Discuss

discuss@lists.surbl.org

1862 discussions

Re: Which rules are replaces by *.surbl.org?
by Jeff Chan 15 Jun '04

15 Jun '04

On Saturday, June 12, 2004, 4:10:30 PM, Matt Kettler wrote: > At 08:26 PM 6/12/04 +0200, Matthias Keller wrote: >>I just upgraded to 2.63 and installed the patch to use surbls >>But I'm now not quite sure which .cf-rules I may remove now....? >>sc.surbl.org -> replaces spamcop_top200.cf ? > No.. spamcop_top200 is NOT URI based, it's Received: headers.. > The normal spamcop DNSBL (RCVD_IN_BL_SPAMCOP_NET) overlaps with > spamcop_top200.cf not SURBL. >>ws.surbl.org -> replaces blacklist-uri.cf, right? > Yes. >> -- but also blacklist.cf ? > No. surbl ONLY does uri's.. WS's blacklist.cf is a sender-domain blacklist. >>be.surbl.org -> that one I'm sure, it replaces bigevil (and midevil) ..... > Somewhat, although be.surbl.org is going away and even right now it doesn't > (and cannot) contain all of bigevil. Thanks for a good response Matt! You hit all the points excellently. Key is that SURBLs contain message body URI domains. This is a very different approach from most RBLs which as you note list sender domains or sending IP addresses. SURBLs don't go after the sources of the messages, they go after the URIs in the message bodies. More information about the lists can be found at: http://www.surbl.org/lists.html > Eventualy JC, WS, And CS are going to get together and merge all the > static-text stuff in bigevil over to WS's stuff, and bigevil will focus > only on wide-range regex stuff, at which point it can't be surbl hosted and > must be a .cf file. (DNS can't do regexes, just exact text match) The enumerable domains in be.surbl.org are now being merged into ws.surbl.org, so be.surbl.org is just about ready to go away, with the heavily-wildcarded, widely-varying domains ending up exclusively in BigEvil.cf. In other words the domains from BigEvil and MidEvil that can be listed without many wildcards go into ws.surbl.org and the domains that need more wildcards (too many to be practically enumerated) will end up in BigEvil.cf . Chris may not be ready to do the latter yet, but the former is already in place as of a few days ago. We're watching it all run for a while before announcing officially. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

3 3

{Spam?} Another redirection site: www.clubiran.com
by Jeff Chan 14 Jun '04

14 Jun '04

Here's another open redirection site to handle: http://www.clubiran.com/url/click.php?url=http://www.loan-america.com/index… I've whitelisted it in SURBLs. Anything special that happens in URI parsing code or the programs that call it may want to take this one into account. I've also written the owners of the redirection site. Jeff C.

1 0

ob.surbl.org ?
by ian sison (mailing list) 11 Jun '04

11 Jun '04

In the latest rsync of the dns zones i got the file ob.surbl.org.bind as well. it's a biggie, at 3884780 bytes. Anyone know the source of this data? - Ian

3 4

[SURBL-Discuss] Re: URI with one slash not recognised by SA/SPAMCOP_URI?
by John Fawcett 10 Jun '04

10 Jun '04

From: "Menno van Bennekom" > Hi, > > I get spam with a different URL, the redirect has only one '/': > <a > href="http://rd.yahoo.com/oashoscy/*http:/hjktccbz.woodwheel.info/mn/num17"> > > > This is not recognised by BIZ_TLD (in this example my copy, INFO_TLD). > I can change that in the regular expression. > But I don't think SPAMCOP_URI_RBL recognizes it too because woodwheel is > in the database but SA gives no hit. > If you click on the link above it works, so it seems the one slash is > possible. > Can anyone confirm that one slash is not recognized? This should work with SpamCopURI. What version are you using? Have you got entry like spamcop_uri_resolve_open_redirects 1 open_redirect_list_spamcop_uri rd.yahoo.com *.rd.yahoo.com in spamcop_uri.cf? John

4 6

Discounting invalid TLD's in uri_to_domain
by Yusuf Goolamabbas 09 Jun '04

09 Jun '04

I've filed bug 3467 in SA's bugzilla http://bugzilla.spamassassin.org/show_bug.cgi?id=3467 suggesting that uri_to_domain discount URI's which don't end in valid TLD's. There are test cases in which SA's get_uri_list can pick up URI of the form http://random.gif/ which will return random.gif as the domain and get fed into the pool of candidate domains to check for. I don't know that SpamCopURI's behaviour is with the testcases I've filed Regards, Yusuf

2 1

RE: SURBL works well on envelope sender
by Chris Santerre 08 Jun '04

08 Jun '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Monday, June 07, 2004 10:22 PM >To: spamassassin-dev(a)incubator.apache.org >Cc: discuss(a)lists.surbl.org >Subject: SURBL works well on envelope sender > *snip* > >How's the multi roll-out going? It would definitely be handy for this >test (the code to support it already exists). The simple answer is, "Its begining to look a lot like christmas." :) We are finally making some good headway. Bill has a nice system up. More _trusted_ people able to make submissions. A little more testing needed, and some scripts added. BigEvil.cf will be retiring from its current form soon, and be changing over to being created off of WS. I can't tell you how happy that makes me!! (And how much time it saves me!) Possibility of another SURBL taking the place of BE. 6dos.surbl.org? Still in discussion. Those stats should go thru the roof when we change over. --Chris (The tired one.)

1 0

IP addresses in SURBL?
by Chris Santerre 08 Jun '04

08 Jun '04

I forgot, DO I add these into the SURBL, or do I keep IPs out for now and add to my BigEvil dynamic version? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 3

Huh? Anyone know chinease?
by Chris Santerre 08 Jun '04

08 Jun '04

Huh??? I have no clue if this is a legit, spam, or shammer site! www.631.cn Anyone? --Chris >-----Original Message----- >From: SURBL+ Checker [mailto:surbl@rulesemporium.com] >Sent: Tuesday, June 08, 2004 4:37 AM >To: csanterre(a)MerchantsOverseas.com >Subject: SURBL+ Checker Submission > > >Date: Tue Jun 8 03:37:17 2004 >Reporter: Alex <alex(a)munged.de> >Reporter IP: 146.140.8.121 > >Applicable List: URIBL:be.surbl.org >Reported URI/IP: www.631.cn > >Email Source: >---------------------------------------- > >From dsfahgfsdjg(a)sina.com Tue Jun 8 05:11:32 2004 >Return-Path: <dsfahgfsdjg(a)sina.com> >X-Original-To: ciphelp@localhost >Delivered-To: ciphelp(a)localhost.igd.fhg.de >Received: from localhost (localhost [127.0.0.1]) > by electra.igd.fhg.de (Postfix) with ESMTP id 43EC4284F > for <ciphelp@localhost>; Tue, 8 Jun 2004 05:11:32 +0200 (CEST) >Delivered-To: fsf(a)zeitform.de >Received: from mail.zeitform.de [146.140.212.117] > by localhost with POP3 (fetchmail-6.2.0) > for ciphelp@localhost (single-drop); Tue, 08 Jun 2004 >05:11:32 +0200 (CEST) >Received: (qmail 18309 invoked by uid 906); 8 Jun 2004 03:09:03 -0000 >Received: from dsfahgfsdjg(a)sina.com by guildenstern by uid 89 >with qmail-scanner-1.22 > (clamdscan: 0.72. spamassassin: 2.63. >Clear:RC:0(219.137.195.16):SA:1(7.6/5.0):. > Processed in 1.51324 secs); 08 Jun 2004 03:09:03 -0000 >X-Spam-SavedStatus: Yes, hits=7.6 required=5.0 >X-Spam-SavedLevel: ******* >Received: from unknown (HELO sina.com) (219.137.195.16) > by guildenstern.zeitform.de with SMTP; 8 Jun 2004 03:09:01 -0000 >From: dsfahgfsdjg(a)sina.com >Subject: Chinese handicraft >To: fsf(a)zeitform.de >Content-Type: text/html;charset="GB2312" >Date: Tue, 8 Jun 2004 11:08:57 +0800 >X-Priority: 4 >X-Mailer: Foxmail 4.1 [cn] >X-Qmail-Scanner-1.22: added fake MIME-Version header >MIME-Version: 1.0 >X-Qmail-Scanner-Message-ID: <108666414267218299@guildenstern> >Message-Id: <20040608031132.43EC4284F(a)electra.igd.fhg.de> >X-Spam-Contact: Please contact alex(a)zeitform.de if anything looks wrong >X-Spam-Flag: YES >X-Spam-Checker-Version: SpamAssassin >2.63-zeitform_1.11_electra (2004-01-11) > on electra.igd.fhg.de >X-Spam-Level: ********************* >X-Spam-Status: Yes, hits=21.6 required=8.0 tests=BAYES_99,DCC_CHECK, > DEAR_SOMETHING,DNS_FROM_RFCI_DSN,FRONTPAGE,HTML_70_80, > HTML_CHARSET_FARAWAY,HTML_FONTCOLOR_BLUE,HTML_IMAGE_AREA_05, > HTML_MESSAGE,MIME_CHARSET_FARAWAY,MIME_HTML_ONLY,NO_REAL_NAME, > RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_RFCI autolearn=no > version=2.63-zeitform_1.11_electra >X-Spam-Report: > * 0.2 NO_REAL_NAME From: does not include a real name > * 2.3 DEAR_SOMETHING BODY: Contains 'Dear (something)' > * 0.1 HTML_FONTCOLOR_BLUE BODY: HTML font color is blue > * 0.1 HTML_MESSAGE BODY: HTML included in message > * 2.2 HTML_IMAGE_AREA_05 BODY: HTML has 5-6 kilopixels >of images > * 1.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives >confidence between 51 and 100 > * [cf: 100] > * 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML > * 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100% > * [score: 1.0000] > * 0.3 MIME_HTML_ONLY BODY: Message only has text/html >MIME parts > * 2.5 FRONTPAGE BODY: Frontpage used to create the message > * 1.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) > * 2.9 DCC_CHECK Listed in DCC >(http://rhyolite.com/anti-spam/dcc/) > * 0.3 DNS_FROM_RFCI_DSN RBL: From: sender listed in >dsn.rfc-ignorant.org > * 0.1 RCVD_IN_RFCI RBL: Sent via a relay in >ipwhois.rfc-ignorant.org > * [$ has inaccurate or missing WHOIS data at the] > [RIR] > * 0.5 HTML_CHARSET_FARAWAY A foreign language charset >used in HTML markup > * 2.5 MIME_CHARSET_FARAWAY MIME character set >indicates foreign language >Status: RO >Content-Length: 6551 >Lines: 93 > ><html> > ><head> ><meta http-equiv="Content-Type" content="text/html; charset=gb2312"> ><meta name="GENERATOR" content="Microsoft FrontPage 4.0"> ><meta name="ProgId" content="FrontPage.Editor.Document"> ><title>Ýþ²Ý</title> ></head> > ><body> > ><table border="0" width="100%" height="84" cellspacing="0" >cellpadding="0"> > <tr> > <td width="100%" height="46"> > <p style="line-height: 100%"> <font color="#0000FF" >size="3" face="Comic Sans MS">Dear > Sirs,</font><p style="line-height: 100%"><font >color="#0000FF" size="3" face="Comic Sans MS">We > are a big manufacturer and exporter for the straw hat in >Guangdong China > and export to European market for years' >experiences. </font><p style="line-height: 100%"><font >color="#0000FF" size="3" face="Comic Sans MS">Nowadays, We > own eight franchised stores and many alliance stores. We >export all kinds > of straw hat to many countries and get high reputation >for our top > quality, reasonable price, quick delivery, punctuate and >cordial service > among the customers. </font><p style="line-height: >100%"><font color="#0000FF" size="3" face="Comic Sans MS">For > more our company information and arranged items, pleased >go to our > Internet Nebsite:<a href="http://www.631.cn/cm/cm" >target="_blank">www.631.cn/cm/cm > </a> Hope you will show some interested in > our strong parts. </font><p style="line-height: >100%"><font color="#0000FF" size="3" face="Comic Sans MS">Sincerely > hope for you kind compare. We are eager to building up >business relation > with you in near future. </font><p >style="line-height: 100%"><font color="#0000FF" size="3" >face="Comic Sans MS">Looking > forward to your attention and early reply.</font><p >style="line-height: 100%"><font color="#0000FF" size="3" >face="Comic Sans MS">Best > Regards,</font><p style="line-height: 100%"><font >color="#0000FF" size="3" face="Comic Sans MS">Ms. > Greace (Sales)</font><p style="line-height: 100%"><font >color="#0000FF" size="3" face="Comic Sans >MS">E-mail:sh040601@yahoo.com.cn</font><p style="line-height: >100%"><font color="#0000FF" size="3" face="Comic Sans MS">Mobile > Phone:+86 20 13711547452/33501929</font><p >style="line-height: 100%"><font color="#0000ff" size="3" >face="Comic Sans MS">Fax:+86-20-87249995</font></td> > </tr> > <tr> > <td width="100%" height="26"><font color="#0000ff" >size="2">   </font></td> > </tr> ></table> ><table cellSpacing="8" cellPadding="8" width="56%" border="8" >height="1172"> > <tbody> > <tr> > <td width="33%" height="217"><a >href="http://www.631.cn/cmtp/101.htm" target="_blank"><img >src="http://www.631.cn/cm/101.gif" border="0" width="200" >height="200"></a></td> > <td width="35%" height="217"><a >href="http://www.631.cn/cmtp/102.htm" target="_blank"><img >src="http://www.631.cn/cm/102.gif" border="0" width="200" >height="200"></a></td> > <td width="36%" height="217"><a >href="http://www.631.cn/cmtp/103.htm" target="_blank"><img >src="http://www.631.cn/cm/103.gif" border="0" width="200" >height="200"></a></td> > </tr> > <tr> > <td width="33%" height="200"><a >href="http://www.631.cn/cmtp/105.htm" target="_blank"><img >src="http://www.631.cn/cm/105.gif" border="0" width="200" >height="200"></a></td> > <td width="35%" height="200"><a >href="http://www.631.cn/cmtp/112.htm" target="_blank"><img >src="http://www.631.cn/cm/112.gif" border="0" width="200" >height="200"></a></td> > <td width="36%" height="200"><a >href="http://www.631.cn/cmtp/113.htm" target="_blank"><img >src="http://www.631.cn/cm/113.gif" border="0" width="200" >height="200"></a></td> > </tr> > <tr> > <td width="33%" height="225"><a >href="http://www.631.cn/cmtp/108.htm" target="_blank"><img >src="http://www.631.cn/cm/108.gif" border="0" width="200" >height="200"></a></td> > <td width="35%" height="225"><a >href="http://www.631.cn/cmtp/109.htm" target="_blank"><img >src="http://www.631.cn/cm/109.gif" border="0" width="200" >height="200"></a></td> > <td width="36%" height="225"><a >href="http://www.631.cn/cmtp/107.htm" target="_blank"><img >src="http://www.631.cn/cm/107.gif" border="0" width="200" >height="200"></a></td> > </tr> > <tr> > <td width="33%" height="200"><a >href="http://www.631.cn/cm/110.htm" target="_blank"><img >src="http://www.631.cn/cm/110.gif" border="0" width="200" >height="200"></a></td> > <td width="35%" height="200"><a >href="http://www.631.cn/cmtp/117.htm" target="_blank"><img >src="http://www.631.cn/cm/117.gif" border="0" width="200" >height="200"></a></td> > <td width="36%" height="200"><a >href="http://www.631.cn/cmtp/120.htm" target="_blank"><img >border="0" src="http://www.631.cn/cm/120.gif" width="200" >height="200"></a></td> > </tr> > <tr> > <td width="33%" height="200"><a >href="http://www.631.cn/cmtp/118.htm" target="_blank"><img >src="http://www.631.cn/cm/118.gif" border="0" width="200" >height="200"></a></td> > <td width="35%" height="200"><a >href="http://www.631.cn/cmtp/111.htm" target="_blank"><img >src="http://www.631.cn/cm/111.gif" border="0" width="200" >height="200"></a></td> > <td width="36%" height="200"><a >href="http://www.631.cn/cmtp/106.htm" target="_blank"><img >src="http://www.631.cn/cm/106.gif" border="0" width="200" >height="200"></a></td> > </tr> > </tbody> ></table> ><table height="1" borderColorDark="#ffffff" width="704" >borderColorLight="#333333" border="1"> > <tbody> > <tr> > <td width="70" bgColor="#ffb051" height="1"><font >size="2">Adders:</font></td> > <td width="618" bgColor="#fff8a2" height="1"><font >size="2">Barbe Industrial Ltd.<br> > No.1521,7Floor, HengLong Tower Guangzhou<br> > Big Rd.Guangdong China.</font></td> > </tr> > <tr> > <td width="70" bgColor="#ffb051" height="1"><font >size="2">Packing:</font></td> > <td width="618" bgColor="#fff8a2" height="1"><font >size="2">Have two > >packing:400PCS/CTN,MEAS:80¡Á52¡Á70£»200PCS/CTN£¬MEAS:80¡Á21¡Á70 >¡£</font></td> > </tr> > <tr> > <td width="70" bgColor="#ffb051" height="1"><font >size="2">Description:</font></td> > <td width="618" bgColor="#fff8a2" height="1"><font size="2">The > hats are made of push, that is fine natural plant >(without any pollution), > surface innocuous coated; The push is very soft and >toughness, knitted by > a special technology method( about80 years history), >being able to stand > wear and tear.</font></td> > </tr> > </tbody> ></table> > ></body> > ></html> > > >---------------------------------------- > >

1 0

http://.virtual-pc.org
by Frank Ellermann 08 Jun '04

08 Jun '04

Hi, I've just seen http://.virtual-pc.org in a spam, and SC handled it as virtual-pc.org resp. www.virtual-pc.org SURBL got it, virtual-pc.org.sc.surbl.org is listed, can SA also handle this trick ? Bye, Frank

1 0

[SURBL-Discuss] Fwd: URI with one slash not recognised by SA/SPAMCOP_URI?
by Jeff Chan 07 Jun '04

07 Jun '04

This is a forwarded message From: Menno van Bennekom <mvbengro(a)xs4all.nl> To: spamassassin-users(a)incubator.apache.org Date: Monday, June 7, 2004, 5:00:50 AM Subject: URI with one slash not recognised by SA/SPAMCOP_URI? ===8<==============Original message text=============== Hi, I get spam with a different URL, the redirect has only one '/': <a href="http://rd.yahoo.com/oashoscy/*http:/hjktccbz.woodwheel.info/mn/num17"> This is not recognised by BIZ_TLD (in this example my copy, INFO_TLD). I can change that in the regular expression. But I don't think SPAMCOP_URI_RBL recognizes it too because woodwheel is in the database but SA gives no hit. If you click on the link above it works, so it seems the one slash is possible. Can anyone confirm that one slash is not recognized? Regards Menno van Bennekom ===8<===========End of original message text===========

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss