- Discuss - Mailman 3

[SURBL-Discuss] Re: URI with one slash not recognised by SA/SPAMCOP_URI?
by John Fawcett 10 Jun '04

10 Jun '04

From: "Menno van Bennekom" > Hi, > > I get spam with a different URL, the redirect has only one '/': > <a > href="http://rd.yahoo.com/oashoscy/*http:/hjktccbz.woodwheel.info/mn/num17"> > > > This is not recognised by BIZ_TLD (in this example my copy, INFO_TLD). > I can change that in the regular expression. > But I don't think SPAMCOP_URI_RBL recognizes it too because woodwheel is > in the database but SA gives no hit. > If you click on the link above it works, so it seems the one slash is > possible. > Can anyone confirm that one slash is not recognized? This should work with SpamCopURI. What version are you using? Have you got entry like spamcop_uri_resolve_open_redirects 1 open_redirect_list_spamcop_uri rd.yahoo.com *.rd.yahoo.com in spamcop_uri.cf? John

4 6

Discounting invalid TLD's in uri_to_domain
by Yusuf Goolamabbas 09 Jun '04

09 Jun '04

I've filed bug 3467 in SA's bugzilla http://bugzilla.spamassassin.org/show_bug.cgi?id=3467 suggesting that uri_to_domain discount URI's which don't end in valid TLD's. There are test cases in which SA's get_uri_list can pick up URI of the form http://random.gif/ which will return random.gif as the domain and get fed into the pool of candidate domains to check for. I don't know that SpamCopURI's behaviour is with the testcases I've filed Regards, Yusuf

2 1

RE: SURBL works well on envelope sender
by Chris Santerre 08 Jun '04

08 Jun '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Monday, June 07, 2004 10:22 PM >To: spamassassin-dev(a)incubator.apache.org >Cc: discuss(a)lists.surbl.org >Subject: SURBL works well on envelope sender > *snip* > >How's the multi roll-out going? It would definitely be handy for this >test (the code to support it already exists). The simple answer is, "Its begining to look a lot like christmas." :) We are finally making some good headway. Bill has a nice system up. More _trusted_ people able to make submissions. A little more testing needed, and some scripts added. BigEvil.cf will be retiring from its current form soon, and be changing over to being created off of WS. I can't tell you how happy that makes me!! (And how much time it saves me!) Possibility of another SURBL taking the place of BE. 6dos.surbl.org? Still in discussion. Those stats should go thru the roof when we change over. --Chris (The tired one.)

1 0

IP addresses in SURBL?
by Chris Santerre 08 Jun '04

08 Jun '04

I forgot, DO I add these into the SURBL, or do I keep IPs out for now and add to my BigEvil dynamic version? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 3

Huh? Anyone know chinease?
by Chris Santerre 08 Jun '04

08 Jun '04

Huh??? I have no clue if this is a legit, spam, or shammer site! www.631.cn Anyone? --Chris >-----Original Message----- >From: SURBL+ Checker [mailto:surbl@rulesemporium.com] >Sent: Tuesday, June 08, 2004 4:37 AM >To: csanterre(a)MerchantsOverseas.com >Subject: SURBL+ Checker Submission > > >Date: Tue Jun 8 03:37:17 2004 >Reporter: Alex <alex(a)munged.de> >Reporter IP: 146.140.8.121 > >Applicable List: URIBL:be.surbl.org >Reported URI/IP: www.631.cn > >Email Source: >---------------------------------------- > >From dsfahgfsdjg(a)sina.com Tue Jun 8 05:11:32 2004 >Return-Path: <dsfahgfsdjg(a)sina.com> >X-Original-To: ciphelp@localhost >Delivered-To: ciphelp(a)localhost.igd.fhg.de >Received: from localhost (localhost [127.0.0.1]) > by electra.igd.fhg.de (Postfix) with ESMTP id 43EC4284F > for <ciphelp@localhost>; Tue, 8 Jun 2004 05:11:32 +0200 (CEST) >Delivered-To: fsf(a)zeitform.de >Received: from mail.zeitform.de [146.140.212.117] > by localhost with POP3 (fetchmail-6.2.0) > for ciphelp@localhost (single-drop); Tue, 08 Jun 2004 >05:11:32 +0200 (CEST) >Received: (qmail 18309 invoked by uid 906); 8 Jun 2004 03:09:03 -0000 >Received: from dsfahgfsdjg(a)sina.com by guildenstern by uid 89 >with qmail-scanner-1.22 > (clamdscan: 0.72. spamassassin: 2.63. >Clear:RC:0(219.137.195.16):SA:1(7.6/5.0):. > Processed in 1.51324 secs); 08 Jun 2004 03:09:03 -0000 >X-Spam-SavedStatus: Yes, hits=7.6 required=5.0 >X-Spam-SavedLevel: ******* >Received: from unknown (HELO sina.com) (219.137.195.16) > by guildenstern.zeitform.de with SMTP; 8 Jun 2004 03:09:01 -0000 >From: dsfahgfsdjg(a)sina.com >Subject: Chinese handicraft >To: fsf(a)zeitform.de >Content-Type: text/html;charset="GB2312" >Date: Tue, 8 Jun 2004 11:08:57 +0800 >X-Priority: 4 >X-Mailer: Foxmail 4.1 [cn] >X-Qmail-Scanner-1.22: added fake MIME-Version header >MIME-Version: 1.0 >X-Qmail-Scanner-Message-ID: <108666414267218299@guildenstern> >Message-Id: <20040608031132.43EC4284F(a)electra.igd.fhg.de> >X-Spam-Contact: Please contact alex(a)zeitform.de if anything looks wrong >X-Spam-Flag: YES >X-Spam-Checker-Version: SpamAssassin >2.63-zeitform_1.11_electra (2004-01-11) > on electra.igd.fhg.de >X-Spam-Level: ********************* >X-Spam-Status: Yes, hits=21.6 required=8.0 tests=BAYES_99,DCC_CHECK, > DEAR_SOMETHING,DNS_FROM_RFCI_DSN,FRONTPAGE,HTML_70_80, > HTML_CHARSET_FARAWAY,HTML_FONTCOLOR_BLUE,HTML_IMAGE_AREA_05, > HTML_MESSAGE,MIME_CHARSET_FARAWAY,MIME_HTML_ONLY,NO_REAL_NAME, > RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_RFCI autolearn=no > version=2.63-zeitform_1.11_electra >X-Spam-Report: > * 0.2 NO_REAL_NAME From: does not include a real name > * 2.3 DEAR_SOMETHING BODY: Contains 'Dear (something)' > * 0.1 HTML_FONTCOLOR_BLUE BODY: HTML font color is blue > * 0.1 HTML_MESSAGE BODY: HTML included in message > * 2.2 HTML_IMAGE_AREA_05 BODY: HTML has 5-6 kilopixels >of images > * 1.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives >confidence between 51 and 100 > * [cf: 100] > * 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML > * 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100% > * [score: 1.0000] > * 0.3 MIME_HTML_ONLY BODY: Message only has text/html >MIME parts > * 2.5 FRONTPAGE BODY: Frontpage used to create the message > * 1.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) > * 2.9 DCC_CHECK Listed in DCC >(http://rhyolite.com/anti-spam/dcc/) > * 0.3 DNS_FROM_RFCI_DSN RBL: From: sender listed in >dsn.rfc-ignorant.org > * 0.1 RCVD_IN_RFCI RBL: Sent via a relay in >ipwhois.rfc-ignorant.org > * [$ has inaccurate or missing WHOIS data at the] > [RIR] > * 0.5 HTML_CHARSET_FARAWAY A foreign language charset >used in HTML markup > * 2.5 MIME_CHARSET_FARAWAY MIME character set >indicates foreign language >Status: RO >Content-Length: 6551 >Lines: 93 > ><html> > ><head> ><meta http-equiv="Content-Type" content="text/html; charset=gb2312"> ><meta name="GENERATOR" content="Microsoft FrontPage 4.0"> ><meta name="ProgId" content="FrontPage.Editor.Document"> ><title>Ýþ²Ý</title> ></head> > ><body> > ><table border="0" width="100%" height="84" cellspacing="0" >cellpadding="0"> > <tr> > <td width="100%" height="46"> > <p style="line-height: 100%"> <font color="#0000FF" >size="3" face="Comic Sans MS">Dear > Sirs,</font><p style="line-height: 100%"><font >color="#0000FF" size="3" face="Comic Sans MS">We > are a big manufacturer and exporter for the straw hat in >Guangdong China > and export to European market for years' >experiences. </font><p style="line-height: 100%"><font >color="#0000FF" size="3" face="Comic Sans MS">Nowadays, We > own eight franchised stores and many alliance stores. We >export all kinds > of straw hat to many countries and get high reputation >for our top > quality, reasonable price, quick delivery, punctuate and >cordial service > among the customers. </font><p style="line-height: >100%"><font color="#0000FF" size="3" face="Comic Sans MS">For > more our company information and arranged items, pleased >go to our > Internet Nebsite:<a href="http://www.631.cn/cm/cm" >target="_blank">www.631.cn/cm/cm > </a> Hope you will show some interested in > our strong parts. </font><p style="line-height: >100%"><font color="#0000FF" size="3" face="Comic Sans MS">Sincerely > hope for you kind compare. We are eager to building up >business relation > with you in near future. </font><p >style="line-height: 100%"><font color="#0000FF" size="3" >face="Comic Sans MS">Looking > forward to your attention and early reply.</font><p >style="line-height: 100%"><font color="#0000FF" size="3" >face="Comic Sans MS">Best > Regards,</font><p style="line-height: 100%"><font >color="#0000FF" size="3" face="Comic Sans MS">Ms. > Greace (Sales)</font><p style="line-height: 100%"><font >color="#0000FF" size="3" face="Comic Sans >MS">E-mail:sh040601@yahoo.com.cn</font><p style="line-height: >100%"><font color="#0000FF" size="3" face="Comic Sans MS">Mobile > Phone:+86 20 13711547452/33501929</font><p >style="line-height: 100%"><font color="#0000ff" size="3" >face="Comic Sans MS">Fax:+86-20-87249995</font></td> > </tr> > <tr> > <td width="100%" height="26"><font color="#0000ff" >size="2">   </font></td> > </tr> ></table> ><table cellSpacing="8" cellPadding="8" width="56%" border="8" >height="1172"> > <tbody> > <tr> > <td width="33%" height="217"><a >href="http://www.631.cn/cmtp/101.htm" target="_blank"><img >src="http://www.631.cn/cm/101.gif" border="0" width="200" >height="200"></a></td> > <td width="35%" height="217"><a >href="http://www.631.cn/cmtp/102.htm" target="_blank"><img >src="http://www.631.cn/cm/102.gif" border="0" width="200" >height="200"></a></td> > <td width="36%" height="217"><a >href="http://www.631.cn/cmtp/103.htm" target="_blank"><img >src="http://www.631.cn/cm/103.gif" border="0" width="200" >height="200"></a></td> > </tr> > <tr> > <td width="33%" height="200"><a >href="http://www.631.cn/cmtp/105.htm" target="_blank"><img >src="http://www.631.cn/cm/105.gif" border="0" width="200" >height="200"></a></td> > <td width="35%" height="200"><a >href="http://www.631.cn/cmtp/112.htm" target="_blank"><img >src="http://www.631.cn/cm/112.gif" border="0" width="200" >height="200"></a></td> > <td width="36%" height="200"><a >href="http://www.631.cn/cmtp/113.htm" target="_blank"><img >src="http://www.631.cn/cm/113.gif" border="0" width="200" >height="200"></a></td> > </tr> > <tr> > <td width="33%" height="225"><a >href="http://www.631.cn/cmtp/108.htm" target="_blank"><img >src="http://www.631.cn/cm/108.gif" border="0" width="200" >height="200"></a></td> > <td width="35%" height="225"><a >href="http://www.631.cn/cmtp/109.htm" target="_blank"><img >src="http://www.631.cn/cm/109.gif" border="0" width="200" >height="200"></a></td> > <td width="36%" height="225"><a >href="http://www.631.cn/cmtp/107.htm" target="_blank"><img >src="http://www.631.cn/cm/107.gif" border="0" width="200" >height="200"></a></td> > </tr> > <tr> > <td width="33%" height="200"><a >href="http://www.631.cn/cm/110.htm" target="_blank"><img >src="http://www.631.cn/cm/110.gif" border="0" width="200" >height="200"></a></td> > <td width="35%" height="200"><a >href="http://www.631.cn/cmtp/117.htm" target="_blank"><img >src="http://www.631.cn/cm/117.gif" border="0" width="200" >height="200"></a></td> > <td width="36%" height="200"><a >href="http://www.631.cn/cmtp/120.htm" target="_blank"><img >border="0" src="http://www.631.cn/cm/120.gif" width="200" >height="200"></a></td> > </tr> > <tr> > <td width="33%" height="200"><a >href="http://www.631.cn/cmtp/118.htm" target="_blank"><img >src="http://www.631.cn/cm/118.gif" border="0" width="200" >height="200"></a></td> > <td width="35%" height="200"><a >href="http://www.631.cn/cmtp/111.htm" target="_blank"><img >src="http://www.631.cn/cm/111.gif" border="0" width="200" >height="200"></a></td> > <td width="36%" height="200"><a >href="http://www.631.cn/cmtp/106.htm" target="_blank"><img >src="http://www.631.cn/cm/106.gif" border="0" width="200" >height="200"></a></td> > </tr> > </tbody> ></table> ><table height="1" borderColorDark="#ffffff" width="704" >borderColorLight="#333333" border="1"> > <tbody> > <tr> > <td width="70" bgColor="#ffb051" height="1"><font >size="2">Adders:</font></td> > <td width="618" bgColor="#fff8a2" height="1"><font >size="2">Barbe Industrial Ltd.<br> > No.1521,7Floor, HengLong Tower Guangzhou<br> > Big Rd.Guangdong China.</font></td> > </tr> > <tr> > <td width="70" bgColor="#ffb051" height="1"><font >size="2">Packing:</font></td> > <td width="618" bgColor="#fff8a2" height="1"><font >size="2">Have two > >packing:400PCS/CTN,MEAS:80¡Á52¡Á70£»200PCS/CTN£¬MEAS:80¡Á21¡Á70 >¡£</font></td> > </tr> > <tr> > <td width="70" bgColor="#ffb051" height="1"><font >size="2">Description:</font></td> > <td width="618" bgColor="#fff8a2" height="1"><font size="2">The > hats are made of push, that is fine natural plant >(without any pollution), > surface innocuous coated; The push is very soft and >toughness, knitted by > a special technology method( about80 years history), >being able to stand > wear and tear.</font></td> > </tr> > </tbody> ></table> > ></body> > ></html> > > >---------------------------------------- > >

1 0

http://.virtual-pc.org
by Frank Ellermann 08 Jun '04

08 Jun '04

Hi, I've just seen http://.virtual-pc.org in a spam, and SC handled it as virtual-pc.org resp. www.virtual-pc.org SURBL got it, virtual-pc.org.sc.surbl.org is listed, can SA also handle this trick ? Bye, Frank

1 0

[SURBL-Discuss] Fwd: URI with one slash not recognised by SA/SPAMCOP_URI?
by Jeff Chan 07 Jun '04

07 Jun '04

This is a forwarded message From: Menno van Bennekom <mvbengro(a)xs4all.nl> To: spamassassin-users(a)incubator.apache.org Date: Monday, June 7, 2004, 5:00:50 AM Subject: URI with one slash not recognised by SA/SPAMCOP_URI? ===8<==============Original message text=============== Hi, I get spam with a different URL, the redirect has only one '/': <a href="http://rd.yahoo.com/oashoscy/*http:/hjktccbz.woodwheel.info/mn/num17"> This is not recognised by BIZ_TLD (in this example my copy, INFO_TLD). I can change that in the regular expression. But I don't think SPAMCOP_URI_RBL recognizes it too because woodwheel is in the database but SA gives no hit. If you click on the link above it works, so it seems the one slash is possible. Can anyone confirm that one slash is not recognized? Regards Menno van Bennekom ===8<===========End of original message text===========

1 0

large number of empty URIs preceeding actual one
by Jeff Chan 05 Jun '04

05 Jun '04

Not sure if this is a new type of spam or not: http://www.surbl.org/fitch7826drug.us.4jun04.txt This example I just received had many real or joe job URIs with no text in the anchor like: <a href=3D"http://www.elysian-MUNGED.com"></a> Perhaps it's trying to run out some counters, but the real target domain is visible as the last "removal" URI: <a href=3D"http://= www.ozone.fitch7826drug-MUNGED.us/d.ddd">here.</a> > Name: fitch7826drug.us > Address: 61.250.93.214 Where this IP is in sbl.spamhaus.org of course. The "ordering" link just before it was broken (no dot, at least in my MUA, The Bat!): <a href=3D"http://fitch7826drug= us/b94">Click Interestingly SpamCop did parse the message correctly in terms of ignoring the blank anchors and finding only the clickable ones. That said, if urirhsbl or SpamCopURI limit the number of URIs checked, these could sneak through. A useful behavior might be to ignore any non-clickable anchors, if we're not already doing that. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

5 5

Re: [SURBL-Discuss] Joe Job again: Watchsound.com
by Jim Knuth 04 Jun '04

04 Jun '04

Hallo und guten Morgen Jeff, danke für die Email vom 04.06.2004 um 00:43 Jeff Chan schrieb - wrote: > On Thursday, June 3, 2004, 7:25:06 AM, Chris Santerre wrote: >> LOL, guess they don't like being added to BigEvil! watchsound.com is Joe >> Jobbing me now. Poor little pron spammer hosted in China. (61.152.133.68). >> Feel free to add this to the other SURBL servers, firewall blocks, Host file >> blocks, squid blocks, ect..... > FWIW This domain is currently in sc.surbl.org and ws.surbl.org.. > (But not be.surbl.org? That doesn't seem right...) warum schickst Du mir das? Hab ich damit etwas zu tun? why do you send that to me? Have done I with that something? -- Viele Grüße, Kind regards, Jim Knuth jk(a)jkart.de ICQ #277289867 ---------- Zufalls-Zitat ---------- Frauen würden sich leichter damit abfinden, dass ihr Mann später nach Hause kommt, wenn sie sich wirklich darauf verlassen könnten, dass er nicht früher da ist. [Sidonie-Gabrielle Colette] ---------- Dieser Text hat nichts mit dem Empfänger der Mail zu tun ---------- virengeprüft mit NOD32 Version 1.780 Update 03.06.2004

1 0

Joe Job again: Watchsound.com
by Chris Santerre 04 Jun '04

04 Jun '04

LOL, guess they don't like being added to BigEvil! watchsound.com is Joe Jobbing me now. Poor little pron spammer hosted in China. (61.152.133.68). Feel free to add this to the other SURBL servers, firewall blocks, Host file blocks, squid blocks, ect..... Thankfully a LOT of people have wised up to Joe Jobs and seem to be checking the sending IP vs. the From. So I don't get many complaints. I guess I should be flatered? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 2

Whitelist sparklist.com
by Chris Santerre 04 Jun '04

04 Jun '04

They *seem* to be white. But have spammers signup and run one time spam runs. They aren't in the URL links, but are the senders. Just something to look out for. However, surpluscomputers.com can be blacklisted to the stoneage! ALong with softwareandstuff.com ! Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 2

RE: [SURBL-Discuss] Whitelist sparklist.com
by Chris Santerre 03 Jun '04

03 Jun '04

>-----Original Message----- >From: Kris Deugau [mailto:kdeugau@vianet.ca] >Sent: Thursday, June 03, 2004 12:47 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Whitelist sparklist.com > > >Chris Santerre wrote: >> However, surpluscomputers.com can be blacklisted to the stoneage! >> ALong with softwareandstuff.com ! > >Why? Their list management seems... dubious at times, but they're a >legit business and I for one specifically signed up for their >newsletter- which, IIRC, was properly confirmed opt-in. (Both domains >are for the same company; they've been trying to change their name and >domain.) > >-kgd Because they sent a SPAM to me, to an email that was setup specifically to be used by at another site. I make alias emails for everything I sign up for. So I can track when this happens. They used this email address, which they somehow got from a competitor of theirs. It was obviously not signed up for use with them, because I would have made a new one. So not only did they spam, but they got the address thru ill means. I am working with the original site to find how they got it. They are NOT affiliates or partners. --Chris

2 1

Re: rbldnsd is not responding
by Ricardo 03 Jun '04

03 Jun '04

Hi! > On Wednesday, June 2, 2004, 9:00:52 AM, Ricardo Ricardo wrote: >>We are trying to setup a local rbldnsd with rsynced data to answer the >>DNS queries, but the rbldnsd is not responding. [...] >>If I test our cached DNS system: >>% nslookup adulteroticfiction-MUNGED.com.sc.surbl.org 127.0.0.1 >>*** Can't find server name for address 127.0.0.1: Query refused >>*** Default servers are not available Thanks for the tips! I saw that I was not doing the right test... This one worked: dig test.surbl.org-MUNGED.sc.surbl.org @127.0.0.1 BTW, I (think I) understand how the whole thing works, but... isn't it possible to change SpamCopURI to resolve the names at a specific machine ip/port, instead of changing the DNS setup? Wouldn't this be easier and safer? []s! -- ... Hofstadter's Law: The time and effort required to complete a project are always more than you expect, even when you take into account Hofstadter's Law.

2 1

Need assistance in Installing SpamCopURI
by Rich 03 Jun '04

03 Jun '04

I'm sorry if this is a little off-base here, I am trying to install SA plugin SpamCopURI but kept getting errors as shown below, one error indicates 'Can't locate URI/QueryParam.pm' but I already copied the file to /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/ Any input would be appreciated. Thanks. #perl Makefile.PL # SAPATH /usr/lib/perl5/site_perl/5.8.0 # installsitelib /usr/lib/perl5/site_perl/5.8.0 # INSTALLDIRS site Warning: prerequisite Net::DNS 0 not found. Warning: prerequisite URI 1.28 not found. We have 1.21. Writing Makefile for Mail::SpamAssassin::SpamCopURI #make Manifying blib/man3/Mail::SpamAssassin::Conf.3pm Manifying blib/man3/Mail::SpamAssassin::PerMsgStatus.3pm Manifying blib/man3/Mail::SpamAssassin::SpamCopURI.3pm #make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/blacklist........Can't locate URI/QueryParam.pm in @INC (@INC contains: /usr/local/src/Mail-SpamAssassin-SpamCopURI-0.18/blib/lib /usr/local/src/Mail-SpamAssassin-SpamCopURI-0.18/blib/arch /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl . /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl .) at /usr/local/src/Mail-SpamAssassin-SpamCopURI-0.18/blib/lib/Mail/SpamAssassin/ SpamCopURI.pm line 5. BEGIN failed--compilation aborted at /usr/local/src/Mail-SpamAssassin-SpamCopURI-0.18/blib/lib/Mail/SpamAssassin/ SpamCopURI.pm line 5. Compilation failed in require at t/blacklist.t line 4. BEGIN failed--compilation aborted at t/blacklist.t line 4. . . . . Test returned status 255 (wstat 65280, 0xff00) DIED. FAILED tests 1-6 Failed 6/6 tests, 0.00% okay Failed Test Stat Wstat Total Fail Failed List of Failed ---------------------------------------------------------------------------- --- t/blacklist.t 255 65280 4 4 100.00% 1-4 t/dnsrbl.t 255 65280 6 6 100.00% 1-6 t/extract_urls.t 255 65280 23 23 100.00% 1-23 t/mailto.t 255 65280 1 1 100.00% 1 t/open_redirect.t 255 65280 5 5 100.00% 1-5 t/spamcopuri.t 255 65280 12 12 100.00% 1-12 t/whitelist.t 255 65280 6 6 100.00% 1-6 Failed 7/7 test scripts, 0.00% okay. 57/57 subtests failed, 0.00% okay. make: *** [test_dynamic] Error 2

5 5

RE: [SURBL-Discuss] Need assistance in Installing SpamCopURI
by Chris Santerre 03 Jun '04

03 Jun '04

>-----Original Message----- >From: John Andersen [mailto:jsa@pen.homeip.net] >Sent: Wednesday, June 02, 2004 10:47 PM >To: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] Need assistance in Installing SpamCopURI > > >On Wednesday 02 June 2004 07:05, Raymond Dijkxhoorn wrote: >> Hi! >> >> > You could also try install SpamCopURI through CPAN: >> > >> > perl -MCPAN -e shell >> > install Mail::SpamAssassin::SpamCopURI >> > >> > >> > And the dependencies should be taken care of. >> >> Hey, cool, didnt know it was in CPAN yet, great! > >That is cool! >I wish more people would use CPAN for perl things. >I don't understand why people want to use RPMs for this, >I've always done Spamassassin this way and its So easy. > Hey I didn't know it was on CPAN either! Now that is cool! Very nice guys, great work! --Chris

1 0

Re: ANNOUNCE: Mail::SpamAssassin::SpamCopURI 0.18
by Jeff Chan 03 Jun '04

03 Jun '04

On Wednesday, June 2, 2004, 2:10:58 PM, Lucas Albers wrote: > I noticed this release does not have support for: > open_redirect_list_spamcop_uri drs.yahoo.com > open_redirect_list_spamcop_uri rd.yahoo.com > Why not? > Should I just add them back in? > I currently has these listed: > open_redirect_list_spamcop_uri snurl.com *.snurl.com > open_redirect_list_spamcop_uri snipurl.com *.snipurl.com > open_redirect_list_spamcop_uri tinyclick.com *.tinyclick.com > open_redirect_list_spamcop_uri babyurl.com *.babyurl.com > open_redirect_list_spamcop_uri lin.kz *.lin.kz > open_redirect_list_spamcop_uri *.v3.net > open_redirect_list_spamcop_uri shorl.com *.shorl.com > open_redirect_list_spamcop_uri tinyurl.com *.tinyurl.com > open_redirect_list_spamcop_uri xurl.us As I understand it, SpamCopURI only handles "open" redirects where the redirected-to site is visible in the original URI. I'm not sure why/if the yahoo redirectors came out of the list. Perhaps Eric Kolve can comment. "Opaque" redirection sites, which encode or otherwise obscure the destination URI, such as tinyurl.com, are not currently handled in SpamCopURI (SA 2.63) or urirhsbl (SA 3.0), due to potential resource issues. Following such redirections would incur network access, timeouts, etc. that would probably be unusable on a mail system with significant message volume. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 2

Re: [SURBL-Discuss] Is spamd broken?
by John Andersen 03 Jun '04

03 Jun '04

On Wednesday 02 June 2004 20:22, David B Funk wrote: > On Wed, 2 Jun 2004, John Andersen wrote: > > Folks here probably remember me whining about never once > > seeing a surbl hit in my spam even after wadeing thru hundreds > > of spams. > > > > Several users gave me hints which I dutifully carried out (thanks guys). > > John Fawcett even sent me a spammer's web URI that was > > guarenteed to trigger the Spamcop URI code and it did when fired > > off manually with a command line like > > /usr/bin/spamassassin -D -t < message-file > output-file 2>&1 > > > > BUT STILL no Surbl hits. > > > > Just as a lark I remove the spamd line from my procmailrc and > > replaced it with /usr/bin/spamassassin -a > > > > AND IT WORKS? > > > > So, what's wrong with spamd? Is it not capable of handling > > anything but the basic rules? > > One question John, > Do you -really- mean 'spamd' ? > Are you actually trying to use 'spamd' in your procmailrc? No, - Good catch, I was using spamc in procmailrc to send it to spamd. Spamassassin used directly seems a bit more resource intensive as I can hear my disks ratteling away when mail arrives. Not that this matters much because the machine has nothing to do most of the time. -- _____________________________________ John Andersen

2 1

Is spamd broken?
by John Andersen 03 Jun '04

03 Jun '04

Folks here probably remember me whining about never once seeing a surbl hit in my spam even after wadeing thru hundreds of spams. Several users gave me hints which I dutifully carried out (thanks guys). John Fawcett even sent me a spammer's web URI that was guarenteed to trigger the Spamcop URI code and it did when fired off manually with a command line like /usr/bin/spamassassin -D -t < message-file > output-file 2>&1 BUT STILL no Surbl hits. Just as a lark I remove the spamd line from my procmailrc and replaced it with /usr/bin/spamassassin -a AND IT WORKS? So, what's wrong with spamd? Is it not capable of handling anything but the basic rules? -- _____________________________________ John Andersen

2 1

Re: SURBL and hitpoints
by Jeff Chan 03 Jun '04

03 Jun '04

On Wednesday, June 2, 2004, 4:55:29 AM, Martin Lyberg wrote: > Lucas Albers wrote: >> My average score on spam increased signifigantly. >> I'll have to enable redirector checks because many spammers are now using >> redirectors. > Does anybody know why this isn't enabled by default? Is the > redirector-list accurate or should i add/remove anything from the list? > Will the cpu-load increase significant? Yes, the redirection checks are disabled by default to save some resources like CPU and network traffic. If your message volume isn't too large then you can probably enable it. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

rbldnsd is not responding
by Ricardo 03 Jun '04

03 Jun '04

Dear list, Help! We are trying to setup a local rbldnsd with rsynced data to answer the DNS queries, but the rbldnsd is not responding. I started it manually with this command: % /usr/local/sbin/rbldnsd -u rbldns -b 127.0.0.1/53 -w /usr/local/etc/rbldnsd sc.surbl.org:dnset:sc.surbl.org.rbldnsd ws.surbl.org:dnset:ws.surbl.org.rbldnsd It started with no errors, and with an expected output (as seen on http://www.surbl.org/rbldnsd-howto.html): rbldnsd: listening on 127.0.0.1/53 rbldnsd: dnset:sc.surbl.org.rbldnsd: 20040602 131207: e/w=504/0 rbldnsd: dnset:ws.surbl.org.rbldnsd: 20040602 131208: e/w=12297/0 rbldnsd: zones reloaded, time 0.2e/0.0u sec rbldnsd: rbldnsd version 0.992 (7 Mar 2004) started (1 socket(s), 2 zone(s)) If I test our cached DNS system: % nslookup adulteroticfiction-MUNGED.com.sc.surbl.org 127.0.0.1 *** Can't find server name for address 127.0.0.1: Query refused *** Default servers are not available If I use the default DNS, of course it works: % nslookup adulteroticfiction-MUNGED.com.sc.surbl.org Server: server4.mpc.com.br Address: 200.246.0.252 Name: adulteroticfiction-MUNGED.com.sc.surbl.org Address: 127.0.0.2 There's no other DNS on the machine, nor errors on /var/log/messages. I also tried to use the FreeBSD version of the startup script. This are the versions of the softwares: - FreeBSD 4.9-RELEASE-p3 - rbl dns daemon version 0.992 (7 Mar 2004) Any hints to solve this will be greatly appreciated! []s! -- ... Press any key to continue or any other key to quit.

2 1

Rsync request
by Ricardo 01 Jun '04

01 Jun '04

Hi list! :) I'd like to know if is normal to have a certain delay in a response after request for a rsync using http://www.surbl.org/rsync-signup.html I did it on 05/24, if I'm not mistaken... []s! -- ... No Mice were harmed in the creation of this message. Two dogs got sick, and a cat ran away. But no mice were harmed.

3 2

SV: [SURBL-Discuss] Problems installing SPAMCOP_URI - Make test e rror
by Martin Lyberg 31 May '04

31 May '04

Hi Eric, Thanks for all help, that seem to solve my problem. SPAMCOP_URI is now installed and im getting loads of hit on the SURBL-lists :) Thank you! / Martin : -----Ursprungligt meddelande----- : Från: Eric Kolve [mailto:ekolve@comcast.net] : Skickat: den 28 maj 2004 01:20 : Till: Martin Lyberg : Kopia: 'SURBL Discussion list ' : Ämne: Re: [SURBL-Discuss] Problems installing SPAMCOP_URI - : Make test e rror : : : On Thu, May 27, 2004 at 10:09:14PM +0200, Martin Lyberg wrote: : > Hi Eric, : > : > That is correct, if this is the message you mean? : > : > perl Makefile.PL : > # SAPATH /usr/lib/perl5/site_perl/5.8.0 : > # installsitelib /usr/lib/perl5/site_perl/5.8.0 : > # INSTALLDIRS site : > Warning: prerequisite URI 1.28 not found. We have 1.21. : > Writing Makefile for Mail::SpamAssassin::SpamCopURI : > : > Which URI package do i need to download through CPAN in this case? : Install this package: : : http://search.cpan.org/CPAN/authors/id/G/GA/GAAS/URI-1.30.tar.gz : : : --eric : : : > : > Thanks in advance : > : > / Martin : > : > -----Original Message----- : > From: Eric Kolve : > To: SURBL Discussion list : > Sent: 5/27/2004 6:34 PM : > Subject: Re: [SURBL-Discuss] Problems installing SPAMCOP_URI - Make : > test e rror : > : > You need the URI package from CPAN. You should have received : > a warning when you attempted to install (if not let me know). : > : > --eric : > : > : > On Thu, May 27, 2004 at 02:52:28PM +0200, Martin Lyberg wrote: : > > Hi! : > > : > > I solved the problem by this thread: : > > : > > http://lists.surbl.org/pipermail/discuss/2004-May/000522.html : > > : > > But now i can't get through 'make test'. This gives me the : > > following: : > > : > > make test : > > : > > ---snip--- : > > : > > Failed 9/9 tests, 0.00% okay : > > t/whitelist........Can't locate URI/QueryParam.pm in @INC (@INC : > contains: : > > /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib : > > /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/arch : > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 : > > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/site_perl/5.8.0 : > > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl : > > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/vendor_perl/5.8.0 : > > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl : > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi : /usr/lib/perl5/5.8.0 . : > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 : > > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl : > > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl : > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi : /usr/lib/perl5/5.8.0 .) : > at : > > : > : /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib/Mail/SpamAssassin/Spa : > mC : > opUR : > > I.pm line 5. : > > BEGIN failed--compilation aborted at : > > : > : /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib/Mail/SpamAssassin/Spa : > mC : > opUR : > > I.pm line 5. : > > Compilation failed in require at t/whitelist.t line 6. BEGIN : > > failed--compilation aborted at t/whitelist.t line 6. # Looks like : > > your test died before it could output anything. : > > t/whitelist........dubious : > > : > > Test returned status 2 (wstat 512, 0x200) : > > DIED. FAILED tests 1-6 : > > Failed 6/6 tests, 0.00% okay : > > Failed Test Stat Wstat Total Fail Failed List of Failed : > > : > : ---------------------------------------------------------------------- : > -- : > ---- : > > --- : > > t/blacklist.t 2 512 4 4 100.00% 1-4 : > > t/dnsrbl.t 2 512 6 6 100.00% 1-6 : > > t/extract_urls.t 2 512 15 15 100.00% 1-15 : > > t/mailto.t 2 512 1 1 100.00% 1 : > > t/open_redirect.t 2 512 5 5 100.00% 1-5 : > > t/spamcopuri.t 2 512 9 9 100.00% 1-9 : > > t/whitelist.t 2 512 6 6 100.00% 1-6 : > > Failed 7/7 test scripts, 0.00% okay. 46/46 subtests failed, 0.00% : > okay. : > > make: *** [test_dynamic] Error 2 : > > : > > Any solution to this problem? Just before i did upgrade Net::DNS : > through : > > CPAN. : > > : > > Thank you. : > > : > > / Martin : > > : > > : > > : > > : -----Ursprungligt meddelande----- : > > : Från: Eric Kolve [mailto:ekolve@comcast.net] : > > : Skickat: den 27 maj 2004 14:11 : > > : Till: SURBL Discussion list : > > : Ämne: Re: [SURBL-Discuss] Problems installing SPAMCOP_URI : > > : : > > : : > > : On Thu, May 27, 2004 at 01:44:02PM +0200, Martin Lyberg wrote: : > > : > : Hi : > > : > : : > > : > : I've been reading alot about SURBL in SA-mailinglist, now : > > : > : i've decided to give it a try. But im having trouble : > > : > : installing SpamcopUri. : > > : > : : > > : > : I have the following system: RH9, Postfix, SA 2.63 : > > : > : : > > : > : I get the following: : > > : > : : > > : > : Perl Makefile.pl : > > : > : : > > : > : Can't locate Mail/SpamAssassin.pm in @INC (@INC contains: : > > : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > > : > : /usr/lib/perl5/5.8.0 : > > : > : /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > > : > : /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl : > > : > : /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > > : > : /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl : > > : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > > : > : /usr/lib/perl5/5.8.0 .) at Makefile.PL line 3. BEGIN : > > : > : failed--compilation aborted at Makefile.PL line 3. : > > : > : : > > : > : What is wrong here? : > > : : > > : It looks like 'Perl' (was that really what was executed) : > > : couldn't find Mail::SpamAssassin. Do you know where it's : > > : installed? This appears to be an issue with the @INC. : > > : : > > : : > > : --eric : > > : : > > : : > > : > : > > : > Does anyone know a solution to this problem? Is there : any easy : > > : > solution? : > > : > : > > : > Thanks in advance : > > : > : > > : > / Martin : > > : > _______________________________________________ : > > : > Discuss mailing list : > > : > Discuss(a)lists.surbl.org : > > : > http://lists.surbl.org/mailman/listinfo/discuss : > > : _______________________________________________ : > > : Discuss mailing list : > > : Discuss(a)lists.surbl.org : > > : http://lists.surbl.org/mailman/listinfo/discuss : > > : : > > : > > _______________________________________________ : > > Discuss mailing list : > > Discuss(a)lists.surbl.org : > > http://lists.surbl.org/mailman/listinfo/discuss : > : > _______________________________________________ : > Discuss mailing list : > Discuss(a)lists.surbl.org : > http://lists.surbl.org/mailman/listinfo/discuss :

6 12

SpamCopURI+ --lint
by Cami 30 May '04

30 May '04

Hi All, I'm using the SA Mail-SpamAssassin-SpamCopURI-0.17 plugin, (i've installed the packages required) and i'm getting the following errors when running spamassassin --lint: [spamwall01][/etc/mail/spamassassin]# spamassassin --lint Failed to compile URI SpamAssassin tests, skipping: (syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule WS_URI_RBL, line 1, near "eval:" syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 1, near "eval:" syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 6, near "} }" ) Is this something to worry about? (i thought --lint should not return any errors..) Regards, Cami

2 2

FW: SURBL+ Checker Submission
by Chris Santerre 28 May '04

28 May '04

Currently people are using the SARE website to report domains to me. This is the kind of report I get. I've munged the email and IP of the reporter. Most of the time the entire spam is also included. I get about 12 a day. However I'n not going to be adding domains like this to BE in the very near future. These should start going to an address for WS until Paul gets his project up? If so, all I need is an email address. Thanks, --Chris >-----Original Message----- >From: SURBL+ Checker [mailto:surbl@rulesemporium.com] >Sent: Friday, May 28, 2004 10:05 AM >To: csanterre(a)MerchantsOverseas.com >Subject: SURBL+ Checker Submission > > >Date: Fri May 28 09:04:38 2004 >Reporter: Adam <munged(a)npower.com> >Reporter IP: 62.xxx.25.19 >Reporter Desc: Another spam domain. > >Applicable List: URIBL:be.surbl.org >Reported URI/IP: tonightafter.com > >Email Source: >---------------------------------------- > >Message sent in plain text: > >One of your buddies hooked you up on a date with another buddy. > >http://tonightafter.com/confirm/?oc=50798885 > > > > > > > > > > > > > > > > > > >Don't want these notifications? >http://tonightafter.com/remove/?oc=50798885 > > > >nsophomoricdelude aspersion ephesus gigaherz kinshasha >teratology stalwart bebop intensive whatnot insert badge >quality aldermen copter assail testament pistol been bystander >cost beneficent clinician cyclops falsify matrices breadroot >bushel charcoal dwindle kobayashi > >obrassymediate moneymake calvinist osiris insupportable >intrigue cavemen bonito pig digital derelict doctrinaire >badinage mathematician television rhyme matsumoto vacuolate >conceptual landmark typhon > >Message headers: > >Received: from pcp01061328pcs.summit01.tn.comcast.net >([68.60.16.253]) by > kfnfw01.npower.com via smtpd (for [10.52.40.144]) with >SMTP; 28 May 2004 > 00:28:05 UT >X-Message-Info: 8Uiw9j262CPXfyuJXQ22mxd155uwrqaGHxilJIixvYYgxv4up >Received: from yahoo.com ([205.138.1.111]) by co14-p82.yahoo.com with > Microsoft SMTPSVC (7.7.6206.9972); Fri, 28 May 2004 14:31:14 -0200 >Received: from yahoo.com (yahoo.com [174.174.7.190]) by yahoo.com > (8.12.10/8.12.9) with ESMTP id pwe4JO051427 for ><bizbox(a)npower.com>; Fri, > 28 May 2004 13:32:14 -0300 (EST) (envelope-from >Janis(a)tonightafter.com) >Received: from CB2790413 (modemcable76.3-14.h.yahoo.com >[104.92.164.94]) > (authenticated bits=5) by yahoo.com (8.12.10/8.12.9) with ESMTP id > JSN20ruz28I294295 for <bizbox(a)npower.com>; Fri, 28 May >2004 15:31:14 > -0100 (EST) (envelope-from Janis(a)tonightafter.com) >Message-ID: ><24163mv103bhg9$p099VO137sg38$81VOT691LRT3@yak19370990924877> >From: "Lula French" <Janis(a)tonightafter.com> >To: <Bizbox> >Subject: RE: tempted by love? >Date: Fri, 28 May 2004 11:31:14 -0500 >MIME-Version: 1.0 >Content-Type: multipart/alternative; boundary="--15104472402585470068" > >----15104472402585470068 >Content-Type: text/plain >Content-Transfer-Encoding: 7Bit > >----15104472402585470068-- > >---------------------------------------- > >

2 1

RE: [SURBL-Discuss] OT: RBL needed!
by Chris Santerre 28 May '04

28 May '04

>-----Original Message----- >From: Doc Schneider [mailto:maddoc@maddoc.net] >Sent: Friday, May 28, 2004 9:55 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] OT: RBL needed! > > >This Off topic but figured most of us all get hit with this stuff. > >I am in need of a bit of help. > >I got a whole bunch of open relays doing rumpelstiltskin(sic) >attacks on >both my main mailserver and my seconary MX server... hitting the >secondary and making it throttle the main one. > >Anyway is there a way to use some of these RBLs to basically >deny these >open relays to be able to even attempt these attacks? > >I'm running Sendmail 8.12.11 on Linux... both these boxen run RH 6.2 >and are really locked down against other attacks. > >I use to just drop routes to these idiots but never a good solution >IMNSHO 8*) > >I looked through the sendmail FAQs and didn't find anything that was >helpful. > >Any idea would be more then welcome. > Did you mean something like sorbs.net? http://www.dnsbl.us.sorbs.net/using.html See the Zones Available towards the bottom. HTH, Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss