Discuss

discuss@lists.surbl.org

1862 discussions

Should bravemouser.com be blacklisted?
by ITReading ITReading 07 May '04

07 May '04

Hello all, I continue to receive messages with URIs to "bravemouser.com" in the past few weeks. Should this domain be added to one of the surbl lists? Most of the messages are TV Pay Per View spam. An example of one of the messages can be found here: http://www.aldridge-borden.com/bravemouser.txt -Charles Solomon

2 1

Fwd: URI's not recognized
by Jeff Chan 07 May '04

07 May '04

This is a forwarded message From: Menno van Bennekom <mvbengro(a)xs4all.nl> To: spamassassin-users(a)incubator.apache.org Date: Friday, May 7, 2004, 3:35:37 AM Subject: URI's not recognized ===8<==============Original message text=============== Hi, I have problems getting URI's recognized by SpamAssassin 2.63 (postfix/amavisd-new). At first redirects like this were not recognized: http://rd.yahoo.com*http://spammer.spam.biz So I removed ^ from the BIZ expression: uri BIZ_TLD /(?:https?:\/\/|mailto:)[^\/]+\.biz(?:\/|$)/i Still the following was not recognized: <a href=3Dhttp://away.goingabroadd.biz/aps/cms/> Because of the 3D (and other stuff spammers put there lately). Only by changing 'uri BIZ_TLD' to 'body BIZ_TLD' it gets recognized. But I use SpamCopURI and that also doesn't recognize URI's with things in front of http. And I can't tell SpamCopURI to use the 'body' check instead or uri.. How can I make the URI subroutine recognize these URI's? Would using SpamAssassin v3.0 help? Thanks Menno ===8<===========End of original message text===========

3 2

Make test problems in 0.15
by Brian Ipsen 07 May '04

07 May '04

Hi, When doing "make test" with 0.15 I get: t/blacklist........ok t/dnsrbl...........ok t/extract_urls.....ok t/mailto...........ok t/open_redirect....ok 5/6# Failed test (t/open_redirect.t at line 71) t/open_redirect....NOK 6# Looks like you failed 1 tests of 6. t/open_redirect....dubious Test returned status 1 (wstat 256, 0x100) DIED. FAILED test 6 Failed 1/6 tests, 83.33% okay t/spamcopuri.......ok t/whitelist........ok Failed Test Stat Wstat Total Fail Failed List of Failed ---------------------------------------------------------------------------- --- t/open_redirect.t 1 256 6 1 16.67% 6 Failed 1/7 test scripts, 85.71% okay. 1/42 subtests failed, 97.62% okay. Is a module missing - or need to be updated ?? /Brian

3 2

New Redirector?
by David Hooton 07 May '04

07 May '04

Hi All, Just found an AOL redirector being abused in one of our spamtraps.. The url is on www.aol.com/ams/clickThruRedirect.adp If you need an exact copy of it I can provide it. Not sure if its included in the SURBL/SpamCopURI redirector list yet or not is this published anywhere? Regards, David Hooton Senior Partner Platform Networks www.platformnetworks.net ======================================================================== Pain free spam & virus protection by: www.mailsecurity.net.au Forward undetected SPAM to: spam(a)mailsecurity.net.au ========================================================================

3 4

ANNOUNCE: Mail::SpamAsssassin::SpamCopURI 0.15
by Eric Kolve 07 May '04

07 May '04

I have just released SpamCopURI 0.15. I have fixed a few bugs that were reported and also added some url extraction so open_redirect resolution isn't need any longer for urls that redirect through google.com, msn.com, yahoo.com or any site that redirects based on a url being passed in the query or path portion. The install *should* be smoother. The Makefile.PL now attempts to detect where SpamAssassin was installed and place itself in that directory. See the Changes file for a complete list. https://sourceforge.net/projects/spamcopuri/ --eric

2 1

[SURBL-Discuss] Fwd: Re: svn commit: rev 10552 - in incubator/spamassassin/trunk: lib/Mail/SpamAssassin t t/data/spam
by Jeff Chan 07 May '04

07 May '04

Justin points out a feature that would be nice to back-port into SA 2.63.... From: Justin Mason To: spamassassin-users Date: Thursday, May 6, 2004, 9:50:17 PM Subject: svn commit: rev 10552 - in incubator/spamassassin/trunk: lib/Mail/SpamAssassin t t/data/spam Justin writes: > Author: jm > Date: Thu May 6 21:36:42 2004 > New Revision: 10552 > > Modified: > incubator/spamassassin/trunk/lib/Mail/SpamAssassin/Util.pm > incubator/spamassassin/trunk/t/data/spam/009 > incubator/spamassassin/trunk/t/uri.t > Log: > spam spotted in wild evading URIBL, so deal with several URI obfuscations: http://0x425c45de/, http://66.92.0x45.221/, http://1113343455/, http://slashdot.org@1113343456/ in get_uri_list Jeff C et al -- I'm not sure how the SpamAssassin 2.63 code deals with this, but I'd suspect it'd miss those URLs... I've just checked in a fix in 3.0.0, so it might be worth porting it over. - --j.

1 0

RE: Bug in Spamcop's surbl add-on module
by Chris Santerre 07 May '04

07 May '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, May 05, 2004 4:52 PM >To: SURBL Discuss >Cc: spamassassin-users(a)incubator.apache.org >Subject: Re: Bug in Spamcop's surbl add-on module > > >On Wednesday, May 5, 2004, 1:03:15 PM, Chris Santerre wrote: > >>>From: Jeff Chan [mailto:jeffc@surbl.org] >>>bigevil.domains:e.1asphost.com >>> >>>However we should be taking off the subdomain before it goes into >>>the SURBL form. I'll need to check with Chris on how we can >>>handle that. > >> It's not a bug, its a feature! Actually, no its a bug :) I >have been going >> thru cleaning these sort of things up. However I started at >the begining of >> the B.E. list. This is at rule 181, I haven't even got to >100 yet! This is >> left over from my alpha phase of B.E. I've had a lot more >coffee since then. > >Hi Chris, >Would you mind if I added a quick regex to remove and third or >higher level domains from .com, .biz, .net, .info, etc. from >domains before they go into be? It wouldn't be perfect but >it could help some. > >In other words trim down e.1asphost.com to 1asphost.com (etc) >in my own data munging? > >Jeff C. Jeff my friend, nothing would make me happier :) OK, maybe if you sent me some models bearing beer to ask me. That might be a little better. But baring that, sure :-) --Chris

5 7

Installation Problems of SpamCopURI on RH9
by Ilan Aisic 06 May '04

06 May '04

Hi, I just wanted to report that yesterday I've installed SpamCopURI 0.14 on RedHat 9 with SA 2.63. On first try, running "perl Makeifle.PL" did not work. Apparently, it wanted Mail/SpamAssassin to be on perl 5.8.0 but it was deployed on 5.6.1. After I created a symlink as follows (watch for line breaks): >>> lrwxrwxrwx 1 root root 13 May 5 20:00 /usr/lib/perl5/site_perl/5.8.0/Mail -> ../5.6.1/Mail <<< I proceeded installing SpamCopURI without a problem. I thought that other RH users may encounter the same problem. Regards, -- Ilan Aisic Pointer Software Systems, Ltd.

2 1

Got these errors
by Doc Schneider 06 May '04

06 May '04

I get usual log events sent to me and notice this one. There was just this one that I saw. May 6 01:33:21 newmail spamd[25105]: Failed to run WS_URI_RBL SpamAssassin test, skipping: ^I(Modification of non-creatable array value attempted, subscript -1 at /usr/local/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/SpamCopURI.pm line 179, <GEN15147> line 175. ) May 6 01:33:21 newmail spamd[25105]: Failed to run SPAMCOP_URI_RBL SpamAssassin test, skipping: ^I(Modification of non-creatable array value attempted, subscript -1 at /usr/local/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/SpamCopURI.pm line 179, <GEN15147> line 175. ) May 6 01:33:21 newmail spamd[25105]: Failed to run BE_URI_RBL SpamAssassin test, skipping: ^I(Modification of non-creatable array value attempted, subscript -1 at /usr/local/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/SpamCopURI.pm line 179, <GEN15147> line 175. ) -- -Doc --- MomNDoc Online Consultants http://www.maddoc.net/ momndoc(a)maddoc.net

2 2

form-type URIs correctly extracted?
by Jeff Chan 06 May '04

06 May '04

I've spotted a couple form-enclosed URIs lately, such as: <FORM action=3dhttp:// www =2e seo500 =2e com/submit2=2ephp=20 method=3dpost> (without the spaces in the URI) Wanted to sanity check that urirhsbl and SpamCopURI are both finding these correctly. Can anyone confirm? (Yeah I know I should just read the sources.... ;-) TIA, Jeff C.

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss