Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

ANNOUNCE: Mail::SpamAssassin::SpamCopURI 0.17
by Eric Kolve 27 May '04

27 May '04

Just released SpamCopURI 0.17. This is basically a bugfix release. Upgrade if you see something you need: 0.17 Mon May 24 18:23:55 PDT 2004 - added code to handle hex encoded and base 10 encoded IP addresses - added backslash handling in urls (http:/\www.google.com) - handling case when host of a URL is a '.' - calling env_proxy on LWP::UserAgent to support proxied users (thanks to bluebanana ) http://sourceforge.net/projects/spamcopuri/ --eric

2 3

Another Hatcheck, 20m.com
by Chris Santerre 25 May '04

25 May '04

20m.com is a web hosting site. However I believe they host spammers without regard. I could be wrong. We need to decide wether they get whitelisted or not. There are numerous legit sites hosted by them....unfortunetly. Even going to their site produces a popup page. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

Orangestad spammer
by Chris Santerre 25 May '04

25 May '04

SARE has been working on a few rules to catch the Oranjestad spams. One of the ninjas has this list of domains. I'm hoping someone here finds it usefull. I would add to Bigevil, but I'm swamped! > > OK, you asked for it. 109 discrete spamvertised domains culled >from verified Aruba-spams. Yuck. > > ----- > >achieveyouthinweek.com >affordkinginventions.com >beautyattractsall.com >bebetterwithourstore.com >bestguaranteever.com >bestinventionever.com >bestofallitemsonline.com >bestservicesites.com >blowoutredsale.com >braveclassyshop.com >braveselectionnet.com >breakoldbadhabit.com >brightwaystobeauty.com >buyheredowell.com >catchclassyproduct.com >checkhereforhealth.com >cherrysaleall.com >creatingmassdemand.com >dealwithhealthhere.com >dedicatedtoimprove.com >delightfullproducts.com >desireablehealth.com >digitalnetachiever.com >divineredtagmall.com >doctorrecommendedproducts.com >dogoodwithus.com >eliteintendedservice.com >elitesinvitedtobuy.com >enormousbenefitshere.com >finallydiscoveryouth.com >findoutoursecrets.com >followthisexample.com >futureinyourhand.com >galaxyhealthproducts.com >getalphahealth.com >givingawaybestitems.com >glossyproducts.com >goldenthingshere.com >goldpromosol.com >greatinfoonlyonce.com >greatlooksachiever.com >greatqualityoption.com >greatvarietyproducts.com >guaranteedforeveryone.com >healthcenterservice.com >hereyouhaveitall.com >highclassinformers.com >hurryandbeyounger.com >improvedlifeatonce.com >incrediblemallhere.com >incrediblemalls.com >infoforbetterpeople.com >ingenioussol.com >inspireingitems.com >instantlybebetter.com >itemsincreasinghealth.com >jetsetthings.com >joinusforhealth.com >kingproviderstore.com >knowwhatisbest.com >livebettershophere.com >looknomoreforstores.com >looksprovidersnet.com >madetohelpyou.com >mallthathasbest.com >megagoldpromotion.com >naturehelpedmany.com >nofaluirewithus.com >nowherelesetofind.com >onlyworkingproducts.com >oppforall.com >oursecretsmakeimprovements.com >peoplewaitedforthis.com >powerbeautythings.com >producedtohelp.com >productblasthere.com >proofofbettersale.com >prospertherightway.com >prosperwithsale.com >qualityclassysolutions.com >restorehealthwithus.com >royalgalaxysale.com >royaltyproductconsume.com >salesroyalinfo.com >samrthealthproduct.com >satisfyallyourneeds.com >secretstoyourhome.com >seenonlyonce.com >simpleachieverlooks.com >simpleandgreat.com >simplecalssystuff.com >speedupimprovements.com >splendidsalepro.com >sportsline.com >stophereandbuy.com >supervaluableinfo.com >supremeyouthstore.com >testedandproved.com >thishelpedpeople.com >unforgettablesale.com >uniquenetplace.com >usechancetoprosper.com >useonlybestproducts.com >whatyouaskedhere.com >whatyouhavebeenwaitingfor.com >youfoundidealsolution.com >yourgoalachieved.com >yourvibrantproduct.com > > ----- > > Urp. If nothing else, it makes for good BE fodder. >

1 0

Problems installing SPAMCOP_URI
by Martin Lyberg 25 May '04

25 May '04

Hi I've been reading alot about SURBL in SA-mailinglist, now i've decided to give it a try. But im having trouble installing SpamcopUri. I have the following system: RH9, Postfix, SA 2.63 I get the following: Perl Makefile.pl Can't locate Mail/SpamAssassin.pm in @INC (@INC contains: /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 .) at Makefile.PL line 3. BEGIN failed--compilation aborted at Makefile.PL line 3. What is wrong here? Thanks in advance / Martin

1 0

Install on redhat 7.3
by Dan Didier 24 May '04

24 May '04

Hi, updated a bunch of my perl modules - DNS, URI... The initial perl makefile.pl worked well, but then I got this when doing a make test: Any help for a not so good perl person??? Thanks, Dan [root@MAPCI-MAILER-02 Mail-SpamAssassin-SpamCopURI-0.16]# make cp lib/Mail/SpamAssassin/Conf.pm blib/lib/Mail/SpamAssassin/Conf.pm cp lib/Mail/SpamAssassin/SpamCopURI.pm blib/lib/Mail/SpamAssassin/SpamCopURI.pm cp lib/Mail/SpamAssassin/PerMsgStatus.pm blib/lib/Mail/SpamAssassin/PerMsgStatus.pm Manifying blib/man3/Mail::SpamAssassin::Conf.3pm Manifying blib/man3/Mail::SpamAssassin::SpamCopURI.3pm Manifying blib/man3/Mail::SpamAssassin::PerMsgStatus.3pm [root@MAPCI-MAILER-02 Mail-SpamAssassin-SpamCopURI-0.16]# make test PERL_DL_NONLAZY=1 /usr/bin/perl -Iblib/arch -Iblib/lib -I/usr/lib/perl5/5.6.1/i386-linux -I/usr/lib/perl5/5.6.1 -e 'use Test::Harness qw(&runtests $verbose); $verbose=0; runtests @ARGV;' t/*.t t/blacklist.........Can't locate Test/More.pm in @INC (@INC contains: blib/arch blib/lib /usr/lib/perl5/5.6.1/i386-linux /usr/lib/perl5/5.6.1/i386-linux /usr/lib/perl5/5.6.1/i386-linux /usr/lib/perl5/5.6.1 /usr/lib/perl5/5.6.1/i386-linux /usr/lib/perl5/5.6.1/i386-linux /usr/lib/perl5/5.6.1 /usr/lib/perl5/site_perl/5.6.1/i386-linux /usr/lib/perl5/site_perl/5.6.1/i386-linux /usr/lib/perl5/site_perl/5.6.1 /usr/lib/perl5/site_perl/5.6.1/i386-linux /usr/lib/perl5/site_perl/5.6.1 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.6.1/i386-linux /usr/lib/perl5/vendor_perl/5.6.1/i386-linux /usr/lib/perl5/vendor_perl/5.6.1 /usr/lib/perl5/vendor_perl/5.6.1/i386-linux /usr/lib/perl5/vendor_perl/5.6.1 /usr/lib/perl5/vendor_perl . /usr/lib/perl5/5.6.1/i386-linux /usr/lib/perl5/5.6.1 /usr/lib/perl5/site_perl/5.6.1/i386-linux /usr/lib/perl5/site_perl/5.6.1 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.6.1/i386-linux /usr/lib/perl5/vendor_perl/5.6.1 /usr/lib/perl5/vendor_perl .) at t/blacklist.t line 3. BEGIN failed--compilation aborted at t/blacklist.t line 3. t/blacklist.........dubious Test returned status 2 (wstat 512, 0x200) t/dnsrbl............Can't locate Test/More.pm in @INC (@INC contains: blib/arch blib/lib /usr/lib/perl5/5.6.1/i386-linux /usr/lib/perl5/5.6.1/i386-linux /usr/lib/perl5/5.6.1/i386-linux /usr/lib/perl5/5.6.1 /usr/lib/perl5/5.6.1/i386-linux /usr/lib/perl5/5.6.1/i386-linux /usr/lib/perl5/5.6.1 /usr/lib/perl5/site_perl/5.6.1/i386-linux /usr/lib/perl5/site_perl/5.6.1/i386-linux /usr/lib/perl5/site_perl/5.6.1 /usr/lib/perl5/site_perl/5.6.1/i386-linux /usr/lib/perl5/site_perl/5.6.1 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.6.1/i386-linux /usr/lib/perl5/vendor_perl/5.6.1/i386-linux /usr/lib/perl5/vendor_perl/5.6.1 /usr/lib/perl5/vendor_perl/5.6.1/i386-linux /usr/lib/perl5/vendor_perl/5.6.1 /usr/lib/perl5/vendor_perl . /usr/lib/perl5/5.6.1/i386-linux /usr/lib/perl5/5.6.1 /usr/lib/perl5/site_perl/5.6.1/i386-linux /usr/lib/perl5/site_perl/5.6.1 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.6.1/i386-linux /usr/lib/perl5/vendor_perl/5.6.1 /usr/lib/perl5/vendor_perl .) at t/dnsrbl.t line 3. BEGIN failed--compilation aborted at t/dnsrbl.t line 3. t/dnsrbl............dubious

2 1

Another redirector
by Patrik Nilsson 23 May '04

23 May '04

Hi, Might already be known, but since I haven't seen it mentioned, here's another redirector used in spam: urllog.com Actual example of spam using it available if needed. Patrik

3 2

Re: [SURBL-Discuss] Another redirector
by Patrik Nilsson 23 May '04

23 May '04

At 16:35 2004-05-22 +0200, Raymond Dijkxhoorn wrote: > > Might already be known, but since I haven't seen it mentioned, here's > > another redirector used in spam: > > urllog.com > > > > Actual example of spam using it available if needed. > >Please provide all info, or post it on the list. Then we can contact the >guys running the service and see if we can get them SURBL'ed. OK, wasn't sure submitting the actual example mail to the list was a reliable method as it might get blocked. Anyway - example attached. Patrik

2 2

Re: [SURBL-Discuss] RFC: Combined SURBL list details, phishing list ready
by Jeff Chan 23 May '04

23 May '04

On Saturday, May 22, 2004, 8:30:56 AM, Daniel Quinlan wrote: > Jeff Chan <jeffc(a)surbl.org> writes: >> So should I open an RFE in bugzilla to request handling of a >> combined SURBL list in urirhsbl (modulo the later updates of the > Yes. Done. >> corrected name multi.surbl.org and starting from .2 not .1)? > Why starting at .2 instead of .1? Don't you want to use all of the > bits available? Someone said that 127.0.0.1 in an RBL would cause general mail delivery problems, but I believe that might only apply to an RBL applied to message headers in an MTA, which SURBLs aren't. OPM uses the .1 bit, but it does it in the larger context of 127.1.0.x not 127.0.0.X, where .1 could perhaps run into the loopback address. http://opm.blitzed.org/info I suppose we could start with the 2,4,8 bits and expand back down to .1 if we feel it's safe later. Does that sound ok? >>> Default TTL for the combined list is generally the longest of the >>> included lists, which is six hours, while individual entries >>> inherit the shortest TTL which can be 10 minutes for sc data. >>> That allows individual entries to expire in BIND appropriately to >>> their data source. > Shouldn't the TTL be the shortest of the included lists? Yes, individual entries would get the shortest TTL if it appears on multiple lists. Jeff C.

1 0

RE: [SURBL-Discuss] DNS for dummies
by rleonard＠opto22.com 20 May '04

20 May '04

Written like a true, typical linux lurker! Sometimes it is better to have one on one with somebody who knows what they are doing, than going off of some text from Google.. I got a lot of great help, and got it running in less than an hour.. much less time than it would have taken me to research, read, test, re-research any questions and implement.. Another, better question is.. why do some people feel compelled to reply negatively rather than just ignore? I get more traffic on this newsgroup than I get SPAM.. most of it is completely beyond me, and I'm of no use to anybody.. but every once in a while I get a message from another newbie that is running into an issue I have already figured out.. and it is with pleasure I reply to them.. even though they probably could have just googled the answer themselves. The rest I glance at, and delete. Thanks again to everybody on this list that is helpful to those of us that are either new, time restricted or just plain lost.. -----Original Message----- From: Ralph Seichter [mailto:mailing-list@seichter.de] Sent: Thursday, May 20, 2004 4:08 AM To: SURBL Discussion list Subject: Re: [SURBL-Discuss] DNS for dummies rleonard(a)opto22.com wrote: > Has anybody written a "HOWTO DNS" for dummies.. Why don't people do their homework? Next time, use Google to search for "HOWTO DNS". It returned approximately 510,000 hits. -- Mit freundlichen Grüßen / Yours sincerely Dipl. Inform. Ralph Seichter HORUS-IT Ahornweg 10 D-57635 Oberirsen Tel +49 2686 987880 Fax +49 2686 987889 http://horus-it.de/ _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

3 2

Re: [SURBL-Discuss] Hatcheck: this one is a toughy for me....
by Patrik Nilsson 20 May '04

20 May '04

At 15:38 2004-05-20 -0400, Chris Santerre wrote: >205.236.189.57 = www.Default-Homepage-Network.com >thoughts on this? http://www.spamhaus.org/sbl/sbl.lasso?query=SBL9442 http://groups.google.com/groups?q=Default-Homepage-Network.com&scoring=d Pornspam and hijackware. Patrik

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss