- Discuss - Mailman 3

packaging SpamCopURI
by Robert Brooks 26 Apr '04

26 Apr '04

Hi, I've packaged SpamCopURI, but these files clash with SpamAssassin files. /usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Conf.pm /usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/PerMsgStatus.pm I assume that these normally replace the originally install SpamAssassin files. Is this correct, and if so should I look at adding SpamCopURI to my SpamAssassin package. Regards, Rob -- Robert Brooks, Network Manager, Hyperlink Interactive Ltd <robb(a)hyperlink-interactive.co.uk> http://hyperlink-interactive.co.uk/ Tel: +44 (0)20 7240 8121 Fax: +44 (0)20 7240 8098 - Help Microsoft stamp out piracy. Give Linux to a friend today! -

4 11

[SURBL-Discuss] Re: [spa] Re: Getting SURBL to deal with obfuscated URLs
by Jeff Chan 25 Apr '04

25 Apr '04

On Sunday, April 25, 2004, 11:55:33 AM, Charles Gregory wrote: > In the case of the '.ca' TLD (www.circa.ca), the original hierarchical > structure was: domain.city.prov.ca (eg fleanet.hamilton.on.ca). > The 'ca' registry has since been opened up and many new '.ca' domains > have the normal 2nd level format. But the registry still permits 3rd and > 4th level domains under the exsiting provincial and municipality levels. > I have no idea what safegaurds are in place, if any, to prevent spammers > from trying to register fourth level domains. I expect all they would have > to do is have a registered place of business in the municipality. > I do know that the named province/municipality does *not* have any control > over the assignments. Both two and three level domain cases are handled where the two level domains can be anything.ca that are not listed as a known geographic TLD like on.ca (for Ontario province) and where the three level domain would be under a known two level TLD such as anything.on.ca. A fourth level geographic domain, for example under a city name, may not be handled properly, but could be added. If we drive spammers to be desperate enough to use those then we've already had great success. :-) Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

More news on unparsed urls
by John Fawcett 25 Apr '04

25 Apr '04

I have tested SpamCopURI 0.14 and SA 2.63 with my collection of unparsed urls. This new version deals with many of the cases, so that the ugly workarounds I was using can be removed. By the way, if you're reading this Eric, it might be worthwhile adding ads.msn.com and g.msn.com to the list of known redirection services in the sample spamcop_uri.cf. Here are the cases that are not picked up: 1. URLs that aren't URLs (missing protocol, even missing www ) <p> P<advisory>l<aboveboard>e<compose>a<geochronology>s<moral>e<palfrey> <rada= r>c<symptomatic>o<yankee>p<conduit>y<souffle> <intake>a<arise>n<eocene>d <= thickish>paste <impact>this <broadloom>link <road>i<dichotomous>n<quinine>= t<scoreboard>o y<eager>o<impact>ur b<archenemy>r<band>o<wallop>wser <b> he= althyexchange.biz</b> 2. Double protocol http://http://www.eager-18.com/_7953f10b575a18d044cdec5a40bd4f22//?d=vision Workaround in PerMsgStatus.pm $uri =~ s/http:\/\/http:\/\//http:\/\//gi; (NB from the previously published workaround I added case insensitivity) 3. HTML escape sequences in URL http://toform.net/mcp/879/1352/cap112.html Workaround in PerMsgStatus.pm $_ = HTML::Entities::decode($_); use HTML::Entities; (NB from the previously published workaround this is different because it does the conversion earlier on and so takes into account that http could also be coded with escape sequences. It seems to work despite the comment to not modify $_ in get_uri_list.) Here's a diff of PerMSgStatus.pm with SpamCopURI 0.14 compared to the version with the workarounds mentioned above. John diff -u PerMsgStatus.pm.orig PerMsgStatus.pm -----------cut------------- --- PerMsgStatus.pm.orig 2004-04-25 12:50:05.000000000 +0200 +++ PerMsgStatus.pm 2004-04-25 13:01:11.000000000 +0200 @@ -44,6 +44,7 @@ use Mail::SpamAssassin::Conf; use Mail::SpamAssassin::Received; use Mail::SpamAssassin::Util; +use HTML::Entities; use constant HAS_MIME_BASE64 => eval { require MIME::Base64; }; @@ -1748,6 +1749,7 @@ for (@$textary) { # NOTE: do not modify $_ in this loop + $_ = HTML::Entities::decode($_); while (/($uriRe)/go) { my $uri = $1; @@ -1776,6 +1778,7 @@ $uri = "${base_uri}$uri"; } } + $uri =~ s/http:\/\/http:\/\//http:\/\//gi; # warn("Got URI: $uri\n"); push @uris, $uri; -----------------cut---------------

1 0

domains that roll out of sc.surbl.org
by John Fawcett 24 Apr '04

24 Apr '04

Just a thought: given the dynamic nature of the sc.surbl.org data, it might be useful to have a listing history for the SURBL+ checker (http://www.rulesemporium.com/cgi-bin/uribl.cgi) Something along the lines of domain xxxx currently (listed|notl listed) in sc.surbl.org - added ddmmyyyy hhmm - removed ddmmyyyy hhmm - added ddmmyyyy hhmm - removed ddmmyyyy hhmm This way it would be possible to check whether old domains are being left dormant until they work their way out of the list and then being resurrected later on. Another thought was to make a separate historic list of domains that are removed from sc.surbl.org when there are no new reports. People who want to do more aggressive filtering could also use the historic list in addition to the other lists. The risk of FPs is still low because I can't forsee there being many "reformed" spammer domains. John

2 1

RE: [RulesEmporium] Rbldns and wildcards
by Dallas L. Engelken 24 Apr '04

24 Apr '04

> Indeed, I just realized an embarrassing screw-up on my part. > > There are two different programs with similar names and > slightly different properties,including zone file differences: > > rbldns > > rbldnsd > > We are using rbldnsd zone files. I need to update the web site > to reflect this and post an announcement. > As am I.. I guess I didn't realize there was a rbldns either... In rbldnsd, you can wildcard domains... From # man rbldnsd dnset Set of (possible wildcarded) domain names with associated A and TXT values. Similar to ip4set, but instead of IP addresses, data consists of domain names (not in reverse form). One domain name per line, possible starting with wildcard (either with starâdot (*.) or just a dot). Entry starting with exclamation sign is exclusion. Default value for all subsequent lines may be specified by a line starting with a colon. Wildcards are interpreted as follows: example.com only example.com domain is listed, not subdomains thereof. Not a wildcard entry. *.example.com all subdomains of example.com are listed, but not examâ ple.com itself. .example.com all subdomains of example.com and example.com itself are listed. This is a shortcut: to list a domain name itself and all itâs subdomains, one may either specify two lines (example.com and *.example.com), or one line (.examâ ple.com). Instead of listing FQDN's, why not just list the TLD with a dot in front... For example, list .mailnotice.biz instead of t.mailnotice.biz in case they change to some other letter in front of their TLD. Dallas

2 1

rbldnsd and rsync'ing
by Roger WJ Alterskjær 24 Apr '04

24 Apr '04

Hi all! I've successfully installed rbldnsd and want to set it up along with rsync'ing of sc/ws/be.surbl.org. My question is how to set up the RBLDNSD variable in /etc/sysconfig/rbldnsd and the rsync crontab. So far I've got a tip on rsync: Rsyncing is very easy. You would set up a cron job to call something like: rsync RSYNC_SERVER_NAME_GOES_HERE::surbl/sc.surbl.org.rbldns . Seams simple enough. It's just that darn rbldnsd variable that's got me confused. -- Mvh, Roger WJ Alterskjær Edb-konsulent Vitenskapsmuseet, NTNU

1 0

Fwd: Re: Goofy domain names
by Jeff Chan 24 Apr '04

24 Apr '04

From: Jeff Chan To: spamassassin-users Date: Friday, April 23, 2004, 3:28:49 PM Subject: Goofy domain names ===8<==============Original message text=============== On Friday, April 23, 2004, 7:38:46 AM, Chris Santerre wrote: > This is where BigEvil may start going. I can change mine in 2 secs to use > /\d00\dhosting/ but as soon as I do that, it will be removed from > be.surbl.org. For obvious reasons they can't use wildcards. All signs point > to me changing bigevil over to search for this kind of stuff, and simply add > any static ones I have to ws.surbl.org. But will see. This is where our philosophies clash slightly. SURBLs just want a list of known spam domains. SA rulesets with wildcards try to match entire possible/probable classes of domain names based on observing prior types of variation. Both approaches have their merits. For my purposes, I'd just prefer to get the domains that have already been found in spam. I acknowledge that that doesn't have the predictive value of the class approach, but it also makes FPs less possible in principle. (Though in reality it's not very likely that any legitimate sites are suddenly going to start using rxmeds1.com, rxmeds2.com, rxmeds3.com, etc.) Jeff C. ===8<===========End of original message text===========

3 4

Re: [RulesEmporium] Rbldns and wildcards
by Jeff Chan 24 Apr '04

24 Apr '04

Indeed, I just realized an embarrassing screw-up on my part. There are two different programs with similar names and slightly different properties,including zone file differences: rbldns rbldnsd We are using rbldnsd zone files. I need to update the web site to reflect this and post an announcement. Jeff C. __ On Friday, April 23, 2004, 4:23:48 PM, Chris Santerre wrote: > not sure so I've cc'd the big guy on this one. >>-----Original Message----- >>From: Dallas L. Engelken [mailto:dallase@nmgi.com] >>Sent: Friday, April 23, 2004 4:27 PM >>To: >>Subject: [RulesEmporium] Rbldns and wildcards >> >> >>What is the recommended 'type' of zone for running bigevil via rbldns.. >>'dnset' ? >> >>If dnset is recommended, why arent a lot of the entries in be.surbl.org >>listed as >> >>.domain.com instead of domain.com to cover the TLD and all sub domains? >>I probably missed this discussing didn't I.... >> >> -- Jeff Chan mailto:jeffc@surbl.org-nospam http://www.surbl.org/

1 1

[SURBL-Discuss] Re: [SURBL-Announce] ANNOUNCE: The SARE SURBL+ Checker v0.4
by Ralph Seichter 24 Apr '04

24 Apr '04

> [Linked from the surbl site also... -- Jeff C.] Ok Jeff, you caught me in the middle of a mail asking for this "lookup link", so where is the web cam you installed? ;-) -- Mit freundlichen Grüßen / Yours sincerely Dipl. Inform. Ralph Seichter HORUS-IT Ahornweg 10 D-57635 Oberirsen Tel +49 2686 987880 Fax +49 2686 987889 http://horus-it.de/

2 1

[SURBL-Discuss] Re: [SURBL-Announce] ANNOUNCE: Mail::SpamAsssassin::SpamCopURI 0.11
by Jeff Chan 24 Apr '04

24 Apr '04

On Tuesday, April 20, 2004, 10:51:55 PM, Eric Kolve wrote: > I have just released SpamCopURI version 0.11. This fixes a few > bugs that had been reported and adds open redirect resolution. > This basically takes a URL from say rd.yahoo.com and attempts > to resolve the Location header without ever fetching from > the potential spammy site. > Only the URLs that have hosts that match an address list get > redirect resolution. As well, redirect resolution is off > by default, but can be enabled in the conf file. I have > placed several open redirect sites in the conf file. > The basic requirement is that the redirect return a 300 > level HTTP response when fetching. I placed google.com > in there even though they don't have their own redirect > domain, but this should be fairly safe since most if not > all google URLs are either redirects or searches. Give > it a try and tell me what you think. This is all dependent > upon LWP, but if you don't have LWP everything else > will function as it did before. Eric, you may want to share your redirection resolution strategies with the 3.0 developers. I haven't heard Justin getting beyond patterns yet. ;-) Jeff C.

3 5

RE: [SURBL-Discuss] How effective is SURBL?
by Chris Santerre 23 Apr '04

23 Apr '04

I use sa-stats.pl It isn't like what I'm talking about. Working with the SA devs to keep an outputed DB of score hits. Not logging each hit. But updating a counter. --Chris >-----Original Message----- >From: Doc Schneider [mailto:maddoc@maddoc.net] >Sent: Friday, April 23, 2004 3:35 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] How effective is SURBL? > > > > >Chris Santerre wrote: > >>>>What tools are people using to see what are the most hit rulesets? >>> >>>I've been thinking of writing a tool to check out some of >>>those rulesets >>>the spammy crap hits on. >>> >>>Figured if nothing else it would be fun! 8*)) >>> >>> >>> >>>-Doc >> >> >> How about working with the devs to have a function in SA to >dump rule hits >> into a seperate log? Just rule hits. I'd buy that for a dollar! > >Which Developers? I'm game to do something like this. I know there is >already one for SA. sa-stats.pl or some such. Too bad it never has >worked for me. (probably missing a module or something) Ork! > >But hey I sure can whip something up if there is an interest. > >-Doc (Brushes off his coding skills)(needs more WD-40) > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

RE: [SURBL-Discuss] How effective is SURBL?
by Chris Santerre 23 Apr '04

23 Apr '04

>-----Original Message----- >From: Doc Schneider [mailto:maddoc@maddoc.net] >Sent: Friday, April 23, 2004 2:05 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] How effective is SURBL? > > > > > > What tools are people using to see what are the most hit rulesets? > >I've been thinking of writing a tool to check out some of >those rulesets >the spammy crap hits on. > >Figured if nothing else it would be fun! 8*)) > > > >-Doc How about working with the devs to have a function in SA to dump rule hits into a seperate log? Just rule hits. I'd buy that for a dollar! --Chris

3 3

RE: [SURBL-Discuss] How effective is SURBL?
by Chris Santerre 23 Apr '04

23 Apr '04

>-----Original Message----- >From: Don Newcomer [mailto:newcomer@dickinson.edu] >Sent: Friday, April 23, 2004 9:17 AM >To: SURBL Discussion List >Subject: [SURBL-Discuss] How effective is SURBL? > > >Look for yourself. Here are my top 10 rule hits for yesterday: > >18173 HTML_MESSAGE >11898 WS_URI_RBL >11871 MIME_HTML_ONLY >6951 SPAMCOP_URI_RBL >6847 CLICK_BELOW >6035 HTML_LINK_CLICK_HERE >5278 MIME_HTML_NO_CHARSET >5085 MY_SHRT_IMG >4993 COMBINED_FROM >4140 BE_URI_RBL > >Nice work, gentlemen! What's better is the fact that my system load >appears to have dropped considerably. Life is good... > Considering I also wrote MY_SHRT_IMG, this data makes me VERY happy ;) --Chris

3 2

RE: [SURBL-Discuss] Re: Bill Stearns' sa-blacklist available as S URBL: ws.surbl.org
by Chris Santerre 23 Apr '04

23 Apr '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, April 23, 2004 9:05 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Re: Bill Stearns' sa-blacklist >available as >SURBL: ws.surbl.org > > >On Friday, April 23, 2004, 5:25:06 AM, Raymond Dijkxhoorn wrote: >> So, when >> can we start using the combined lists :) > >We're waiting to hear back from Bill, Chris, Paul, et. al., >about whether they want to combine their rules before they >reach us. Should have a better idea after a conference >call this evening. > >Jeff C. > I think we will find that everyone wants to combine. Just need to find a 'trusted' way for us to all add to one. Emailing domains to one guy for them to add is NUTZ! Happens to me all the time :) --Chris

1 0

probable impact of cid:.* urls in uri_to_domain
by Yusuf Goolamabbas 23 Apr '04

23 Apr '04

Hi, Currently URIDNSBL.pm uses SA's get_uri_list to get a list of URI's from a message, the current regex seems to also get uri's of the form cid:random_characters in the list cid:.* seems to refer to content-ids,attachments in the same message when these uris are run through uri_to_domain, they return back the same result cid:.* My feeling is that a message can contain some artificial cid:.* url's which may skew the set of random domains used for SURBL lookup's I am not sure if cid:.* url's should be returned from get_uri_list() or they should be stripped correctly in uri_to_domain. Quite a few of the values after cid: seem to refer to host names/domain names Regards, Yusuf

3 3

[SURBL-Discuss] [Fwd: cloud-cuckoo-land: M-W's Word of the Day] (fwd)
by Don Newcomer 23 Apr '04

23 Apr '04

I was able to whitelist mail from these people but I'm wondering, more importantly, why they were picked up by the WS_URI_RBL rule. I used the new SURBL checking website and none of the URIs came up positive as far as I could tell. Any ideas? ================================================================================ Don Newcomer Dickinson College Senior Manager, Systems P.O. Box 1773 newcomer(a)dickinson.edu Carlisle, PA 17013 Phone: (717) 245-1256 FAX: (717) 245-1690 ---------- Forwarded message ---------- Date: Fri, 23 Apr 2004 08:44:44 -0400 From: Paul Levit <levitp(a)dickinson.edu> To: Don Newcomer <newcomer(a)dickinson.edu> Subject: [Fwd: cloud-cuckoo-land: M-W's Word of the Day] -------- Original Message -------- Return-Path: <bounce-mw-20902366(a)blast1.myfree.com> Received: from blast1.myfree.com by alpha.dickinson.edu (8.11.1/1.1.29.3/19Aug03-0302PM) id i3N9V0d0000454121; Fri, 23 Apr 2004 05:31:01 -0400 (EDT) Received: from lanai.startsampling.com ([64.85.80.203]) by blast1.myfree.com with SMTP (Lyris ListManager WIN32 version 6.1b); Tue, 20 Apr 2004 13:45:02 -0500 Received: (from nobody@localhost) by lanai.startsampling.com (8.11.6/8.9.3) id i3KIiD316859; Tue, 20 Apr 2004 11:44:13 -0700 Date: Thu, 22 Apr 2004 23:59:00 -0500 Message-Id: <LYRIS-20902366-1782963-2004.04.23-00.00.01--LEVITP#dickinson.edu(a)blast1.myfree.com> From: word(a)m-w.com To: LEVITP(a)dickinson.edu MIME-Version: 1.0 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: cloud-cuckoo-land: M-W's Word of the Day List-Unsubscribe: <mailto:leave-mw-20902366A@blast1.myfree.com> Reply-To: word(a)m-w.com X-Dickinson-MailScanner-Information: Please contact the ISP for more information X-Dickinson-MailScanner: Found to be clean X-Dickinson-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=3.876, required 3, BAYES_00 -4.90, CLICK_BELOW 0.10, DATE_IN_PAST_03_06 0.42, FREE_TRIAL 0.90, HTML_50_60 0.10, HTML_LINK_CLICK_HERE 0.10, HTML_MESSAGE 0.10, J_CHICKENPOX_16 0.60, MIME_HTML_ONLY 0.32, MK_BAD_HTML_02 0.68, MK_BAD_HTML_05 0.30, NO_REAL_NAME 0.16, WS_URI_RBL 5.00) X-MailScanner-From: bounce-mw-20902366(a)blast1.myfree.com <http://www.merriam-webster.com> <http://www.merriam-webster.com/game/> <http://www.wordcentral.com> <http://www.merriam-websterunabridged.com> *Did you share your favorite word with us? Visit our web site for details!* No Yes The Word of the Day for Apr 23 is: *cloud-cuckoo-land* \klowd-KOO-koo-land\ /noun/ : a realm of fantasy or of whimsical or foolish behavior <http://www.merriam-webster.com/sound/c/cloud_01.wav> *Example sentence: * If the boss really thinks he can up productivity and increase profit after the company is downsized, he is living in cloud-cuckoo-land. *Did you know? *In Aristophanes' 5th century B.C. comedy /Birds/, Peisthetaerus (a human) convinces the king of the birds and his followers to help him build an ideal city juxtaposed between heaven and earth. They plan to intercept all of the sacrifices rising from the earth to the gods on Olympus, thereby starving the gods into cooperating with them. The newly built city is dubbed "Nephelokokkygia," (from "nephos," meaning "cloud," and "kokkyx," the native European cuckoo). By the late 19th century, English speakers had translated the town's name as "Cloud-Cuckoo-Land" and had begun using it as a general term for any similarly unreal or whimsical place or situation. *Indicates the sense illustrated in the example sentence. <http://www.startsampling.com/sm/wod/redirector.iphtml?item=3243&url=http%3A…> ------------------------------------------------------------------------ You Are Subscribed As: LEVITP(a)dickinson.edu ------------------------------------------------------------------------ Subscribe to Word of the Day via the Web: click here <http://www.startsampling.com/sm/wod/register.iphtml> Unsubscribe to Word of the Day via the Web: click here <http://www.startsampling.com/sm/wod/changeofaddress.iphtml?email=LEVITP@dic…> To change the email format from html to text: click here <http://www.startsampling.com/sm/wod/changeofaddres s.iphtml> Questions about your subscription? click here <http://www.startsampling.com/sm/wod/faq.htm l> © 2004 by Merriam-Webster <http://www.Merriam-Webster.com>, Incorporated <http://www.startsampling.com/sm/wod/redirector.iphtml?item=3243&url=http%3A…> ------------------------------------------------------------------------ Word game lovers! Enjoy a free trial subscription to Merriam-Webster Unabridged and try our new brainteasers! click here <http://www.startsampling.com/sm/wod/redirector.iphtml?html=1&item=3243&url=…> ------------------------------------------------------------------------ <http://www.startsampling.com/sm/wod/redirector.iphtml?item=3243&url=http%3A…> <http://www.startsampling.com/sm/wod/redirector.iphtml?item=3243&url=http%3A…> *mf mwh 042304 LEVITP(a)dickinson.edu mf* If you cannot read this email, please copy and paste the following address into your web browser to subscribe to the text version of the Merriam-Webster Word of the Day: http://www.startsampling.com/sm/wod/changeofaddress.iphtml -- Paul Levit '71 Executive Director Information Technology Dickinson College Carlisle, PA 17013 717.245.1256 Promote, provide and support the effective use of information technology to advance Dickinson's mission and strategic goals.

2 5

How effective is SURBL?
by Don Newcomer 23 Apr '04

23 Apr '04

Look for yourself. Here are my top 10 rule hits for yesterday: 18173 HTML_MESSAGE 11898 WS_URI_RBL 11871 MIME_HTML_ONLY 6951 SPAMCOP_URI_RBL 6847 CLICK_BELOW 6035 HTML_LINK_CLICK_HERE 5278 MIME_HTML_NO_CHARSET 5085 MY_SHRT_IMG 4993 COMBINED_FROM 4140 BE_URI_RBL Nice work, gentlemen! What's better is the fact that my system load appears to have dropped considerably. Life is good... ================================================================================ Don Newcomer Dickinson College Senior Manager, Systems P.O. Box 1773 newcomer(a)dickinson.edu Carlisle, PA 17013 Phone: (717) 245-1256 FAX: (717) 245-1690

1 0

RE: [SURBL-Discuss] Re: Bill Stearns' sa-blacklist available as SURBL: ws.surbl.org
by Scott Truman 23 Apr '04

23 Apr '04

On Tuesday, April 20, 2004, 6:10:30 PM, Bill Landry wrote: > ----- Original Message ----- > From: "Jeff Chan" <jeffc(a)surbl.org> >> So the quick answer is they'll probably not be combined. >> >> However we probably will offer a combined version of Bill's >> list and Chris' BigEvil list since they are more similar in >> character. > Jeff, why not one DNS query that supports multiple result codes: > test: somedomain.com.sc.surbl.org > results: > 127.0.0.2 = Spamcop > 127.0.0.3 = WS List > 127.0.0.4 = BigEvil List > 127.0.0.5 = etc... > Same thing multi-test RBLs like AHBL, Sorbs, Blars, FiveTen, NJABL and > others do. That's pretty cool. One could even extend that as such (if they don't already): test: example.com.all.surbl.org ;) results: 127.0.0.2 = SC List 127.0.0.4 = WS List 127.0.0.8 = BigEvil List 127.0.0.16 = Someother List etc.... Multiple hits for the same lookup could be returned by combining the last octet i.e. a result of 127.0.0.10 would indicate the URI was found in both the SC and BigEvil lists. If one was only interested in what SC found, then one would AND the result with 127.0.0.2 just thinking out loud...

5 5

Statistics
by Doc Schneider 23 Apr '04

23 Apr '04

Gang, [root@newmail root]# grep SPAMCOP_URI_RBL /home/maddoc/mail/caughtspam|wc -l 361 [root@newmail root]# grep WS_URI_RBL /home/maddoc/mail/caughtspam|wc -l 213 [root@newmail root]# grep BE_URI_RBL /home/maddoc/mail/caughtspam|wc -l 92 [root@newmail root]# All this in 24 hours. Well I did NOT get my usual volume of spam, I did get enough. And FWIW it caught 99% and no FPs! Way kewl! -- -Doc --- MomNDoc Online Consultants http://www.maddoc.net/ momndoc(a)maddoc.net

1 0

ANNOUNCE: Mail::SpamAsssassin::SpamCopURI 0.14
by Eric Kolve 23 Apr '04

23 Apr '04

Release 0.14 is up on sourceforge.net. Sorry about all these releases. This is just a small one to fix the 'Modification of non-creatable array value attempted' error a few people have been seeing. You can fetch it at http://sourceforge.net/projects/spamcopuri --eric

2 4

ANNOUNCE: Mail::SpamAsssassin::SpamCopURI 0.13
by Eric Kolve 23 Apr '04

23 Apr '04

I have just released SpamCopURI 0.13. This release adds some basic query caching as well as registrar based lookups against the RBL. Instead of querying for both the 2nd and 3rd level domain we are now only querying for the 2nd OR the 3rd based on the TLD. Let me know if you see any issues with this: false positives, misses that should be hits, etc. We are now caching the query results on a per test basis so multiple URLs to the same to domain should only get checked once per RBL. There is also a change that fixes a compile error under Perl 5.005 reported on this list. Open redirect resolution is still off by default. I would like to hear how this has worked out for those that have enabled it. Do you think its safe enough to enabled it by default? The latest release can be retrieved from http://sourceforge.net/projects/spamcopuri --eric

5 7

Just found a bunch of these also
by Chris 23 Apr '04

23 Apr '04

Checked back, this started right after I installed .12 last night. >From chris(a)chris.localdomain Thu Apr 22 19:42:01 2004 Return-Path: <chris(a)chris.localdomain> Delivered-To: chris(a)chris.localdomain Received: by chris.localdomain (Postfix, from userid 501) id 4E9E6584002; Thu, 22 Apr 2004 20:42:01 -0400 (EDT) From: root(a)chris.localdomain (Cron Daemon) To: chris(a)chris.localdomain Subject: Cron <chris@chris> /usr/bin/spamcopuri-update X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/home/chris> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=chris> Message-Id: <20040423004201.4E9E6584002(a)chris.localdomain> Date: Thu, 22 Apr 2004 20:42:01 -0400 (EDT) Can't locate object method "_fetch_records" via package "Mail::SpamAssassin::SpamCopURI" at /usr/bin/spamcopuri-update line 16. -- Regards Chris A 100% Microsoft free computer Registered Linux User 283774 http://counter.li.org 8:07pm up 16 days, 2:43, 2 users, load average: 0.94, 0.95, 0.68

3 3

Error with the new Spamcop URI rule file
by Chris 23 Apr '04

23 Apr '04

Came home to the below errors today in my log. This is after I removed the # comment # spamcop_uri_resolve_open_redirects 1 Security Violations =-=-=-=-=-=-=-=-=-= Apr 22 15:47:09 chris spamd[19353]: Failed to run SPAMCOP_URI_RBL SpamAssassin test, skipping: ^I(Modification of non-creatable array value attempted, subscript -1 at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/SpamCopURI.pm line 116, <GEN83> line 117. ) Apr 22 15:47:09 chris spamd[19353]: Failed to run WS_URI_RBL SpamAssassin test, skipping: ^I(Modification of non-creatable array value attempted, subscript -1 at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/SpamCopURI.pm line 116, <GEN83> line 117. ) Any ideas anyone? Chris -- Regards Chris A 100% Microsoft free computer Registered Linux User 283774 http://counter.li.org 7:18pm up 16 days, 1:54, 2 users, load average: 0.41, 0.48, 0.46

4 6

RE: [SURBL-Discuss] BigEvil + MidEvil as SURBL
by Chris Santerre 23 Apr '04

23 Apr '04

> -----Original Message----- > From: John Wilcock [mailto:john@tradoc.fr] > Sent: Thursday, April 22, 2004 2:26 AM > To: Jeff Chan; SURBL Discussion list > Subject: Re: [SURBL-Discuss] BigEvil + MidEvil as SURBL > > > On Wed, 21 Apr 2004 14:49:51 -0700, Jeff Chan wrote: > > >> > 1) BigEvil wildcards. Not sure how you would handle these. > > >> Something like > > >> > evil\d{2,4}spam\.com is a general wildcard. Some of those > > >> domains don't even > > >> > exhist. Not sure how SURBL will handle that. > > >> > > >> Yes, I should have mentioned that I'm simply discarding them. > > >> Unfortunately there's no easy way to deal with them. Domains > > >> without any patterns in them, which are a majority, come right > > >> through. The script is at: > > > > > Can we make sure that when you announce this to the > public that they know > > > this! :) > > > I can see the flurry of emails now. > > > > Definitely will mention the differences in the announcement and > > web site! > > Perhaps the ideal would be if the script that converts bigevil to rbl > form could also generate a separate "wildevil" cf file containing only > the wildcard entries from bigevil, so that people can have the best of > both worlds... > > John. Hold off on the wilcard idea for now. Let me figure out with the other guys what we are doing. A few ideas in the mix. But I would let wildcards stay as a regex file. It is crazy to try to lookup things like /\dmeds\d{2,6}\.(?:com|net|biz)/ , that would take a looong time to do just that one! --Chris

3 2

MIMEDefang
by Justin 23 Apr '04

23 Apr '04

Howdy. Can anyone tell me if the SpamCopURI can be used with MIMEDefang. Ie, not running spamd but instead loading the SA perl stuff into memory at launch? spamd isn't going to be an option for me any more so I'm hoping it's possible to use SpamCopURI with MD. Thanks Justin

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss