Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

SURBL querying engine?
by Shashank Tripathi 19 Jul '04

19 Jul '04

Hello I am looking for some simple PHP based functionality that will allow me to query the SURBL database for a domain name and confirm if it is a spamvertised one or not. Is there any engine for this? I would like this functionality on hosted domains as well, which means setting up a DNS resolution etc may be impractical. All I need is some online location to which I can send an input (a URL, or just the domain name) and get back a "YES" or a "NO" indicating whether this domain name is clean or not. Thanks for any ideas! Shanx

3 3

6dos data into ds.surbl.org
by Jeff Chan 19 Jul '04

19 Jul '04

Chris Santerre asked on the spamassassin-users list whether ds.surbl.org was being updated with the 6dos data. The answer is no, it's static now based on that snapshot Chris gave me a couple weeks ago. To be honest, the 6dos data seems too over-inclusive to me for production use, but perhaps Chris or Rich could help me figure out something closer to a live feed as we beta test it. Jeff C.

2 2

Fwd: Re: ob.surbl.org FP
by Jeff Chan 18 Jul '04

18 Jul '04

Brian Godette noticed on spamassassin-users that kerrypicksedwards.com showed up on ob.surbl.org last week ago. That started a fairly long thread, to which I responded below. From: Jeff Chan To: spamassassin-users Date: Saturday, July 17, 2004, 11:22:23 PM Subject: ob.surbl.org FP OK here are some of my responses to the themes in this thread: 1. I've whitelisted: kerrypicksedwards.com, johnkerry.com, bush's site and some other candidate sites. (By whitelisting I mean preventing these domains from getting onto SURBLs. There is no whitening or score improvement of your incoming messages with the SURBL whitelists.) 2. Some people seem more comfortable sending non-commercial spam out. It's still spam, but in their religious or political fervor they think they're justified, which of course they are not. And any site that has unconfirmed opt-in is just begging for this kind of abuse by zealots (and opponents) also. 3. Justin is right that's it's important to keep domains of sites that might get mentioned in legitimate messages (ham) out of SURBLs, otherwise false positives are possible. In this sense CAN-SPAM is irrelevant since any partially whitehat sites need to not get listed. In this sense the standards for inclusion in SURBLs need to be higher than sender IP or domain RBLs. Blocking messages based on URIs has potentially much larger effect on mail in general than blocking a specific zombie or rogue mail server. The focus of SURBLs therefore should be on the hard core professional criminal spammers' domains first. 4. The outblaze data is based on their spam traps, so they *are* getting spam from these when they should not (for example outside the U.S.). The whitelists take precedence over any input data feeds like Outblaze, so they will prevent list inclusion. 5. Outblaze has another interesting idea in that only domains less than 90 days old are listed. The idea is that spammers burn through domains quickly so the really recently registered ones are more likely to be spammers'. This is only for domains that actually get delivered into their spam traps, and it's probably a good idea. 6. Outblaze may do some additional processing before we get their data, but in general it appears to be quite good. We iterated a bit by sharing whitelist hits, etc. so we could focus their feed on the most often spamming URI domains. So it may take more than a single trap hit to get onto their list, and in addition to the 90 day newness of registration factor, their data seems quite good in general. Jeff C.

1 0

RE: [SURBL-Discuss] Michael Radwin blogs about closing Yahoo'sredirectors
by William C. Devine II 18 Jul '04

18 Jul '04

If they're doing 'authentication' or 'hashes' and someone has to generate them for specific URL's, then their 'hash' code will have to be broken before they'll be able to use the rd.yahoo.com again (except for the international ones until they fix them) william -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Saturday, July 17, 2004 3:17 PM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] Michael Radwin blogs about closing Yahoo'sredirectors On Saturday, July 17, 2004, 1:19:44 AM, Raymond Dijkxhoorn wrote: >> Yahoo! Engineer Michael Radwin blogs about Y! closing their redirector >> (not sure if all their country redirectors are closed) >> >> http://www.radwin.org/michael/blog/2004/07/open_http_redirectors.html > Thats great news, i hope more will follow, OR! start using SURBL (for > example) to filter their redirects.... FWIW I added an entry to his blog suggesting they consider denying redirection services to spammers by using SURBLs, as Metamark is doing. Jeff C. _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss ------------------------------------------------------------ Mail was checked for spam by the Freeware Edition of No Spam Today! The Freeware Edition is free for personal and non-commercial use. You can remove this notice by purchasing a full license! To order or to find out more please visit: http://www.no-spam-today.com

1 0

Fwd: New SURBL Results
by Jeff Chan 18 Jul '04

18 Jul '04

From: Chris <cpollock(a)earthlink.net> To: spamassassin-users(a)incubator.apache.org Date: Saturday, July 3, 2004, 8:30:34 PM Subject: New SURBL Results I don't have any fancy results to post, however, in the past 2 1/2 days that I've been running the new ab_uri.cf, ob_uri.cf along with spamcop_uri.cf and ws_uri.cf I've had no false positives or negatives -- Chris

2 1

[SURBL-Discuss] Michael Radwin blogs about closing Yahoo's redirectors
by Yusuf Goolamabbas 17 Jul '04

17 Jul '04

Yahoo! Engineer Michael Radwin blogs about Y! closing their redirector (not sure if all their country redirectors are closed) http://www.radwin.org/michael/blog/2004/07/open_http_redirectors.html

3 2

{Spam?} RE: SURBL Help?
by Henry Kwan 16 Jul '04

16 Jul '04

So I was having problems with the following whenever I lint'ed SA 2.63 after installing SURBL. >> >debug: uri tests: Done uriRE >> >Failed to compile URI SpamAssassin tests, skipping: >> >(syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule >> >SPAMCOP_URI_RBL, line 1, near "eval:" >> >syntax error at /etc/mail/spamassassin/bigevil.cf, rule >> >BigEvilList_23, line >> >1038, near "; >> >}" The problem was that even though the install copied all the files over to "/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/" and the command "perl -MMail::SpamAssassin::PerMsgStatus -e 'print $INC{"Mail/SpamAssassin/PerMsgStatus.pm"},"\n"'" returned "/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/PerMsgStatus.pm", my copy of SA 2.63 was actually using the pm files in "/usr/lib/perl5/site_perl/5.8.1/Mail/SpamAssassin/" instead. So once I copied over the pm files to the 5.8.1 directory instead, linting SA 2.63 was successful and I was getting the markups I expected. Though one minor problem still exists: debug: running uri tests; score so far=0 debug: uri tests: Done uriRE Use of uninitialized value in substitution (s///) at /usr/lib/perl5/site_perl/5.8.1/URI/Escape.pm line 161. Use of uninitialized value in substitution (s///) at /usr/lib/perl5/site_perl/5.8.1/URI/Escape.pm line 161. Use of uninitialized value in substitution (s///) at /usr/lib/perl5/site_perl/5.8.1/URI/Escape.pm line 161. debug: checking url: http://127.0.0.2/foo/foo debug: querying for 2.0.0.127.sc.surbl.org Are the uninitialized values anything to be concerned with? I have URI-1.31 installed. Thanks. --Henry

1 0

A sincere request for help
by William Stearns 16 Jul '04

16 Jul '04

Good afternoon, all, Through the tremendous efforts of so many contributors, the ws.surbl.org and its equivalent sa-blacklist have crossed 26,000 live (after the disabled and expired domains have been removed) domains. My _sincere_ thanks to everyone that has worked so hard to make this project work. There have been occasional questions about why the surbl's aren't scored higher. The answer is simple, and is based upon the one universal truth in spam characterization: "_Every_ technique used to identify spam _can screw up_." It's my sincere hope that the surbls, and my pet ws.surbl.org in particular, screw up less than most, but it's still true that they can cause false positives. I'm asking everyone that uses any surbls (that includes anyone using the sa-blacklist.cf, sa-blacklist.uri.cf, ws.surbl.org, *.surbl.org, spamassasin 3.0, and spamassassin 2.x with spamcopuri) for help. If you get any legitimate messages where one of the above mistakenly tagged the message as spam, _please_ let me know. I would sincerely appreciate it if you'd send the message to me as an attachment (forwards or bounces are OK too) with "blacklist" somewhere in the subject (this skips around my spam filters; I don't want the autowhitelist to start tagging _you_ as a spammer!). I'm asking for your help because false positives hurt all of us. I'd much rather have a blacklist with 3 domains I'm absolutely certain of than a blacklist with 120,000 iffy domains. Cheers, - Bill --------------------------------------------------------------------------- "Maybe is an Ambivalent Yet Beguiling Enigma" (Courtesy of Dale Harris <rodmur(a)maybe.org>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

2 2

I want a contest too!! :p
by Chris Santerre 16 Jul '04

16 Jul '04

There are some very cool submissions here: http://wiki.apache.org/spamassassin/LogoContestEntries Can we have a contest for SARE and SURBL? Chris (I have no artistic talent!)

2 1

{Spam?} RE: SURBL Help?
by Chris Santerre 16 Jul '04

16 Jul '04

It will work. I'm not sure why everyone is getting these. I've looked at the code in there and the only thing that stands out is that all of those lines contain "http://surbl-org-permanent-test-point.com/foo/bar" So there may lie the problem? --Chris >-----Original Message----- >From: spam(a)mail.designmedia.com [mailto:spam@mail.designmedia.com] >Sent: Friday, July 16, 2004 1:14 PM >To: spamassassin-users(a)incubator.apache.org >Subject: SURBL Help? > > >Hi. Did anyone run into a open_redirect problem when >installing the SURBL >plugin? (See error log below) > >And if I try to install it anyway by copying over the .cf >file, SA spits out >this error when testing: > >debug: uri tests: Done uriRE >Failed to compile URI SpamAssassin tests, skipping: >(syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule >SPAMCOP_URI_RBL, line 1, near "eval:" >syntax error at /etc/mail/spamassassin/bigevil.cf, rule >BigEvilList_23, line >1038, near "; >}" > >I'm running Fedora C1 with SA 2.63 and all the prerequisite >perl modules. > >Thanks. > >---snip--- >(home/spam) mail 2%> perl Makefile.PL >Checking if your kit is complete... >Looks good >Writing Makefile for Mail::SpamAssassin::SpamCopURI >(home/spam) mail 3%> make >cp lib/Mail/SpamAssassin/Conf.pm blib/lib/Mail/SpamAssassin/Conf.pm >cp lib/Mail/SpamAssassin/PerMsgStatus.pm >blib/lib/Mail/SpamAssassin/PerMsgStatus.pm >cp lib/Mail/SpamAssassin/SpamCopURI.pm >blib/lib/Mail/SpamAssassin/SpamCopURI.pm >Manifying blib/man3/Mail::SpamAssassin::PerMsgStatus.3pm >Manifying blib/man3/Mail::SpamAssassin::Conf.3pm >Manifying blib/man3/Mail::SpamAssassin::SpamCopURI.3pm >(home/spam) mail 4%> make test >PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" >"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t >t/blacklist........ok >t/dnsrbl...........ok >t/extract_urls.....ok >t/mailto...........ok >t/open_redirect....NOK 1# Failed test (t/open_redirect.t at line 37) >t/open_redirect....NOK 2# Failed test (t/open_redirect.t at line 44) >t/open_redirect....NOK 3# Failed test (t/open_redirect.t at line 52) >t/open_redirect....ok 4/5# Looks like you failed 3 tests of 5. >t/open_redirect....dubious >Test returned status 3 (wstat 768, 0x300) >Scalar found where operator expected at (eval 152) line 1, near "'int' >$__val" >(Missing operator before $__val?) >DIED. FAILED tests 1-3 >Failed 3/5 tests, 40.00% okay >t/spamcopuri.......ok >t/whitelist........ok >Failed Test Stat Wstat Total Fail Failed List of Failed >--------------------------------------------------------------- >---------------- >t/open_redirect.t 3 768 5 3 60.00% 1-3 >Failed 1/7 test scripts, 85.71% okay. 3/57 subtests failed, >94.74% okay. >make: *** [test_dynamic] Error 255 >(home/spam) mail 5%> >

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss