Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

ETA on New Version
by Rob McEwen 22 Jul '04

22 Jul '04

I read on an earlier post something about a newer SURBL version which more quickly matches a new domain submission with that particular spammer's past data so as to lower the threshhold (of # of reports) it takes for a known spammer hiding behind a new domain name to get blacklisted. Does anyone have an estimate about when this new system will be put into production. Rob M.

2 1

[SURBL-Discuss] Help! Who should a send email to regarding SA not checking against localhost rbldns?
by Joe Young 22 Jul '04

22 Jul '04

Spamassassin is not checking against my rbldns server. It will query multi.surbl.org but not localhost Here is my configs /etc/sysconfig/rbldnsd RBLDNSD="njabl -udnsbl -r/var/lib/rbldns -t21600 -c60 \ -lquerylog -blocalhost/53 \ localhost:dnset:ws.surbl.org.rbldnsd \ " /etc/mail/spamassassin/spamcop_uri.cf uri SPAMCOP3_URI_RBL eval:check_spamcop_uri_rbl('localhost','127.0.0.2') describe SPAMCOP3_URI_RBL URI's domain appears in spamcop database at ws.surbl.org tflags SPAMCOP3_URI_RBL net score SPAMCOP3_URI_RBL 3.0 The debug of spamassassin shows debug: querying for amazingbuyz.net.localhost debug: Query failed for amazingbuyz.net.localhost debug: querying for amazingbuyz.net.ws.surbl.org debug: found A records for: amazingbuyz.net.ws.surbl.org Dig @localhost amazingbuyz.net.localhost shows ; <<>> DiG 9.2.2-P3 <<>> @localhost amazingbuyz.net.localhost ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24488 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 20, ADDITIONAL: 0 ;; QUESTION SECTION: ;amazingbuyz.net.localhost. IN A ;; ANSWER SECTION: amazingbuyz.net.localhost. 21600 IN A 127.0.0.2 ;; AUTHORITY SECTION: localhost. 5400 IN NS ns1.surbl.org. localhost. 5400 IN NS ns2.surbl.org. localhost. 5400 IN NS ns3.surbl.org. localhost. 5400 IN NS ns4.surbl.org. localhost. 5400 IN NS ns5.surbl.org. localhost. 5400 IN NS ns6.surbl.org. localhost. 5400 IN NS ns7.surbl.org. localhost. 5400 IN NS ns8.surbl.org. localhost. 5400 IN NS ns9.surbl.org. localhost. 5400 IN NS ns10.surbl.org. localhost. 5400 IN NS ns11.surbl.org. localhost. 5400 IN NS ns12.surbl.org. localhost. 5400 IN NS ns13.surbl.org. localhost. 5400 IN NS ns14.surbl.org. localhost. 5400 IN NS ns15.surbl.org. localhost. 5400 IN NS ns16.surbl.org. localhost. 5400 IN NS ns17.surbl.org. localhost. 5400 IN NS ns18.surbl.org. localhost. 5400 IN NS ns19.surbl.org. localhost. 5400 IN NS ns20.surbl.org. ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(localhost) ;; WHEN: Thu Jul 22 11:30:29 2004 ;; MSG SIZE rcvd: 439

2 1

RE: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh
by Chris Santerre 22 Jul '04

22 Jul '04

>70_sc_top200.cf You could remove. >antidrug.cf remove this when you upgrade to SA 3.0 >backhair.cf remove this when you upgrade to SA 3.0 >bigevil.cf REMOVE! >chickenpox.cf remove this when you upgrade to SA 3.0 >evilrules.cf REMOVE very old! --Chris

1 0

RE: [SURBL-Discuss] New slogan
by Chris Santerre 22 Jul '04

22 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, July 20, 2004 1:28 AM >To: discuss(a)lists.surbl.org >Subject: Re: [SURBL-Discuss] New slogan > > >On Monday, July 19, 2004, 9:40:30 PM, Ryan Thompson wrote: >> Save a parse tree. Get SURBL. > >> ;-) > >Or, Let us do the parsing for you. > >(at least part of it) :-) > >Jeff C. > Wouldn't that be: "Relax, and leave the parsing to us!" :) --Chris

2 1

RE: [SURBL-Discuss] ph.surbl.org
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Thanks Jeff And thanks for not "flaming" my dumb questions. Regards Tom > -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: 22 July 2004 10:44 > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] ph.surbl.org > > On Thursday, July 22, 2004, 1:38:06 AM, Thomas Kinghorn wrote: > > I have noticed that the plugin for SA 2.63 has sc, ws, ob & ab BUT the > > plugin for SA 3 has ph.surbl.org. > > > What is ph.surbl.org and can it be used with 2.63 as a stand-alone rule > like > > the others. > > ph is a list with some phishing data. It only exists in > multi.surbl.org which is currently supported in SA 3.0. > It does not exist as a standalone list. > > You can find it described in the Lists document: > > http://www.surbl.org/lists.html#ph > > Jeff C. > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss

1 0

ph.surbl.org
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Hi All. Just reading the docs. I have noticed that the plugin for SA 2.63 has sc, ws, ob & ab BUT the plugin for SA 3 has ph.surbl.org. What is ph.surbl.org and can it be used with 2.63 as a stand-alone rule like the others. Regards, Tom Kinghorn

2 1

RE: [SURBL-Discuss] SA2.63 make problems
by Thomas Kinghorn 22 Jul '04

22 Jul '04

> -----Original Message----- > From: Jeff Chan [mailto:jeffc@surbl.org] > Sent: 22 July 2004 08:46 > To: discuss(a)lists.surbl.org > Subject: Re: [SURBL-Discuss] SA2.63 make problems > > --- > > t/open_redirect.t 3 768 5 3 60.00% 1-3 > > Failed 1/7 test scripts, 85.71% okay. 3/57 subtests failed, 94.74% okay. > > make: *** [test_dynamic] Error 29 > > Welcome to the SURBL community Thomas, > These errors should be gone in SpamCopURI version 0.19. > > Jeff C. > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss Many Thanks Jeff. Is there a work Around in the meantime? Thanks

2 1

Thanks Jeff, 0.019 works on Rh
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Hi Jeff. Thanks for the pointer. 0.019 worked, it just skipped the rd.yahoo.com test. <snip> t/open_redirect....ok 5/5 skipped: Need reliable open redirect to test against - rd.yahoo.com is closed t/spamcopuri.......ok t/whitelist........ok All tests successful, 5 subtests skipped. <snip> I have a bunch of cf files installed. They were downloaded from SARE. Which ones would you advise that I remove? Here is the list: 70_sare_adult.cf 70_sare_bayes_poison_nxm.cf 70_sare_header_abuse.cf 70_sare_oem.cf 70_sare_random.cf 70_sare_specific.cf 70_sare_spoof.cf 70_sc_top200.cf 71_sare_redirect_pre3.0.0.cf 99_FVGT_Tripwire.cf 99_sare_fraud_post25x.cf antidrug.cf backhair.cf bigevil.cf bogus-virus-warnings.cf chickenpox.cf DomainDigits1.cf evilnumbers.cf evilrules.cf Obfu1.cf ratware.cf weeds.cf It is killing the CPU :o$ Regards, Tom Kinghorn

3 2

RE: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh
by Thomas Kinghorn 22 Jul '04

22 Jul '04

> -----Original Message----- > From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] > Sent: 22 July 2004 09:32 > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh > > Hi! > > > bigevil.cf > > Thats one that is doing a lot if think. CPU wise, its included in > ws.surbl.org, so remove that one... > Do I just add ws in spamcop_uri.cf? The standard 1 from the installation source is # vi spamcop_uri.cf uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2') describe SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org tflags SPAMCOP_URI_RBL net score SPAMCOP_URI_RBL 3.0 Sorry for the lame question. Thanks Tom

2 1

FW: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh: GOT IT
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Sorry all. It would help if I read further down in the page :o$ <snip> More SURBL lists ws.surbl.org - sa-blacklist in SURBL form In addition to the original SpamCop URI-derived SURBL sc.surbl.org, we are pleased to have another SURBL compatible with the above plugins, or any other software that can check message body domains against a name-based RBL. <snip> Sorry for wasting your time Regards Tom -----Original Message----- From: Thomas Kinghorn Sent: 22 July 2004 09:59 To: 'SURBL Discussion list' Subject: RE: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh > -----Original Message----- > From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] > Sent: 22 July 2004 09:32 > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh > > Hi! > > > bigevil.cf > > Thats one that is doing a lot if think. CPU wise, its included in > ws.surbl.org, so remove that one... > Do I just add ws in spamcop_uri.cf? The standard 1 from the installation source is # vi spamcop_uri.cf uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2') describe SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org tflags SPAMCOP_URI_RBL net score SPAMCOP_URI_RBL 3.0 Sorry for the lame question. Thanks Tom

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss