- Discuss - Mailman 3

Re: [Possible Spam] New Redirector?
by Carl Hutzler 08 May '04

08 May '04

Yes, we are aware of it and working to shut it down. It is not easy at all due to how the system works (as is the case with many redirector URLs). Feel free to block the URL completely. It is only serving ads for AOL partners really. Should not be a big problem if you can block URLs in your antispam SW. -Carl david(a)platformnetworks.net wrote: >============================================================================== > MAIL SECURITY MESSAGE >============================================================================== > >Mail Security is not 100% sure if the attached message is spam or not and >needs your help to decide. > > >How to help: >-------------------------- >If the attached message is not spam, please forward this email to >notspam(a)mailsecurity.net.au so we can correct our database, which will >stop future messages of this type from being intercepted. > >If the attached message is spam, please delete this message and future >messages like this will be blocked. > >Attached Message Details: >-------------------------- >From: david(a)platformnetworks.net >Subject: New Redirector? > >Thankyou for your help, your assistance helps us to keep our databases as >up to date as possible. >-- >Kind Regards, > >Mail Security >www.mailsecurity.net.au > > >======================================================================== > Pain free spam & virus protection by: www.mailsecurity.net.au > Forward undetected SPAM to: spam(a)mailsecurity.net.au >======================================================================== > > > > > ------------------------------------------------------------------------ > > Subject: > New Redirector? > From: > "David Hooton" <david(a)platformnetworks.net> > Date: > Fri, 7 May 2004 15:38:40 +1000 > To: > <discuss(a)lists.surbl.org> > > > Hi All, > > Just found an AOL redirector being abused in a spam: > >http://www.aol.com/ams/clickThruRedirect.adp?1= > >073757372,2147618210x2147531923,http://www.freeyouraccounts.com/stressfree/= > > Not sure if it’s included in the SURBL/SpamCopURI redirector list yet > or not – is this published anywhere? > > Regards, > > David Hooton > > Senior Partner > > Platform Networks > > www.platformnetworks.net > -- Carl Hutzler Director, AntiSpam Operations America Online Mail Operations cdhutzler(a)aol.com 703.265.5521 work 703.915.6862 cell

2 1

Re: [SURBL-Discuss] Should bravemouser.com be blacklisted?
by Jeff Chan 08 May '04

08 May '04

On Friday, May 7, 2004, 3:08:13 PM, ITReading ITReading wrote: >>>> Jeff Chan <jeffc(a)surbl.org> 05/07/2004 4:45:22 PM >>> >>I don't see any reports about it to SpamCop. You may want to >>do that. > That's interesting. I submit all my "false negatives" to > Spamcop. I know I've submitted at least a dozen or so ". . . > bravemouser.com . ." messages. When I tried processing your message I got the message from SpamCop saying ~"ISP says problem will cease". So the ISP is presumably working on it. Let me know if the spam continues, and I'll add bravemouser.com to my manual blacklist. Jeff C.

1 0

Should bravemouser.com be blacklisted?
by ITReading ITReading 07 May '04

07 May '04

Hello all, I continue to receive messages with URIs to "bravemouser.com" in the past few weeks. Should this domain be added to one of the surbl lists? Most of the messages are TV Pay Per View spam. An example of one of the messages can be found here: http://www.aldridge-borden.com/bravemouser.txt -Charles Solomon

2 1

Fwd: URI's not recognized
by Jeff Chan 07 May '04

07 May '04

This is a forwarded message From: Menno van Bennekom <mvbengro(a)xs4all.nl> To: spamassassin-users(a)incubator.apache.org Date: Friday, May 7, 2004, 3:35:37 AM Subject: URI's not recognized ===8<==============Original message text=============== Hi, I have problems getting URI's recognized by SpamAssassin 2.63 (postfix/amavisd-new). At first redirects like this were not recognized: http://rd.yahoo.com*http://spammer.spam.biz So I removed ^ from the BIZ expression: uri BIZ_TLD /(?:https?:\/\/|mailto:)[^\/]+\.biz(?:\/|$)/i Still the following was not recognized: <a href=3Dhttp://away.goingabroadd.biz/aps/cms/> Because of the 3D (and other stuff spammers put there lately). Only by changing 'uri BIZ_TLD' to 'body BIZ_TLD' it gets recognized. But I use SpamCopURI and that also doesn't recognize URI's with things in front of http. And I can't tell SpamCopURI to use the 'body' check instead or uri.. How can I make the URI subroutine recognize these URI's? Would using SpamAssassin v3.0 help? Thanks Menno ===8<===========End of original message text===========

3 2

Make test problems in 0.15
by Brian Ipsen 07 May '04

07 May '04

Hi, When doing "make test" with 0.15 I get: t/blacklist........ok t/dnsrbl...........ok t/extract_urls.....ok t/mailto...........ok t/open_redirect....ok 5/6# Failed test (t/open_redirect.t at line 71) t/open_redirect....NOK 6# Looks like you failed 1 tests of 6. t/open_redirect....dubious Test returned status 1 (wstat 256, 0x100) DIED. FAILED test 6 Failed 1/6 tests, 83.33% okay t/spamcopuri.......ok t/whitelist........ok Failed Test Stat Wstat Total Fail Failed List of Failed ---------------------------------------------------------------------------- --- t/open_redirect.t 1 256 6 1 16.67% 6 Failed 1/7 test scripts, 85.71% okay. 1/42 subtests failed, 97.62% okay. Is a module missing - or need to be updated ?? /Brian

3 2

New Redirector?
by David Hooton 07 May '04

07 May '04

Hi All, Just found an AOL redirector being abused in one of our spamtraps.. The url is on www.aol.com/ams/clickThruRedirect.adp If you need an exact copy of it I can provide it. Not sure if its included in the SURBL/SpamCopURI redirector list yet or not is this published anywhere? Regards, David Hooton Senior Partner Platform Networks www.platformnetworks.net ======================================================================== Pain free spam & virus protection by: www.mailsecurity.net.au Forward undetected SPAM to: spam(a)mailsecurity.net.au ========================================================================

3 4

ANNOUNCE: Mail::SpamAsssassin::SpamCopURI 0.15
by Eric Kolve 07 May '04

07 May '04

I have just released SpamCopURI 0.15. I have fixed a few bugs that were reported and also added some url extraction so open_redirect resolution isn't need any longer for urls that redirect through google.com, msn.com, yahoo.com or any site that redirects based on a url being passed in the query or path portion. The install *should* be smoother. The Makefile.PL now attempts to detect where SpamAssassin was installed and place itself in that directory. See the Changes file for a complete list. https://sourceforge.net/projects/spamcopuri/ --eric

2 1

[SURBL-Discuss] Fwd: Re: svn commit: rev 10552 - in incubator/spamassassin/trunk: lib/Mail/SpamAssassin t t/data/spam
by Jeff Chan 07 May '04

07 May '04

Justin points out a feature that would be nice to back-port into SA 2.63.... From: Justin Mason To: spamassassin-users Date: Thursday, May 6, 2004, 9:50:17 PM Subject: svn commit: rev 10552 - in incubator/spamassassin/trunk: lib/Mail/SpamAssassin t t/data/spam Justin writes: > Author: jm > Date: Thu May 6 21:36:42 2004 > New Revision: 10552 > > Modified: > incubator/spamassassin/trunk/lib/Mail/SpamAssassin/Util.pm > incubator/spamassassin/trunk/t/data/spam/009 > incubator/spamassassin/trunk/t/uri.t > Log: > spam spotted in wild evading URIBL, so deal with several URI obfuscations: http://0x425c45de/, http://66.92.0x45.221/, http://1113343455/, http://slashdot.org@1113343456/ in get_uri_list Jeff C et al -- I'm not sure how the SpamAssassin 2.63 code deals with this, but I'd suspect it'd miss those URLs... I've just checked in a fix in 3.0.0, so it might be worth porting it over. - --j.

1 0

RE: Bug in Spamcop's surbl add-on module
by Chris Santerre 07 May '04

07 May '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, May 05, 2004 4:52 PM >To: SURBL Discuss >Cc: spamassassin-users(a)incubator.apache.org >Subject: Re: Bug in Spamcop's surbl add-on module > > >On Wednesday, May 5, 2004, 1:03:15 PM, Chris Santerre wrote: > >>>From: Jeff Chan [mailto:jeffc@surbl.org] >>>bigevil.domains:e.1asphost.com >>> >>>However we should be taking off the subdomain before it goes into >>>the SURBL form. I'll need to check with Chris on how we can >>>handle that. > >> It's not a bug, its a feature! Actually, no its a bug :) I >have been going >> thru cleaning these sort of things up. However I started at >the begining of >> the B.E. list. This is at rule 181, I haven't even got to >100 yet! This is >> left over from my alpha phase of B.E. I've had a lot more >coffee since then. > >Hi Chris, >Would you mind if I added a quick regex to remove and third or >higher level domains from .com, .biz, .net, .info, etc. from >domains before they go into be? It wouldn't be perfect but >it could help some. > >In other words trim down e.1asphost.com to 1asphost.com (etc) >in my own data munging? > >Jeff C. Jeff my friend, nothing would make me happier :) OK, maybe if you sent me some models bearing beer to ask me. That might be a little better. But baring that, sure :-) --Chris

5 7

Installation Problems of SpamCopURI on RH9
by Ilan Aisic 06 May '04

06 May '04

Hi, I just wanted to report that yesterday I've installed SpamCopURI 0.14 on RedHat 9 with SA 2.63. On first try, running "perl Makeifle.PL" did not work. Apparently, it wanted Mail/SpamAssassin to be on perl 5.8.0 but it was deployed on 5.6.1. After I created a symlink as follows (watch for line breaks): >>> lrwxrwxrwx 1 root root 13 May 5 20:00 /usr/lib/perl5/site_perl/5.8.0/Mail -> ../5.6.1/Mail <<< I proceeded installing SpamCopURI without a problem. I thought that other RH users may encounter the same problem. Regards, -- Ilan Aisic Pointer Software Systems, Ltd.

2 1

Got these errors
by Doc Schneider 06 May '04

06 May '04

I get usual log events sent to me and notice this one. There was just this one that I saw. May 6 01:33:21 newmail spamd[25105]: Failed to run WS_URI_RBL SpamAssassin test, skipping: ^I(Modification of non-creatable array value attempted, subscript -1 at /usr/local/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/SpamCopURI.pm line 179, <GEN15147> line 175. ) May 6 01:33:21 newmail spamd[25105]: Failed to run SPAMCOP_URI_RBL SpamAssassin test, skipping: ^I(Modification of non-creatable array value attempted, subscript -1 at /usr/local/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/SpamCopURI.pm line 179, <GEN15147> line 175. ) May 6 01:33:21 newmail spamd[25105]: Failed to run BE_URI_RBL SpamAssassin test, skipping: ^I(Modification of non-creatable array value attempted, subscript -1 at /usr/local/lib/perl5/site_perl/5.8.2/Mail/SpamAssassin/SpamCopURI.pm line 179, <GEN15147> line 175. ) -- -Doc --- MomNDoc Online Consultants http://www.maddoc.net/ momndoc(a)maddoc.net

2 2

form-type URIs correctly extracted?
by Jeff Chan 06 May '04

06 May '04

I've spotted a couple form-enclosed URIs lately, such as: <FORM action=3dhttp:// www =2e seo500 =2e com/submit2=2ephp=20 method=3dpost> (without the spaces in the URI) Wanted to sanity check that urirhsbl and SpamCopURI are both finding these correctly. Can anyone confirm? (Yeah I know I should just read the sources.... ;-) TIA, Jeff C.

1 0

List of yahoo domains?
by Jeff Chan 06 May '04

06 May '04

Does anyone have a list of all the world Yahoo domains? If so would you please forward them to me? Same for any other large, legitimate operations with different names like these. TIA, Jeff C.

1 0

ct.mailresponses.com
by Chris Santerre 05 May '04

05 May '04

I found this link in a bunch of spam. However it may be a shammer. ct.mailresponses.com Thoughts? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

RE: Bug in Spamcop's surbl add-on module
by Chris Santerre 05 May '04

05 May '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, May 05, 2004 8:26 AM >To: spamassassin-users(a)incubator.apache.org >Cc: SURBL Discuss >Subject: Re: Bug in Spamcop's surbl add-on module > > >On Wednesday, May 5, 2004, 5:18:04 AM, Keith Hackworth wrote: >> I was installing >> a new mail server and testing the surbl lookups, but my test kept >> getting through not being marked as spam. The test I was using was >> http://e.1asphost.com - this is on the be.surbl.org list. ... >> My logs show that the >> system is looking up 1asphost.com, which is NOT on the list. > For some >> reason, it stripped off the "e." > >> It seems that spamcop's surbl doesn't handle subdomains at >all. Anyone >> else seeing this? > >Hmm, it is indeed in BigEvil with the e. : > >bigevil.cf:uri BigEvilList_181 >/\b(?:extreme-rapes\.com|excaliburproducts\.c >om|evansezmoney\.estarnetwork\.com|enjoyadvanced097\.org|emedor >ders\.com|email\. >homemadesimple\.com|ehostzzz\.net|e-g\.com|efreedomweb\.net|ecr >edibledeals\.com| >echofrompeople\.com|e\.1asphost\.com)\b/i > >and it's therefore making it into be.surbl.org with the e. : > >bigevil.domains:e.1asphost.com > >However we should be taking off the subdomain before it goes into >the SURBL form. I'll need to check with Chris on how we can >handle that. > >BTW, SURBL is not a SpamCop project, although we are using >SpamCop URI domains as a data source in the sc.surbl.org list. > >Jeff C. It's not a bug, its a feature! Actually, no its a bug :) I have been going thru cleaning these sort of things up. However I started at the begining of the B.E. list. This is at rule 181, I haven't even got to 100 yet! This is left over from my alpha phase of B.E. I've had a lot more coffee since then. So I will fix that one, But I'm sure there are others ;) --Chris

2 1

[SURBL-Discuss] Re: Proposal to add some anti-phishing data to SURBL
by Jeff Chan 05 May '04

05 May '04

On Wednesday, May 5, 2004, 7:02:45 AM, Smart,Dan Smart,Dan wrote: > Would love to have this made available. I'm surprised this list isn't more > focused on the Phishing issues. Spam is a nuisance, while Phishing can > bring *REAL* damage and loss of privacy. > I, for one, would love such an anti-phishing SURBL. Thanks for the feedback Dan. I agree phishing is probably more potentially damaging that other spams. We should be getting the data into a SURBL, either as part of ws.surbl.org and/or perhaps a future combined list. Jeff C. __ > <<Dan>> > | How do people feel about adding this data to a public SURBL? > | Does this kind of division of free and commercial uses seem > | ok? Would any of the SURBL public name servers have any > | issues with an arrangement like this?

1 0

RE: [SURBL-Discuss] Stupid SPAM
by Chris Santerre 05 May '04

05 May '04

>-----Original Message----- >From: Jose-Marcio.Martins(a)ensmp.fr >[mailto:jose-marcio.martins@ensmp.fr] >Sent: Wednesday, May 05, 2004 3:47 PM >To: SURBL Discussion list >Subject: [SURBL-Discuss] Stupid SPAM > > > > >Hello, > >Take a look at this SPAM : > > http://www.ensmp.fr/~martins/Prozac > >Mainly, check the source. > >The problem is that it comes with many, many URLs. At the beginning, >there are URLs needed by the SPAM itself. After, it puts many >URLs with >font size equals to 1. Most of these last domains aren't spam... 8-) > >Jose-Marcio > Ah it feels like I'm wraped in a warm URL blanket :) Yeah I've been seeing these for a long time when they tried to get around bigevil. This is one of the reasons I got rid of using scripts to pull out URLs. I believe SA 3.0 will handle these correctly. SURBL is touched by a human. So these things get picked up quick. But common users trying to submit these other URLs is where the time consumption will be. :( Show that we kind of have the spammers by the booboo now :P --Chris

1 0

Re: Bug in Spamcop's surbl add-on module
by Jeff Chan 05 May '04

05 May '04

On Wednesday, May 5, 2004, 5:18:04 AM, Keith Hackworth wrote: > I was installing > a new mail server and testing the surbl lookups, but my test kept > getting through not being marked as spam. The test I was using was > http://e.1asphost.com - this is on the be.surbl.org list. ... > My logs show that the > system is looking up 1asphost.com, which is NOT on the list. For some > reason, it stripped off the "e." > It seems that spamcop's surbl doesn't handle subdomains at all. Anyone > else seeing this? Hmm, it is indeed in BigEvil with the e. : bigevil.cf:uri BigEvilList_181 /\b(?:extreme-rapes\.com|excaliburproducts\.c om|evansezmoney\.estarnetwork\.com|enjoyadvanced097\.org|emedorders\.com|email\. homemadesimple\.com|ehostzzz\.net|e-g\.com|efreedomweb\.net|ecredibledeals\.com| echofrompeople\.com|e\.1asphost\.com)\b/i and it's therefore making it into be.surbl.org with the e. : bigevil.domains:e.1asphost.com However we should be taking off the subdomain before it goes into the SURBL form. I'll need to check with Chris on how we can handle that. BTW, SURBL is not a SpamCop project, although we are using SpamCop URI domains as a data source in the sc.surbl.org list. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

[SURBL-Discuss] Fwd: Re[2]: Proposal to add some anti-phishing data to SURBL
by Jeff Chan 05 May '04

05 May '04

This is a forwarded message From: Robert Menschel To: SpamAssassin Developers <spamassassin-dev(a)incubator.apache.org> Date: Tuesday, May 4, 2004, 7:06:25 PM Subject: Proposal to add some anti-phishing data to SURBL Tuesday, May 4, 2004, 9:42:14 AM, Marc wrote: MP> For what it is worth - I support it. I definitely want to block MP> exposure to fraud of my users. Agreed. The Phishing SURBL sounds like a good idea to me. I see no conflict with a company doing commercial work also offering a public service. Bob Menschel MP> Jeff Chan wrote: >>David Hooton of Platform Networks has been converting the >>proprietary SpamAssassin message content filtering rules of >>MailSecurity.net.au into SURBLs. The data's being organized into >>separate SURBLs, for example pharma, phishing, and other spams. >>In order to give something back to the SURBL/SA community and the >>Internet in general, he is proposing to make the phishing data >>freely available for potential inclusion by Bill Stearns in >>ws.surbl.org. ...

1 0

[SURBL-Discuss] Fwd: Re: Proposal to add some anti-phishing data to SURBL
by Jeff Chan 04 May '04

04 May '04

This is a forwarded message From: Marc Perkel Date: Tuesday, May 4, 2004, 9:42:14 AM Subject: Proposal to add some anti-phishing data to SURBL For what it is worth - I support it. I definitely want to block exposure to fraud of my users. Jeff Chan wrote: >David Hooton of Platform Networks has been converting the >proprietary SpamAssassin message content filtering rules of >MailSecurity.net.au into SURBLs. The data's being organized into >separate SURBLs, for example pharma, phishing, and other spams. >In order to give something back to the SURBL/SA community and the >Internet in general, he is proposing to make the phishing data >freely available

1 0

Proposal to add some anti-phishing data to SURBL
by Jeff Chan 04 May '04

04 May '04

David Hooton of Platform Networks has been converting the proprietary SpamAssassin message content filtering rules of MailSecurity.net.au into SURBLs. The data's being organized into separate SURBLs, for example pharma, phishing, and other spams. In order to give something back to the SURBL/SA community and the Internet in general, he is proposing to make the phishing data freely available for potential inclusion by Bill Stearns in ws.surbl.org. Access to the other lists would be sold commercially, but the phishing data would be a potentially useful spam/fraud/crime fighting tool to make available to everyone, while hopefully creating some recognition for their other lists. A preliminary web page describing the phishing list is at: http://www.mailsecurity.net.au/phish/ Dave describes the status of the phishing list as public in that: "We're going to release our phishing attack list publicly and it will remain that way for the duration of it's life. The only attachment to my business will be that we use it as well & that it will be maintained by my staff." The site will get a phishing spam form added for public submissions before it goes live. Their phishing data sources include spamtraps and feeds from other organizations. Dave asked me to bring up this idea for some discussion and feedback, and he's on these lists so feel free to reply here. How do people feel about adding this data to a public SURBL? Does this kind of division of free and commercial uses seem ok? Would any of the SURBL public name servers have any issues with an arrangement like this? Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

4 11

Re: [SURBL-Discuss] Proposal to add some anti-phishing data to SURBL
by Doc Schneider 04 May '04

04 May '04

Jeff Chan <jeffc(a)surbl.org> wrote .. > On Tuesday, May 4, 2004, 2:03:11 AM, Raymond Dijkxhoorn wrote: > >> I think the intention was for our data to be integrated directly into > >> William's prior to arriving at nameservers, however Jeff is more likely > to > >> be able to confirm this :) > > > That would be perfect, saves the trouble of making a seperate list. > > > Would only be nice for example to give a specific code back, so people > see > > what the hit triggered... But thats possible, we only need to reserve > a > > code in that case. > > It's pretty certain we will want to do a combined list of at > least ws and sc. As an alternative to Bill merging a phishing > list into ws, we could add it to a combined list and *not* have > it as a small, separate list. (In other words it would obly > be available in a combined list.) If we do the latter we could > probably give it a unique result value. > > Either way is possible (i.e. merge into ws, or merge into a > combined list.): > > 1. Merge into ws: probably no specific code for phishing > 2. Merge into combined list: could have a separate code > 2a. (With no separate list for phishing if it's small.) > Jeff, I vote we make a new one called GonePhising.surbl.org 8*) I mean with all these Sasser and various M$ worms on the loose only makes send eh? -Doc (Da-Joker-Ninja) ps. Of course I wasn't being serious!!!!

1 0

[SURBL-Discuss] RE: NEWS: Metamark.net URI shortening and redirection service usi ng SURBL data to deny spammers
by Chris Santerre 03 May '04

03 May '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Saturday, May 01, 2004 12:58 AM >To: SURBL Announce >Cc: SpamAssassin Users; SpamAssassin Developers >Subject: NEWS: Metamark.net URI shortening and redirection >service using >SURBL data to deny spammers > http://www.surbl.org/news.html > >Ask Bjørn Hansen of develooper.com is using SURBL data to block >spammer domains in the Metamark Shorten(tm) Service URI shortening >and redirection service. This is the first use of SURBL data to >prevent abuse of a redirection site that we've heard of! Great >going! CONGRATS!! Forward progress always feels good! --Chris

1 0

RE: [SURBL-Discuss] This ROCKS!
by Chris Santerre 03 May '04

03 May '04

>-----Original Message----- >From: Daniel Quinlan [mailto:quinlan@pathname.com] >Sent: Friday, April 30, 2004 9:13 PM >To: Chris Santerre >Cc: 'SURBL Discussion list'; SpamAssassin-dev(a)incubator.apache.org >Subject: Re: [SURBL-Discuss] This ROCKS! > > >Chris Santerre <csanterre(a)MerchantsOverseas.com> writes: > >> Hey there guys! This was the crazy idea I was discussing >with Doc. I wished >> for a realtime form of DB or flat file to be updated >continuously on rule >> hits. No grepping thru logs or anything. Simply when an >email is sent thru >> SA, whatever rules hit, increase a counter in a db or flat >file for that >> rule. Seperate db or flat file for ham and spam. This gives >live stats on a >> system. No grep'n going on. Just a counter per rule. > >That might give you a good hit rate, but it won't give you an accurate >S/O number. Well if it counts spam and ham hits, then an S/O is but a division away ;) > >> This is to be used on some advanced rule writing we want to >work on. It also >> alows an admin to see what might not be worth keeping >around. Allowing them >> to remove poor performers and increase system speed. > >Sort of like http://www.pathname.com/~corpus/DETAILS.new ? Sort of. I didn't know you guys did that nightly. Very nice. I'm looking for a more localized process that doesn't require a run of anything. Having counters generated means just checking totals. And even if one didn't use the exact same rules as another, they could easily combine totals for the ones they do. However your method is more accurate. > >The corpora have to be sorted by humans to be accurate and runs need to >be synchronized so everyone tests the same rules so runs only happen >once a day, which is fast enough. > >We've been doing this for well over a year and it works great. If only >we had more active developers working on rules... I'm not quite sure how to take that last line. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin Charles Darwin

2 1

[SURBL-Discuss] Sendmail milter and SURBLs? sbl.spamhaus.org and SpamCopURI or urirhsbl?
by Jeff Chan 03 May '04

03 May '04

Saw a link on the Spamhaus site to a sendmail milter: http://www.five-ten-sg.com/dnsbl.html "This milter will also decode (base64, mime, html entity) and scan for HTTP and HTTPS URLs and bare hostnames in the body of the mail. If any of those host names have A records on the SBL (or a single configurable list), the mail will be rejected unless previously whitelisted." Seems to me that should be just as usable with SURBLs as the more limited spam body domain names in sbl.spamhaus.org. Has anyone tried this milter with SURBLs? Conversely has anyone tried sbl.spamhaus.org as a SURBL in SpamCopURI or urirhsbl? Either could be interesting.... Jeff C. Additionally: Installation and configuration Usage: Note that this has ONLY been tested on Linux, specifically RedHat Linux. In particular, this milter makes no attempt to understand IPv6. Your mileage will vary. You will need at a minimum a C++ compiler with a minimally thread safe STL implementation. The distribution includes a test.cpp program. If it fails this milter won't work. If it passes, this milter might work. Fetch dnsbl.tar.gz and tar xfvz dnsbl.tar.gz bash install.bash

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss