installing SpamcopUri. > : > : > : > : I have the following system: RH9, Postfix, SA 2.63 > : > : > : > : I get the following: > : > : > : > : Perl Makefile.pl > : > : > : > : Can't locate Mail/SpamAssassin.pm in @INC (@INC contains: > : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi > : > : /usr/lib/perl5/5.8.0 > : > : /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > : > : /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl > : > : /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > : > : /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl > : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi > : > : /usr/lib/perl5/5.8.0 .) at Makefile.PL line 3. BEGIN > : > : failed--compilation aborted at Makefile.PL line 3. > : > : > : > : What is wrong here? > : > : It looks like 'Perl' (was that really what was executed) > : couldn't find Mail::SpamAssassin. Do you know where it's > : installed? This appears to be an issue with the @INC. > : > : > : --eric > : > : > : > > : > Does anyone know a solution to this problem? Is there any easy > : > solution? > : > > : > Thanks in advance > : > > : > / Martin > : > _______________________________________________ > : > Discuss mailing list > : > Discuss(a)lists.surbl.org > : > http://lists.surbl.org/mailman/listinfo/discuss > : _______________________________________________ > : Discuss mailing list > : Discuss(a)lists.surbl.org > : http://lists.surbl.org/mailman/listinfo/discuss > : > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

Re: [SURBL-Discuss] Problems installing SPAMCOP_URI - Make test e rror
by Martin Lyberg 27 May '04

27 May '04

Hi! I solved the problem by this thread: http://lists.surbl.org/pipermail/discuss/2004-May/000522.html But now i can't get through 'make test'. This gives me the following: make test ---snip--- Failed 9/9 tests, 0.00% okay t/whitelist........Can't locate URI/QueryParam.pm in @INC (@INC contains: /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/arch /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 . /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 .) at /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib/Mail/SpamAssassin/SpamCopUR I.pm line 5. BEGIN failed--compilation aborted at /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib/Mail/SpamAssassin/SpamCopUR I.pm line 5. Compilation failed in require at t/whitelist.t line 6. BEGIN failed--compilation aborted at t/whitelist.t line 6. # Looks like your test died before it could output anything. t/whitelist........dubious Test returned status 2 (wstat 512, 0x200) DIED. FAILED tests 1-6 Failed 6/6 tests, 0.00% okay Failed Test Stat Wstat Total Fail Failed List of Failed ---------------------------------------------------------------------------- --- t/blacklist.t 2 512 4 4 100.00% 1-4 t/dnsrbl.t 2 512 6 6 100.00% 1-6 t/extract_urls.t 2 512 15 15 100.00% 1-15 t/mailto.t 2 512 1 1 100.00% 1 t/open_redirect.t 2 512 5 5 100.00% 1-5 t/spamcopuri.t 2 512 9 9 100.00% 1-9 t/whitelist.t 2 512 6 6 100.00% 1-6 Failed 7/7 test scripts, 0.00% okay. 46/46 subtests failed, 0.00% okay. make: *** [test_dynamic] Error 2 Any solution to this problem? Just before i did upgrade Net::DNS through CPAN. Thank you. / Martin : -----Ursprungligt meddelande----- : Från: Eric Kolve [mailto:ekolve@comcast.net] : Skickat: den 27 maj 2004 14:11 : Till: SURBL Discussion list : Ämne: Re: [SURBL-Discuss] Problems installing SPAMCOP_URI : : : On Thu, May 27, 2004 at 01:44:02PM +0200, Martin Lyberg wrote: : > : Hi : > : : > : I've been reading alot about SURBL in SA-mailinglist, now : > : i've decided to give it a try. But im having trouble : > : installing SpamcopUri. : > : : > : I have the following system: RH9, Postfix, SA 2.63 : > : : > : I get the following: : > : : > : Perl Makefile.pl : > : : > : Can't locate Mail/SpamAssassin.pm in @INC (@INC contains: : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/5.8.0 : > : /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl : > : /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/5.8.0 .) at Makefile.PL line 3. BEGIN : > : failed--compilation aborted at Makefile.PL line 3. : > : : > : What is wrong here? : : It looks like 'Perl' (was that really what was executed) : couldn't find Mail::SpamAssassin. Do you know where it's : installed? This appears to be an issue with the @INC. : : : --eric : : : > : > Does anyone know a solution to this problem? Is there any easy : > solution? : > : > Thanks in advance : > : > / Martin : > _______________________________________________ : > Discuss mailing list : > Discuss(a)lists.surbl.org : > http://lists.surbl.org/mailman/listinfo/discuss : _______________________________________________ : Discuss mailing list : Discuss(a)lists.surbl.org : http://lists.surbl.org/mailman/listinfo/discuss :

2 1

SV: [SURBL-Discuss] Problems installing SPAMCOP_URI
by Martin Lyberg 27 May '04

27 May '04

Hi Eric, : > : : > : Can't locate Mail/SpamAssassin.pm in @INC (@INC contains: : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/5.8.0 : > : /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl : > : /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/5.8.0 .) at Makefile.PL line 3. BEGIN : > : failed--compilation aborted at Makefile.PL line 3. : > : : > : What is wrong here? : : It looks like 'Perl' (was that really what was executed) : couldn't find Mail::SpamAssassin. Do you know where it's : installed? This appears to be an issue with the @INC. It's located here: /usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin.pm Seems like there's an issue with the Perlversion. Since im kinda new to linux and don't want to mess up the installation, i wonder if there's an easy solution to this without reinstalling either SA or Perl. Thank you! / Martin

1 0

Re: [SURBL-Discuss] Problems installing SPAMCOP_URI
by Martin Lyberg 27 May '04

27 May '04

: Hi : : I've been reading alot about SURBL in SA-mailinglist, now : i've decided to give it a try. But im having trouble : installing SpamcopUri. : : I have the following system: RH9, Postfix, SA 2.63 : : I get the following: : : Perl Makefile.pl : : Can't locate Mail/SpamAssassin.pm in @INC (@INC contains: : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : /usr/lib/perl5/5.8.0 : /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl : /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : /usr/lib/perl5/5.8.0 .) at Makefile.PL line 3. BEGIN : failed--compilation aborted at Makefile.PL line 3. : : What is wrong here? Does anyone know a solution to this problem? Is there any easy solution? Thanks in advance / Martin

2 1

Another to whitelist
by Chris Santerre 27 May '04

27 May '04

marketwatch.com Yeah I'm not sure people are even checking these before reporting to me. But this is used by a LOT of financial spam. Legit site. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

5 7

ANNOUNCE: Mail::SpamAssassin::SpamCopURI 0.17
by Eric Kolve 27 May '04

27 May '04

Just released SpamCopURI 0.17. This is basically a bugfix release. Upgrade if you see something you need: 0.17 Mon May 24 18:23:55 PDT 2004 - added code to handle hex encoded and base 10 encoded IP addresses - added backslash handling in urls (http:/\www.google.com) - handling case when host of a URL is a '.' - calling env_proxy on LWP::UserAgent to support proxied users (thanks to bluebanana ) http://sourceforge.net/projects/spamcopuri/ --eric

2 3

Another Hatcheck, 20m.com
by Chris Santerre 25 May '04

25 May '04

20m.com is a web hosting site. However I believe they host spammers without regard. I could be wrong. We need to decide wether they get whitelisted or not. There are numerous legit sites hosted by them....unfortunetly. Even going to their site produces a popup page. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

Orangestad spammer
by Chris Santerre 25 May '04

25 May '04

SARE has been working on a few rules to catch the Oranjestad spams. One of the ninjas has this list of domains. I'm hoping someone here finds it usefull. I would add to Bigevil, but I'm swamped! > > OK, you asked for it. 109 discrete spamvertised domains culled >from verified Aruba-spams. Yuck. > > ----- > >achieveyouthinweek.com >affordkinginventions.com >beautyattractsall.com >bebetterwithourstore.com >bestguaranteever.com >bestinventionever.com >bestofallitemsonline.com >bestservicesites.com >blowoutredsale.com >braveclassyshop.com >braveselectionnet.com >breakoldbadhabit.com >brightwaystobeauty.com >buyheredowell.com >catchclassyproduct.com >checkhereforhealth.com >cherrysaleall.com >creatingmassdemand.com >dealwithhealthhere.com >dedicatedtoimprove.com >delightfullproducts.com >desireablehealth.com >digitalnetachiever.com >divineredtagmall.com >doctorrecommendedproducts.com >dogoodwithus.com >eliteintendedservice.com >elitesinvitedtobuy.com >enormousbenefitshere.com >finallydiscoveryouth.com >findoutoursecrets.com >followthisexample.com >futureinyourhand.com >galaxyhealthproducts.com >getalphahealth.com >givingawaybestitems.com >glossyproducts.com >goldenthingshere.com >goldpromosol.com >greatinfoonlyonce.com >greatlooksachiever.com >greatqualityoption.com >greatvarietyproducts.com >guaranteedforeveryone.com >healthcenterservice.com >hereyouhaveitall.com >highclassinformers.com >hurryandbeyounger.com >improvedlifeatonce.com >incrediblemallhere.com >incrediblemalls.com >infoforbetterpeople.com >ingenioussol.com >inspireingitems.com >instantlybebetter.com >itemsincreasinghealth.com >jetsetthings.com >joinusforhealth.com >kingproviderstore.com >knowwhatisbest.com >livebettershophere.com >looknomoreforstores.com >looksprovidersnet.com >madetohelpyou.com >mallthathasbest.com >megagoldpromotion.com >naturehelpedmany.com >nofaluirewithus.com >nowherelesetofind.com >onlyworkingproducts.com >oppforall.com >oursecretsmakeimprovements.com >peoplewaitedforthis.com >powerbeautythings.com >producedtohelp.com >productblasthere.com >proofofbettersale.com >prospertherightway.com >prosperwithsale.com >qualityclassysolutions.com >restorehealthwithus.com >royalgalaxysale.com >royaltyproductconsume.com >salesroyalinfo.com >samrthealthproduct.com >satisfyallyourneeds.com >secretstoyourhome.com >seenonlyonce.com >simpleachieverlooks.com >simpleandgreat.com >simplecalssystuff.com >speedupimprovements.com >splendidsalepro.com >sportsline.com >stophereandbuy.com >supervaluableinfo.com >supremeyouthstore.com >testedandproved.com >thishelpedpeople.com >unforgettablesale.com >uniquenetplace.com >usechancetoprosper.com >useonlybestproducts.com >whatyouaskedhere.com >whatyouhavebeenwaitingfor.com >youfoundidealsolution.com >yourgoalachieved.com >yourvibrantproduct.com > > ----- > > Urp. If nothing else, it makes for good BE fodder. >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss