Discuss

discuss@lists.surbl.org

1876 discussions

Stupid SPAM
by Jose-Marcio.Martins＠ensmp.fr 11 May '04

11 May '04

Hello, Take a look at this SPAM : http://www.ensmp.fr/~martins/Prozac Mainly, check the source. The problem is that it comes with many, many URLs. At the beginning, there are URLs needed by the SPAM itself. After, it puts many URLs with font size equals to 1. Most of these last domains aren't spam... 8-) Jose-Marcio -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

5 10

SpamCopURI rpms
by Robert Brooks 10 May '04

10 May '04

Hi, I've created binary and source rpms which can be found here: http://www.elvis.demon.co.uk/SpamCopURI/ I will look at improving these and better integration with SpamAssassin rpms over the next few weeks, but in the mean time your feedback is welcome. Note it is likely you will have to --force the install so that the common files with SpamAssassin are replaced. It is _strongly recommended_ that you build from the source rpm on your system as the binaries are built on RedHat 7.3 and may not suit your systems. rpm --rebuild perl-Mail-SpamAssassin-SpamCopURI-0.15-1.src.rpm It likely I will also share some related rpms in the near future. If anyone has a better place to host the rpms let me know. Regards, Rob -- Robert Brooks, Network Manager, Cable & Wireless UK <robb(a)hyperlink-interactive.co.uk> http://hyperlink-interactive.co.uk/ Tel: +44 (0)20 7240 8121 Fax: +44 (0)20 7240 8098 - Help Microsoft stamp out piracy. Give Linux to a friend today! -

3 2

Re: [Possible Spam] New Redirector?
by Carl Hutzler 08 May '04

08 May '04

Yes, we are aware of it and working to shut it down. It is not easy at all due to how the system works (as is the case with many redirector URLs). Feel free to block the URL completely. It is only serving ads for AOL partners really. Should not be a big problem if you can block URLs in your antispam SW. -Carl david(a)platformnetworks.net wrote: >============================================================================== > MAIL SECURITY MESSAGE >============================================================================== > >Mail Security is not 100% sure if the attached message is spam or not and >needs your help to decide. > > >How to help: >-------------------------- >If the attached message is not spam, please forward this email to >notspam(a)mailsecurity.net.au so we can correct our database, which will >stop future messages of this type from being intercepted. > >If the attached message is spam, please delete this message and future >messages like this will be blocked. > >Attached Message Details: >-------------------------- >From: david(a)platformnetworks.net >Subject: New Redirector? > >Thankyou for your help, your assistance helps us to keep our databases as >up to date as possible. >-- >Kind Regards, > >Mail Security >www.mailsecurity.net.au > > >======================================================================== > Pain free spam & virus protection by: www.mailsecurity.net.au > Forward undetected SPAM to: spam(a)mailsecurity.net.au >======================================================================== > > > > > ------------------------------------------------------------------------ > > Subject: > New Redirector? > From: > "David Hooton" <david(a)platformnetworks.net> > Date: > Fri, 7 May 2004 15:38:40 +1000 > To: > <discuss(a)lists.surbl.org> > > > Hi All, > > Just found an AOL redirector being abused in a spam: > >http://www.aol.com/ams/clickThruRedirect.adp?1= > >073757372,2147618210x2147531923,http://www.freeyouraccounts.com/stressfree/= > > Not sure if it’s included in the SURBL/SpamCopURI redirector list yet > or not – is this published anywhere? > > Regards, > > David Hooton > > Senior Partner > > Platform Networks > > www.platformnetworks.net > -- Carl Hutzler Director, AntiSpam Operations America Online Mail Operations cdhutzler(a)aol.com 703.265.5521 work 703.915.6862 cell

2 1

Re: [SURBL-Discuss] Should bravemouser.com be blacklisted?
by Jeff Chan 08 May '04

08 May '04

On Friday, May 7, 2004, 3:08:13 PM, ITReading ITReading wrote: >>>> Jeff Chan <jeffc(a)surbl.org> 05/07/2004 4:45:22 PM >>> >>I don't see any reports about it to SpamCop. You may want to >>do that. > That's interesting. I submit all my "false negatives" to > Spamcop. I know I've submitted at least a dozen or so ". . . > bravemouser.com . ." messages. When I tried processing your message I got the message from SpamCop saying ~"ISP says problem will cease". So the ISP is presumably working on it. Let me know if the spam continues, and I'll add bravemouser.com to my manual blacklist. Jeff C.

1 0

Should bravemouser.com be blacklisted?
by ITReading ITReading 07 May '04

07 May '04

Hello all, I continue to receive messages with URIs to "bravemouser.com" in the past few weeks. Should this domain be added to one of the surbl lists? Most of the messages are TV Pay Per View spam. An example of one of the messages can be found here: http://www.aldridge-borden.com/bravemouser.txt -Charles Solomon

2 1

Fwd: URI's not recognized
by Jeff Chan 07 May '04

07 May '04

This is a forwarded message From: Menno van Bennekom <mvbengro(a)xs4all.nl> To: spamassassin-users(a)incubator.apache.org Date: Friday, May 7, 2004, 3:35:37 AM Subject: URI's not recognized ===8<==============Original message text=============== Hi, I have problems getting URI's recognized by SpamAssassin 2.63 (postfix/amavisd-new). At first redirects like this were not recognized: http://rd.yahoo.com*http://spammer.spam.biz So I removed ^ from the BIZ expression: uri BIZ_TLD /(?:https?:\/\/|mailto:)[^\/]+\.biz(?:\/|$)/i Still the following was not recognized: <a href=3Dhttp://away.goingabroadd.biz/aps/cms/> Because of the 3D (and other stuff spammers put there lately). Only by changing 'uri BIZ_TLD' to 'body BIZ_TLD' it gets recognized. But I use SpamCopURI and that also doesn't recognize URI's with things in front of http. And I can't tell SpamCopURI to use the 'body' check instead or uri.. How can I make the URI subroutine recognize these URI's? Would using SpamAssassin v3.0 help? Thanks Menno ===8<===========End of original message text===========

3 2

Make test problems in 0.15
by Brian Ipsen 07 May '04

07 May '04

Hi, When doing "make test" with 0.15 I get: t/blacklist........ok t/dnsrbl...........ok t/extract_urls.....ok t/mailto...........ok t/open_redirect....ok 5/6# Failed test (t/open_redirect.t at line 71) t/open_redirect....NOK 6# Looks like you failed 1 tests of 6. t/open_redirect....dubious Test returned status 1 (wstat 256, 0x100) DIED. FAILED test 6 Failed 1/6 tests, 83.33% okay t/spamcopuri.......ok t/whitelist........ok Failed Test Stat Wstat Total Fail Failed List of Failed ---------------------------------------------------------------------------- --- t/open_redirect.t 1 256 6 1 16.67% 6 Failed 1/7 test scripts, 85.71% okay. 1/42 subtests failed, 97.62% okay. Is a module missing - or need to be updated ?? /Brian

3 2

New Redirector?
by David Hooton 07 May '04

07 May '04

Hi All, Just found an AOL redirector being abused in one of our spamtraps.. The url is on www.aol.com/ams/clickThruRedirect.adp If you need an exact copy of it I can provide it. Not sure if its included in the SURBL/SpamCopURI redirector list yet or not is this published anywhere? Regards, David Hooton Senior Partner Platform Networks www.platformnetworks.net ======================================================================== Pain free spam & virus protection by: www.mailsecurity.net.au Forward undetected SPAM to: spam(a)mailsecurity.net.au ========================================================================

3 4

ANNOUNCE: Mail::SpamAsssassin::SpamCopURI 0.15
by Eric Kolve 07 May '04

07 May '04

I have just released SpamCopURI 0.15. I have fixed a few bugs that were reported and also added some url extraction so open_redirect resolution isn't need any longer for urls that redirect through google.com, msn.com, yahoo.com or any site that redirects based on a url being passed in the query or path portion. The install *should* be smoother. The Makefile.PL now attempts to detect where SpamAssassin was installed and place itself in that directory. See the Changes file for a complete list. https://sourceforge.net/projects/spamcopuri/ --eric

2 1

[SURBL-Discuss] Fwd: Re: svn commit: rev 10552 - in incubator/spamassassin/trunk: lib/Mail/SpamAssassin t t/data/spam
by Jeff Chan 07 May '04

07 May '04

Justin points out a feature that would be nice to back-port into SA 2.63.... From: Justin Mason To: spamassassin-users Date: Thursday, May 6, 2004, 9:50:17 PM Subject: svn commit: rev 10552 - in incubator/spamassassin/trunk: lib/Mail/SpamAssassin t t/data/spam Justin writes: > Author: jm > Date: Thu May 6 21:36:42 2004 > New Revision: 10552 > > Modified: > incubator/spamassassin/trunk/lib/Mail/SpamAssassin/Util.pm > incubator/spamassassin/trunk/t/data/spam/009 > incubator/spamassassin/trunk/t/uri.t > Log: > spam spotted in wild evading URIBL, so deal with several URI obfuscations: http://0x425c45de/, http://66.92.0x45.221/, http://1113343455/, http://slashdot.org@1113343456/ in get_uri_list Jeff C et al -- I'm not sure how the SpamAssassin 2.63 code deals with this, but I'd suspect it'd miss those URLs... I've just checked in a fix in 3.0.0, so it might be worth porting it over. - --j.

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss