Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

SpamCopURI+ --lint
by Cami 30 May '04

30 May '04

Hi All, I'm using the SA Mail-SpamAssassin-SpamCopURI-0.17 plugin, (i've installed the packages required) and i'm getting the following errors when running spamassassin --lint: [spamwall01][/etc/mail/spamassassin]# spamassassin --lint Failed to compile URI SpamAssassin tests, skipping: (syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule WS_URI_RBL, line 1, near "eval:" syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 1, near "eval:" syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 6, near "} }" ) Is this something to worry about? (i thought --lint should not return any errors..) Regards, Cami

2 2

FW: SURBL+ Checker Submission
by Chris Santerre 28 May '04

28 May '04

Currently people are using the SARE website to report domains to me. This is the kind of report I get. I've munged the email and IP of the reporter. Most of the time the entire spam is also included. I get about 12 a day. However I'n not going to be adding domains like this to BE in the very near future. These should start going to an address for WS until Paul gets his project up? If so, all I need is an email address. Thanks, --Chris >-----Original Message----- >From: SURBL+ Checker [mailto:surbl@rulesemporium.com] >Sent: Friday, May 28, 2004 10:05 AM >To: csanterre(a)MerchantsOverseas.com >Subject: SURBL+ Checker Submission > > >Date: Fri May 28 09:04:38 2004 >Reporter: Adam <munged(a)npower.com> >Reporter IP: 62.xxx.25.19 >Reporter Desc: Another spam domain. > >Applicable List: URIBL:be.surbl.org >Reported URI/IP: tonightafter.com > >Email Source: >---------------------------------------- > >Message sent in plain text: > >One of your buddies hooked you up on a date with another buddy. > >http://tonightafter.com/confirm/?oc=50798885 > > > > > > > > > > > > > > > > > > >Don't want these notifications? >http://tonightafter.com/remove/?oc=50798885 > > > >nsophomoricdelude aspersion ephesus gigaherz kinshasha >teratology stalwart bebop intensive whatnot insert badge >quality aldermen copter assail testament pistol been bystander >cost beneficent clinician cyclops falsify matrices breadroot >bushel charcoal dwindle kobayashi > >obrassymediate moneymake calvinist osiris insupportable >intrigue cavemen bonito pig digital derelict doctrinaire >badinage mathematician television rhyme matsumoto vacuolate >conceptual landmark typhon > >Message headers: > >Received: from pcp01061328pcs.summit01.tn.comcast.net >([68.60.16.253]) by > kfnfw01.npower.com via smtpd (for [10.52.40.144]) with >SMTP; 28 May 2004 > 00:28:05 UT >X-Message-Info: 8Uiw9j262CPXfyuJXQ22mxd155uwrqaGHxilJIixvYYgxv4up >Received: from yahoo.com ([205.138.1.111]) by co14-p82.yahoo.com with > Microsoft SMTPSVC (7.7.6206.9972); Fri, 28 May 2004 14:31:14 -0200 >Received: from yahoo.com (yahoo.com [174.174.7.190]) by yahoo.com > (8.12.10/8.12.9) with ESMTP id pwe4JO051427 for ><bizbox(a)npower.com>; Fri, > 28 May 2004 13:32:14 -0300 (EST) (envelope-from >Janis(a)tonightafter.com) >Received: from CB2790413 (modemcable76.3-14.h.yahoo.com >[104.92.164.94]) > (authenticated bits=5) by yahoo.com (8.12.10/8.12.9) with ESMTP id > JSN20ruz28I294295 for <bizbox(a)npower.com>; Fri, 28 May >2004 15:31:14 > -0100 (EST) (envelope-from Janis(a)tonightafter.com) >Message-ID: ><24163mv103bhg9$p099VO137sg38$81VOT691LRT3@yak19370990924877> >From: "Lula French" <Janis(a)tonightafter.com> >To: <Bizbox> >Subject: RE: tempted by love? >Date: Fri, 28 May 2004 11:31:14 -0500 >MIME-Version: 1.0 >Content-Type: multipart/alternative; boundary="--15104472402585470068" > >----15104472402585470068 >Content-Type: text/plain >Content-Transfer-Encoding: 7Bit > >----15104472402585470068-- > >---------------------------------------- > >

2 1

RE: [SURBL-Discuss] OT: RBL needed!
by Chris Santerre 28 May '04

28 May '04

>-----Original Message----- >From: Doc Schneider [mailto:maddoc@maddoc.net] >Sent: Friday, May 28, 2004 9:55 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] OT: RBL needed! > > >This Off topic but figured most of us all get hit with this stuff. > >I am in need of a bit of help. > >I got a whole bunch of open relays doing rumpelstiltskin(sic) >attacks on >both my main mailserver and my seconary MX server... hitting the >secondary and making it throttle the main one. > >Anyway is there a way to use some of these RBLs to basically >deny these >open relays to be able to even attempt these attacks? > >I'm running Sendmail 8.12.11 on Linux... both these boxen run RH 6.2 >and are really locked down against other attacks. > >I use to just drop routes to these idiots but never a good solution >IMNSHO 8*) > >I looked through the sendmail FAQs and didn't find anything that was >helpful. > >Any idea would be more then welcome. > Did you mean something like sorbs.net? http://www.dnsbl.us.sorbs.net/using.html See the Zones Available towards the bottom. HTH, Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

Re: Anti-SURBL technique ?
by Jeff Chan 28 May '04

28 May '04

On Friday, May 28, 2004, 3:48:15 AM, Rikhardur EGILSSON wrote: > From: jdow [mailto:jdow@earthlink.net] See: http://article.gmane.org/gmane.mail.spam.spamassassin.general/50187 >> If it hurts when you put your finger in the pencil sharpener and turn the >> crank don't do it. >> Simply cancel all redirects as spam. If someone legitimate is not courteous >> enough to send it "clear" then "scroom." > Good point, but how do I do that ? > If I understand the SURBL documentation corectly > "spamcop_uri_resolve_open_redirects" will only work on those domains > explicitly named in "open_redirect_list_spamcop_uri" not every spammer > throwaway domain.. We could probably put together a small paper on the subject of redirection sites. First thing to note is that there are different types. Some like the yahoo redirection site show the destination URI clearly contained within the original URI. Others like tinyurl or the spammer redirection site you found encode the destination site so that it's not plainly visible in the original URI. The latter have been called "opaque" and the former "open" redirections. Probably there are other names also, but you get the idea. urirhsbl in SA 3.0 will check all the domains visible in the URI against the SURBL it's called on (perhaps up to some limited number of URIs), including checking the redirection sites themselves. If the "redirect resolution" feature is enabled, SpamCopURI in SA 2.63 will attempt to resolve the Location header using the redirection server, but I'm not sure whether it can do so on an opaque redirection or not. All of the previous answers also apply. Reporting spams to SpamCop which have any visible black hat redirection sites will get them into sc.surbl.org unless we specifically whitelist them, which we would not do for purely spammer redirectors such as the one you found. In that way, even an opaque redirection site will get listed if it's a bad guy redirection site, as opposed to a mostly legitimate one like Yahoo's. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Some issues with get_uri_list
by Yusuf Goolamabbas 28 May '04

28 May '04

Hi, Since SURBL relies extensively on SA's get_uri_list/uri_to_domain I thought it might be appropiate to discuss possible FP's/FN's on this list so as to alert other members to bugs/spammer tricks etc and also be able to provide reduced testcases/fixes to SA developers upstream. One example I've recently filed in SA's bugzilla is http://bugzilla.spamassassin.org/show_bug.cgi?id=3427 Regards, Yusuf

1 0

RE: [SURBL-Discuss] Problems installing SPAMCOP_URI - Make test e rror
by Martin Lyberg 28 May '04

28 May '04

Hi Eric, That is correct, if this is the message you mean? perl Makefile.PL # SAPATH /usr/lib/perl5/site_perl/5.8.0 # installsitelib /usr/lib/perl5/site_perl/5.8.0 # INSTALLDIRS site Warning: prerequisite URI 1.28 not found. We have 1.21. Writing Makefile for Mail::SpamAssassin::SpamCopURI Which URI package do i need to download through CPAN in this case? Thanks in advance / Martin -----Original Message----- From: Eric Kolve To: SURBL Discussion list Sent: 5/27/2004 6:34 PM Subject: Re: [SURBL-Discuss] Problems installing SPAMCOP_URI - Make test e rror You need the URI package from CPAN. You should have received a warning when you attempted to install (if not let me know). --eric On Thu, May 27, 2004 at 02:52:28PM +0200, Martin Lyberg wrote: > Hi! > > I solved the problem by this thread: > > http://lists.surbl.org/pipermail/discuss/2004-May/000522.html > > But now i can't get through 'make test'. This gives me the following: > > make test > > ---snip--- > > Failed 9/9 tests, 0.00% okay > t/whitelist........Can't locate URI/QueryParam.pm in @INC (@INC contains: > /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib > /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/arch > /usr/lib/perl5/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.0 > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.0 > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl > /usr/lib/perl5/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 . > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 .) at > /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib/Mail/SpamAssassin/SpamC opUR > I.pm line 5. > BEGIN failed--compilation aborted at > /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib/Mail/SpamAssassin/SpamC opUR > I.pm line 5. > Compilation failed in require at t/whitelist.t line 6. > BEGIN failed--compilation aborted at t/whitelist.t line 6. > # Looks like your test died before it could output anything. > t/whitelist........dubious > > Test returned status 2 (wstat 512, 0x200) > DIED. FAILED tests 1-6 > Failed 6/6 tests, 0.00% okay > Failed Test Stat Wstat Total Fail Failed List of Failed > ------------------------------------------------------------------------ ---- > --- > t/blacklist.t 2 512 4 4 100.00% 1-4 > t/dnsrbl.t 2 512 6 6 100.00% 1-6 > t/extract_urls.t 2 512 15 15 100.00% 1-15 > t/mailto.t 2 512 1 1 100.00% 1 > t/open_redirect.t 2 512 5 5 100.00% 1-5 > t/spamcopuri.t 2 512 9 9 100.00% 1-9 > t/whitelist.t 2 512 6 6 100.00% 1-6 > Failed 7/7 test scripts, 0.00% okay. 46/46 subtests failed, 0.00% okay. > make: *** [test_dynamic] Error 2 > > Any solution to this problem? Just before i did upgrade Net::DNS through > CPAN. > > Thank you. > > / Martin > > > > : -----Ursprungligt meddelande----- > : Från: Eric Kolve [mailto:ekolve@comcast.net] > : Skickat: den 27 maj 2004 14:11 > : Till: SURBL Discussion list > : Ämne: Re: [SURBL-Discuss] Problems installing SPAMCOP_URI > : > : > : On Thu, May 27, 2004 at 01:44:02PM +0200, Martin Lyberg wrote: > : > : Hi > : > : > : > : I've been reading alot about SURBL in SA-mailinglist, now > : > : i've decided to give it a try. But im having trouble > : > : installing SpamcopUri. > : > : > : > : I have the following system: RH9, Postfix, SA 2.63 > : > : > : > : I get the following: > : > : > : > : Perl Makefile.pl > : > : > : > : Can't locate Mail/SpamAssassin.pm in @INC (@INC contains: > : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi > : > : /usr/lib/perl5/5.8.0 > : > : /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > : > : /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl > : > : /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > : > : /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl > : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi > : > : /usr/lib/perl5/5.8.0 .) at Makefile.PL line 3. BEGIN > : > : failed--compilation aborted at Makefile.PL line 3. > : > : > : > : What is wrong here? > : > : It looks like 'Perl' (was that really what was executed) > : couldn't find Mail::SpamAssassin. Do you know where it's > : installed? This appears to be an issue with the @INC. > : > : > : --eric > : > : > : > > : > Does anyone know a solution to this problem? Is there any easy > : > solution? > : > > : > Thanks in advance > : > > : > / Martin > : > _______________________________________________ > : > Discuss mailing list > : > Discuss(a)lists.surbl.org > : > http://lists.surbl.org/mailman/listinfo/discuss > : _______________________________________________ > : Discuss mailing list > : Discuss(a)lists.surbl.org > : http://lists.surbl.org/mailman/listinfo/discuss > : > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

2 1

Re: [SURBL-Discuss] Problems installing SPAMCOP_URI - Make test e rror
by Martin Lyberg 27 May '04

27 May '04

Hi! I solved the problem by this thread: http://lists.surbl.org/pipermail/discuss/2004-May/000522.html But now i can't get through 'make test'. This gives me the following: make test ---snip--- Failed 9/9 tests, 0.00% okay t/whitelist........Can't locate URI/QueryParam.pm in @INC (@INC contains: /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/arch /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 . /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 .) at /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib/Mail/SpamAssassin/SpamCopUR I.pm line 5. BEGIN failed--compilation aborted at /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib/Mail/SpamAssassin/SpamCopUR I.pm line 5. Compilation failed in require at t/whitelist.t line 6. BEGIN failed--compilation aborted at t/whitelist.t line 6. # Looks like your test died before it could output anything. t/whitelist........dubious Test returned status 2 (wstat 512, 0x200) DIED. FAILED tests 1-6 Failed 6/6 tests, 0.00% okay Failed Test Stat Wstat Total Fail Failed List of Failed ---------------------------------------------------------------------------- --- t/blacklist.t 2 512 4 4 100.00% 1-4 t/dnsrbl.t 2 512 6 6 100.00% 1-6 t/extract_urls.t 2 512 15 15 100.00% 1-15 t/mailto.t 2 512 1 1 100.00% 1 t/open_redirect.t 2 512 5 5 100.00% 1-5 t/spamcopuri.t 2 512 9 9 100.00% 1-9 t/whitelist.t 2 512 6 6 100.00% 1-6 Failed 7/7 test scripts, 0.00% okay. 46/46 subtests failed, 0.00% okay. make: *** [test_dynamic] Error 2 Any solution to this problem? Just before i did upgrade Net::DNS through CPAN. Thank you. / Martin : -----Ursprungligt meddelande----- : Från: Eric Kolve [mailto:ekolve@comcast.net] : Skickat: den 27 maj 2004 14:11 : Till: SURBL Discussion list : Ämne: Re: [SURBL-Discuss] Problems installing SPAMCOP_URI : : : On Thu, May 27, 2004 at 01:44:02PM +0200, Martin Lyberg wrote: : > : Hi : > : : > : I've been reading alot about SURBL in SA-mailinglist, now : > : i've decided to give it a try. But im having trouble : > : installing SpamcopUri. : > : : > : I have the following system: RH9, Postfix, SA 2.63 : > : : > : I get the following: : > : : > : Perl Makefile.pl : > : : > : Can't locate Mail/SpamAssassin.pm in @INC (@INC contains: : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/5.8.0 : > : /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl : > : /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/5.8.0 .) at Makefile.PL line 3. BEGIN : > : failed--compilation aborted at Makefile.PL line 3. : > : : > : What is wrong here? : : It looks like 'Perl' (was that really what was executed) : couldn't find Mail::SpamAssassin. Do you know where it's : installed? This appears to be an issue with the @INC. : : : --eric : : : > : > Does anyone know a solution to this problem? Is there any easy : > solution? : > : > Thanks in advance : > : > / Martin : > _______________________________________________ : > Discuss mailing list : > Discuss(a)lists.surbl.org : > http://lists.surbl.org/mailman/listinfo/discuss : _______________________________________________ : Discuss mailing list : Discuss(a)lists.surbl.org : http://lists.surbl.org/mailman/listinfo/discuss :

2 1

SV: [SURBL-Discuss] Problems installing SPAMCOP_URI
by Martin Lyberg 27 May '04

27 May '04

Hi Eric, : > : : > : Can't locate Mail/SpamAssassin.pm in @INC (@INC contains: : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/5.8.0 : > : /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl : > : /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > : /usr/lib/perl5/5.8.0 .) at Makefile.PL line 3. BEGIN : > : failed--compilation aborted at Makefile.PL line 3. : > : : > : What is wrong here? : : It looks like 'Perl' (was that really what was executed) : couldn't find Mail::SpamAssassin. Do you know where it's : installed? This appears to be an issue with the @INC. It's located here: /usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin.pm Seems like there's an issue with the Perlversion. Since im kinda new to linux and don't want to mess up the installation, i wonder if there's an easy solution to this without reinstalling either SA or Perl. Thank you! / Martin

1 0

Re: [SURBL-Discuss] Problems installing SPAMCOP_URI
by Martin Lyberg 27 May '04

27 May '04

: Hi : : I've been reading alot about SURBL in SA-mailinglist, now : i've decided to give it a try. But im having trouble : installing SpamcopUri. : : I have the following system: RH9, Postfix, SA 2.63 : : I get the following: : : Perl Makefile.pl : : Can't locate Mail/SpamAssassin.pm in @INC (@INC contains: : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : /usr/lib/perl5/5.8.0 : /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl : /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : /usr/lib/perl5/5.8.0 .) at Makefile.PL line 3. BEGIN : failed--compilation aborted at Makefile.PL line 3. : : What is wrong here? Does anyone know a solution to this problem? Is there any easy solution? Thanks in advance / Martin

2 1

Another to whitelist
by Chris Santerre 27 May '04

27 May '04

marketwatch.com Yeah I'm not sure people are even checking these before reporting to me. But this is used by a LOT of financial spam. Legit site. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

5 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss