- Discuss - Mailman 3

FP: bankline.itau.com.br
by Alex Broens (Ninja Trainee) 01 Sep '04

01 Sep '04

Pls whitelist "bankline.itauMUNGED.com.br" Valid Bank Account Info was filtered out incorrectly. Assume Phising abuse, but..... http://www.itau.com.br/ (a genuine bank) Lots of NANAS entries..... If not willing to whitelist, pls let em know and I'll WL on my side Thanks Alex ----------------------------------------------------------- * 3.0 WS_URI_RBL URI's domain appears in ws database at ws.surbl.org * [banklineMUNGED.itauMUNGED.com.br is blacklisted in URI RBL] [at multi.surbl.org] ------------------------ Return-path: <itaumail(a)itau.com.br> Received: from servicos.itauMUNGED.com.br ([200.246.143.230]) by server.domain.tld (server.domain.tld) with ESMTP id 01-md50000009120.msg for <munged(a)munged.tld>; Wed, 01 Sep 2004 20:23:57 +0200 Received: from mail pickup service by servicos.itau.com.br with Microsoft SMTPSVC; Wed, 1 Sep 2004 15:23:34 -0300 From: <itaumail(a)itauMUNGED.com.br> To: <munged(a)munged.tld> Subject: [***SPAM***] Extrato ITAU 20891-0 AG 1170 Date: Wed, 1 Sep 2004 15:23:34 -0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_15E2_01C49037.A5579D00" X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4927.1200 Message-ID: <SIWT001CTOqqgNjWOiy0001af6b(a)servicos.itau.com.br> X-OriginalArrivalTime: 01 Sep 2004 18:23:34.0652 (UTC) FILETIME=[CABF13C0:01C49050] ------------------------- -> itau.com.br. type = A, class = 1, ttl = 86400, dlen = 4 IP address = 200.246.143.40 [ Informations about 200.246.143.40 ] IP range : 200.246.143.0 - 200.246.143.255 Infos : BANCO ITAU S.A. Infos : Av do Estado, 5533, 2A Infos : 03105-000 - Sao Paulo - SP Country : Brazil (BR) Abuse E-mail : abuse(a)embratel.net.br Source : BRNIC ------------------------

2 1

FP: banklineMUNGED-DOTitauMUNGED-DOTcomMUNGED-DOTbr
by Alex Broens (Ninja Trainee) 01 Sep '04

01 Sep '04

Seems the first try enver made it to the list...... Second try..... ---------------------------------------------------------------- Pls whitelist "bankline.itauMUNGED.com.br" Valid Bank Account Info was filtered out incorrectly. Assume Phising abuse, but..... http://www.itau.com.br/ (a genuine Brasilian bank) Lots of NANAS entries..... If not willing to whitelist, pls let me know and I'll WL on my side. Thanks Alex ----------------------------------------------------------- * 3.0 WS_URI_RBL URI's domain appears in ws database at ws.surbl.org * [banklineMUNGED.itauMUNGED.com.br is blacklisted in URI RBL] [at multi.surbl.org] ------------------------ Return-path: <itaumail(a)itau.com.br> Received: from servicos.itauMUNGED.com.br ([200.246.143.230]) by server.domain.tld (server.domain.tld) with ESMTP id 01-md50000009120.msg for <munged(a)munged.tld>; Wed, 01 Sep 2004 20:23:57 +0200 Received: from mail pickup service by servicos.itau.com.br with Microsoft SMTPSVC; Wed, 1 Sep 2004 15:23:34 -0300 From: <itaumail(a)itauMUNGED.com.br> To: <munged(a)munged.tld> Subject: [***SPAM***] Extrato ITAU 20891-0 AG 1170 Date: Wed, 1 Sep 2004 15:23:34 -0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_15E2_01C49037.A5579D00" X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4927.1200 Message-ID: <SIWT001CTOqqgNjWOiy0001af6b(a)servicos.itau.com.br> X-OriginalArrivalTime: 01 Sep 2004 18:23:34.0652 (UTC) FILETIME=[CABF13C0:01C49050] ------------------------- -> itau.comMUNGED-DOTbr. type = A, class = 1, ttl = 86400, dlen = 4 IP address = 200.246.143.40 [ Informations about 200.246.143.40 ] IP range : 200.246.143.0 - 200.246.143.255 Infos : BANCO ITAU S.A. Infos : Av do Estado, 5533, 2A Infos : 03105-000 - Sao Paulo - SP Country : Brazil (BR) Abuse E-mail : abuse(a)embratel.net.br Source : BRNIC ------------------------

1 0

Re: [SURBL-Discuss] Whitelist Please
by Rob McEwen 01 Sep '04

01 Sep '04

RE: funnygreetings.com Forgive me for my ignorance, but would someone please explain the rational for whitelisting funnygreetings.com in the first place. Unlike most here, I use a different program and I don't understand those spamassassin reports... moreover, are there really significant reasons to whitelist funnygreetings.com? Did someone's client complain about missing a message? I fear that this may be the quintessential situation that Jeff probably doesn't want to have to deal with... a hardcore spammer who does have a few legitimate services. It won't hurt my feelings if that list of domains gets removed from SURBL or even gets whitelisted, but I will definitely blacklist them locally on my server. Also, it would be nice to get a little more justification for their remove from SURBL... unless, of course, this is just a case of me not understanding that SpamAssassin report :) Rob McEwen

1 0

Re: [SURBL-Discuss] Whitelist Please
by Rob McEwen 01 Sep '04

01 Sep '04

> I've whitelisted: funnygreetings.com I second Raymond's concern. A ton of spam goes to my server with flowgo.com etc. See the following as well: http://www.spamhaus.org/sbl/sbl.lasso?query=SBL5535 Rob McEwen

2 1

RE: [SURBL-Discuss] Whitelist Please
by Chris Santerre 01 Sep '04

01 Sep '04

Good grief NO! http://www.dietingplans.com/images/TSAE001.jpg I would definitely NOT get into the habit of whitelisting other domains. One at a time! Especially ones like these!! --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, September 01, 2004 2:42 PM >To: SURBL-List >Subject: Re: [SURBL-Discuss] Whitelist Please > > >On Wednesday, September 1, 2004, 5:47:11 AM, Bitz Bitz wrote: >> http://www.funnygreetings.com > >> Listed at WS_URI_RBL > >> X-Spam-Status: No, hits=5.1 required=10.0 tests=RATWR10_MESSID=0.111, >> WS_URI_RBL=5 > >> Thanks, >> -b. > >I've whitelisted: funnygreetings.com > >It belongs to euniverse. I've added it to these other euniverse >domains: > >euniverse.com >flowgo.com >skilljam.com >cupidjunction.com >dietingplans.com >intelligentx.com >netlaughter.com >cutestuf.com >madblast.com >infobeat.com >gossipflash.com >funnygreetings.com > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

RE: [SURBL-Discuss] Whitelist Please
by Chris Santerre 01 Sep '04

01 Sep '04

Cupidjunction don't look too clean either! http://tinyurl.com/542yo One domain at a time. Not affiliate domains...please...pretty please with Doom3 on top! --Chris >-----Original Message----- >From: Rob McEwen [mailto:rob@powerviewsystems.com] >Sent: Wednesday, September 01, 2004 3:07 PM >To: SURBL Discussion list; Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] Whitelist Please > > >> I've whitelisted: funnygreetings.com > >I second Raymond's concern. A ton of spam goes to my server >with flowgo.com etc. > >See the following as well: > >http://www.spamhaus.org/sbl/sbl.lasso?query=SBL5535 > >Rob McEwen > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] To MUNGE to not to MUNGE
by Chris Santerre 01 Sep '04

01 Sep '04

>-----Original Message----- >From: SM [mailto:sm@resistor.net] >Sent: Wednesday, September 01, 2004 2:23 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] To MUNGE to not to MUNGE > > >Hi Rob, >At 10:04 01-09-2004, Rob wrote: >>Currently, I do whitelist this list, but... >> >>...and maybe I'm getting paranold here... >> >>What happens if spammers start adding SURBL tolkins to their >spam? (like >>"lists.surbl.org") Are there not situations here which could >defeat our >>whitelisting and force us back to munging anyway? > >No, unless the whitelisting is not implemented correctly. I suggested >whitelisting the server from which this email comes from and not the >return-path. > >Regards, >-sm whitelist desn't mean what it means for other lists. In SURBL it simply means if some nut puts it into SURBL, it won't matter. The WL will remove it. So it's just never added. There are LOTS of times we remove domain names but don't whitelist. Just in case they return to spamming. And removal of domains usually takes 2-3 "Major players" (LOL I like that. But I'm just a loud mouth, no bigger then the rest of the submitters, just heard from more often ;) Weee!) Not really a policy, we just like to be sure. More then once, one of us has thought something should be removed, only to find quite the opposite from other submitters. And MUNGED might as well go along with Top posting. Do what makes you feel good.....unless it might get you fired :) When I retype htings I automungew because ofp my phat fingers. --Chris

1 0

RE: [SURBL-Discuss] FP: SallyFoster-MUNGED.com
by Chris Santerre 01 Sep '04

01 Sep '04

>-----Original Message----- >From: Rob McEwen [mailto:rob@powerviewsystems.com] >Sent: Wednesday, September 01, 2004 8:41 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] FP: SallyFoster-MUNGED.com > > >FP: SallyFoster-MUNGED.com > >1. Zero NANAS hits >2. domain registered in 1997 >3. very popular fundraiser for school & other organizations (they sell >wrapping paper) > >As a matter of fact, I found this by actually attempting to >send a relative >an e-mail about my own child's school fundraiser. I'm >horrified. I don't >even audit my client's SURBL-blocked mail... perhaps I should now? > >I don't know if they do illegal harvesting or not. I'm >guessing not because >I'd think they would get some NANAS hits if they did. Many of >their e-mails >go out via a parent keying in their friends & family's e-mail >address on the >SallyFoster-MUNGED.com site. I could see how some of these friends or >relatives might not read the resulting message carefully and >automatically >report it as spam :) Therefore, I think that this domain should be >whitelisted, or it probably WILL get relisted for the wrong >reasons, as you >can see. > Agreed, they seem clean on my end as well. --Chris

2 1

Re: [SURBL-Discuss] To MUNGE to not to MUNGE
by Rob McEwen 01 Sep '04

01 Sep '04

>It doesn't work that way. The whitelist means we dont add THOSE domains to >the SURBLs, other domains listed in those mails will still trigger the >SURBL filtering. First, I'm referring to a person's LOCAL whitelisting of SURBL list messages so that these messages bypass all filtering in order to allow SURBL-blocked domains to not stop the SURBL list message. In this scenario, SURBL-filtering could possibly be totally bypassed if the message contained "lists.surbl.org", ... thus creating a loophole for spammers who might try to use this as a tactic for their spam to also bypass the filter. However, my question was probably a silly question to begin with because (as I realized when reading other's messages) the actual IP address of the surbl list server could also be factored into the local whitelisting so that such potentially shrewd tactics of spammers I mentioned above could be defeated. Follow? Rob McEwen

2 1

Re: [SURBL-Discuss] To MUNGE to not to MUNGE
by Rob McEwen 01 Sep '04

01 Sep '04

> Can you explain what you mean? Dont get it i am afraid. All the surbl > domains are whitelisted, but that was not your question i guess? I simply meant, what happens if a spammer tries to sneak various references to surbl in the e-mail (separate from their actual affiliate link, of course) as a means of trying to get whitelisted, thus defeating our whitelisting? ...but, as I said, maybe I'm too paranoid here :) > Sometimes it takes time to find out the how and the what, be happy we are > still responsive ;) Please also note, a whitelist request isnt a guarantee > that it will indeed be whitelisted... Sorry... I didn't mean to sound impatient. Chris weighed in agreeing that it probably should be whitelisted (see archive). I was thinking that when one of the "main players" (Jeff, Raymond, Chris, Joe, etc.) agrees without other disagreements... it was practically considered done. But, again, I don't mean to sound impatient... I just wanted to make sure that SallyFoster-MUNGED.com wasn't going to be missed. Thanks, Rob McEwen

2 1

RE: [SURBL-Discuss] To MUNGE to not to MUNGE
by Chris Santerre 01 Sep '04

01 Sep '04

>-----Original Message----- >From: Ryan Thompson [mailto:ryan@sasknow.com] >Sent: Wednesday, September 01, 2004 9:38 AM >To: SURBL Discussion list >Subject: [SURBL-Discuss] To MUNGE to not to MUNGE > > *snip* > >I see no reason to MUNGE domains posted to this list. Unless >someone has >some really compelling evidence to the contrary, could we please curb >this silly practice before it really becomes a silly collective habit? >:-) I agree --Chris_MUNGED_Santerre :p >

4 4

FP: SallyFoster-MUNGED.com
by Rob McEwen 01 Sep '04

01 Sep '04

FP: SallyFoster-MUNGED.com 1. Zero NANAS hits 2. domain registered in 1997 3. very popular fundraiser for school & other organizations (they sell wrapping paper) As a matter of fact, I found this by actually attempting to send a relative an e-mail about my own child's school fundraiser. I'm horrified. I don't even audit my client's SURBL-blocked mail... perhaps I should now? I don't know if they do illegal harvesting or not. I'm guessing not because I'd think they would get some NANAS hits if they did. Many of their e-mails go out via a parent keying in their friends & family's e-mail address on the SallyFoster-MUNGED.com site. I could see how some of these friends or relatives might not read the resulting message carefully and automatically report it as spam :) Therefore, I think that this domain should be whitelisted, or it probably WILL get relisted for the wrong reasons, as you can see. Rob McEwen

1 0

[SURBL-Discuss] IN the interest in a bigger SA score and fewer FPs.....
by Chris Santerre 31 Aug '04

31 Aug '04

I have removed a rather large group of domains from WS. Time and time again FPs came from this rather large set of data from July. Since we have improved our contributor methods and numbers, I decided to yank them. If they continue to spam, they would just be readded by us anyway. So you might see a slight decrease in file size. And a few more slipping thru we will have to add again. But this will reduce overall FPs. --Chris (Did you know you can get dominoes to deliver to a parking lot at 1 AM!)

3 2

FP
by Chris Santerre 31 Aug '04

31 Aug '04

This was on the bottom of a legit email to a co worker. _______________________________________________ AsianAvenue.com free e-mail - www.asianavenue.com. Click into Asian America. Check out our Special Introductory Offer - E-mail Forwarding for just $5.95 per year! Powered by Outblaze Whitelist asianavenue.com or is it a spam site. Going to it looks fishy. But it is from outblaze, which is VERY antispam I think. --Chris

2 1

RE: [SURBL-Discuss] RFC: Public false positve reporting form
by Chris Santerre 31 Aug '04

31 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, August 30, 2004 7:33 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] RFC: Public false positve reporting form > > >How does anyone feel about a public false positive reporting >form? Such a form would include the reporting party, the >domain(s) or IPs, reasons why it's a false positive, etc. > I think the public needs a way to report FP, to be listed, and greylist domains. However, only if more then one person can work on these. ;) >It could be processed publically or privately in a bug >tracking system. It would be hand checked by some of our >experienced spam fighters. The results could be published >or simply aggregated without public announcement into the >overall whitelist. > >Is this a good or bad idea? good >What level of publication should there be? Answers to none. They give, we take info. Too time consuming to answer all. > >What forms of proof (if any) does anyone like? spam with headers. The rest is up to us. > >Other comments? Who was the first nut ever to think up pole vaulting? "Hey Jim, see that there bush? I bet if I run fast enough with this here flagpole......." --Chris

2 1

FP on WS
by Bill Landry 31 Aug '04

31 Aug '04

Okay, here we go again... ;-) ===== Domain, proflowers.MUNGEDcom is listed on WS. ===== ===== Sending IP listed on two aggressive RBLs, otherwise looks clean: http://www.dnsstuff.com/tools/ip4r.ch?ip=198.31.62.30 ===== ===== Domain, proflowers.com, registered through Network Solutions and domain registered in early 1998: Record created on 04-Feb-1998 ===== ===== Address space owned by Level 3: [whois.arin.net] Level 3 Communications, Inc. LVLT-ORG-198-31 (NET-198-31-0-0-1) 198.31.0.0 - 198.31.255.255 Subnet delegated to: Double Click DOUBLECLICK7-62-28 (NET-198-31-62-0-1) 198.31.62.0 - 198.31.63.255 RegDate: 2003-03-28 ===== ===== No NANAS listings: References: [ Proflowers: 0 ] ===== Anything else needed for this one? :-\ Bill

5 7

Re: [SURBL-Discuss] FP on WS
by Rob McEwen 30 Aug '04

30 Aug '04

> Domain, proflowers.MUNGEDcom is listed on WS. Thanks Bill for your good work. I hope this gets removed fast. I've heard Jeff ask in the past, "hey, what caused this to get on in the first place?" ...well, even though I often lean towards the aggressive side of the arguments, it seems like FPs like this one really are getting on SURBL too often. Therefore, I hope that Jeff or someone can find and correct the source of these particularly egregious types of FPs soon. Rob McEwen

1 0

FP on OB list
by Bill Landry 30 Aug '04

30 Aug '04

Found the link below in a Ziff Davis "Baseline Magazine" renewal notification e-mail, and it was tagged by OB: omessage.MUNGEcom The URI was used in an unsubscribe link. Bill

5 13

SURBL WS test scores in SA 3.0
by Fred 29 Aug '04

29 Aug '04

Hello Group, This is my first post here, let me introduce myself. I've been very active in fighting spam for the past 3-4 years, I just recently became a submitter to the WS surbl list and I am hoping to start some action to help get a few things improved for all of us. I've created a number of rulesets for SARE (tripwire, OEM, Spoof) and released my own rules to the public, now I am focusing on SURBL_WS and doing what I can to improve all aspects of it. First off I am looking for people who use SpamAssassin and have access to a corpus of ham e-mail. The score for the WS SURBL test in 3.0 is very low, I am really focused on improving this and hope to get the score to 2 or 3 by the release of SA 3.1 I want to track down False Positives and get these whitelisted. The statistics-set1.txt file shows: The first number is % of e-mails hit (spam and ham), the next is % of spam, followed by % of ham. 51.999 78.4712 0.4756 URIBL_WS_SURBL With detection at 78.5% this rule is only outperformed by RAZOR2 and this shows our potential. If we could reduce those FPs it would greatly increase or scores and improve everyones perception of how good we are. Even the most basic rule of HTML_MESSAGE only hit on 75% of spam, we are doing more than great so far! Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400 mailto:info@i-is.com

5 12

WL. klm-email.com
by Alex Broens 27 Aug '04

27 Aug '04

Jeff Could you pls get this whitelisted? klm-email.com * 5.0 OB_URI_RBL URI's domain appears in ws database at ob.surbl.org * [klm-email.com is blacklisted in URI RBL at] Domain Name: KLM-EMAIL.COM Registrar: SAFENAMES LTD Whois Server: whois.safenames.net Referral URL: http://www.safenames.net Name Server: A.NS.KLM-EMAIL.COM Name Server: B.NS.KLM-EMAIL.COM Name Server: C.NS.KLM-EMAIL.COM Name Server: D.NS.KLM-EMAIL.COM Name Server: E.NS.KLM-EMAIL.COM Name Server: F.NS.KLM-EMAIL.COM Status: REGISTRAR-LOCK Updated Date: 24-may-2004 Creation Date: 17-may-2004 Expiration Date: 17-may-2006 ---------------------- From: KLM Belgium [SMTP:klm_belgium@klm-email.com] Sent: 27 August 2004 14:23 To: xxxxxxxxxxxx Subject: 10 Crazy Days of Internet USA from 321 euro Fasten your seatbelts as KLM's 10 days of internet will be in the air again from August 31st until September 9th. For 10 days in a row you can book your flights to 76 destinations at extra special prices via www.klm.be (http://klm-email.com/a/MUNGED / www.klm.lu (http://klm-email.com/a/MUNGED/link5. The offer being limited, be sure to book in time! Check the complete list of destinations and prices on www.klm.be (http://klm-email.com/a/MUNGED/link4) / www.klm.lu (http://klm-email.com/a/MUNGED/link4) as of August 31st. Visit www.airfrance.be (http://klm-email.com/a/MUNGED/link6) for other attractive offers. KLM The Reliable Airline --------------------------------

2 1

RE: [SURBL-Discuss] another new TLD?
by Chris Santerre 27 Aug '04

27 Aug '04

getin.to file.to surf.to all reported spams the past few days. >-----Original Message----- >From: Steven Champeon [mailto:schampeo@hesketh.com] >Sent: Thursday, August 26, 2004 4:47 PM >To: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] another new TLD? > > >on Thu, Aug 26, 2004 at 04:39:21PM -0400, Chris Santerre wrote: >> File.to >> >> from >> http://File.to/ooo >> >> OK to add as well? Looks like spammers are trying to get >around the standard >> com, net, info , biz. > >Not new at all. That's Togo, who sold rights to their NIC and which TLD >we often saw in redirection services (e.g., 'http://surf.to') >back in the >mid-nineties. > >Didn't someone post a complete list of TLDs here just recently? > >-- >hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/ _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

3 3

another new TLD?
by Chris Santerre 26 Aug '04

26 Aug '04

File.to from http://File.to/ooo OK to add as well? Looks like spammers are trying to get around the standard com, net, info , biz. --Chris

3 2

SpamCop URI Compilation
by Robin, Rob 26 Aug '04

26 Aug '04

All, My company has the policy of not throwing away default build from the OS install. Therefore, all my perl libs have been compiled under /usr/local/blah/blah without doing UNINST=1. After downloading all the necessary modules, etc, I am close to getting Spamcop URI compile. Details: Perl 5.005_03, SpamAssassin 2.63. perl ./Makefile.PL went through fine. Problem w/ it is extract_url.t test script. PERL5LIB="/usr/local/spamassassin/2.63/lib: /usr/local/perl5lib/HTML/Parser/3.26/lib: /usr/local/perl5lib/File/Spec/0.82/lib:/usr/local/perl5lib/URI/1.31/lib /usr/local/perl5lib/Test/Simple/0.47/lib /usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker /usr/local/perl5lib/podlators/1.27/lib /usr/local/perl5lib/Pod/Parser/1.28/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22" Export PERL5LIB The reason why I called the test script directly is because "make test" put my PERL5LIB directories as a less preferred lib and thus loaded older version of other libs that failed. I needed to circumvent by calling the test script directly. All the test scripts passed, except extract_urls.t. I defined "/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib" as part of PERL5LIB, since I know that SpamCopURI.pm is located at /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin/SpamCopURI.pm. Perl -V confirms that everything is defined properly. From the error message, could it be my perl version is too old ? Please note that all other test scripts went through just fine. bash-2.02# perl ./t/extract_urls.t 1..23 Undefined subroutine &Mail::SpamAssassin::SpamCopURI::_extract_urls called at ./t/extract_urls.t line 46. # Looks like your test died before it could output anything. Any input will be appreciated. #Perl -V (output). I verify that all the dir for my PERL5LIB existed just fine. Characteristics of this binary (from libperl): Built under bsdos Compiled at Oct 8 2000 21:58:54 %ENV: PERL5LIB="/usr/local/spamassassin/current/lib:/usr/local/perl5lib/HTML/Parser/current/lib:/usr/local/perl5lib/File/Spec/current/lib:/usr/local/perl5lib/URI/current/lib:/usr/local/perl5lib/Test/Simple/current/lib:/usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker:/usr/local/perl5lib/podlators/current/lib:/usr/local/perl5lib/Pod/Parser/current/lib:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22" @INC: /usr/local/spamassassin/current/lib /usr/local/perl5lib/HTML/Parser/current/lib /usr/local/perl5lib/File/Spec/current/lib /usr/local/perl5lib/URI/current/lib /usr/local/perl5lib/Test/Simple/current/lib /usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker /usr/local/perl5lib/podlators/current/lib /usr/local/perl5lib/Pod/Parser/current/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22 /usr/libdata/perl5/5.00503/i386-bsdos /usr/libdata/perl5/5.00503 /usr/libdata/perl5/site_perl/i386-bsdos /usr/libdata/perl5/site_perl /usr/libdata/perl5/site_perl/i386-bsdos/include . Thanks, ------------------------ Rob Robin Network Analyst Green Apple, Inc. 740-653-9890 rrobin(a)greenapple.com www.greenapple.com Internet access, hosting and development solutions since 1995.

2 1

RE: [SURBL-Discuss] Strange happenings...
by Chris Santerre 26 Aug '04

26 Aug '04

Older Steve submission. Yup same file. And I can see why these guys would have been added. Looks like spammers were using a spacer.gif image from them in theis spams. Hence lots of NANAS hits. This was before we looked for posion like this. Removed. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, August 18, 2004 9:52 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Strange happenings... > > >On Wednesday, August 18, 2004, 6:17:26 PM, Bill Landry wrote: > >> Replying to my own post. I see now that the URI above gets >redirected to: > >> >http://qspace.iplace.MUNGEDcom/cobrands/41/?sc=1452NLCRamp;&CM= MHHNewsletterServices&CE=TextArea3 > >> and "iplace.com" is listed in WS. So my next questions is, should >> "iplace.com" be listed in WS? > >Probably not. Anyone know if these guys are spammers or why it's >on WS? > >Name: icreditreport.com >Address: 205.180.159.210 >Aliases: qspace.iplace.com > >If this appeared in a legitimate message, then we probably should >whitelist. Was it in a ham? > >Comments? > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

3 2

New tld?
by Chris Santerre 26 Aug '04

26 Aug '04

I've never seen this TLD??? www.sdlkjfdd.it.tt Can I add to surbl? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

4 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss