Discuss

discuss@lists.surbl.org

1876 discussions

Redirects and obfuscated urls
by John Fawcett 13 Apr '04

13 Apr '04

I saw a post on NANAE over the weekend about surbl and it looks like one of the best ideas I've seen. Almost every spam mail I get contains a spamvertized domain, so with good data this method has the potential to block nearly 100% of spam. Spamvertized domains are an essential resource for spammers and are usually longer lived then the abused servers used to send out spam runs. I've set up SpamAssassin and SpamCopURI. I've checked the emails which are not being picked up by surbl and there is a recurring pattern: 1) Redirects 2) Obfuscated urls For example, this was not picked up. <a href=http://drs.yahoo.com/higherillomened./mensuraltalk/*%68ttp://enginery.s hopinternetbuy.biz/%75n%73ub.html target=_blank> shopinternetbuy.biz is in sc.surbl.org. The logic of the parsing engine needs to be enhanced to deal with these cases. This is probably only the start, because spammers will find other ways to get around surbl once it starts being used widely. I'd offer to look at it, but I wouldn't know where to start with perl. John

2 3

DNS load on slartibartfast.pa.net
by William Stearns 13 Apr '04

13 Apr '04

Good evening, all, It's still early in the project, but a few quick observations. Using dnstop and tethereal, I've seen that in the last 24 hours we've had 570K DNS queries to slart, the 5th/6th nameserver for {sa,sc}.surbl.org. 84% of those - 475K queries - have been to surbl.org. The next closest was in-addr.arpa with 12K and 7500 or less for everything else (that "everything else" category includes being a primary or secondary for 130 other domains and the primary nameserver for 28 machines). Of that 475K, 400K were to sc.surbl.org and 43K to sa.surbl.org. I suppose the rest were to jeff.chan.rox.surbl.org. *smile* More recent nameserver stats show the RBL is hovering around 90.2% of the queries to that nameserver. Oh, and did I mention that the nameserver is running on one of 27 User-Mode Linux virtual machines (*) running on top of a dual 1.4Ghz P3? The host machine load runs from 3.0 - 5.0 (but 2 of that is from the distributed.net CPU sponge, so really the load is 1.0 - 3.0). It'll be interesting to see just how high the load goes as more people come on, especially when SA 3.0 comes out. *gulp* :-) Cheers, - Bill * http://66.59.109.137:1500 , http://www.stearns.org/slartibartfast/uml-coop.current.html --------------------------------------------------------------------------- "NT 5.0 is the last nail in the Unix coffin. Interestingly, Unix isn't in the coffin... It's wondering what the heck is sealing itself into a wooden box 6 feet underground..." (Courtesy of Jason McMullan <jmcc(a)grits.visus.com>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

5 6

Here it comes.
by William Stearns 13 Apr '04

13 Apr '04

Good afternoon, all, The slashdot effect is probably hammering surbl.org right now. Someone posted surbl.org to http://slashdot.org/ The slashdot comments aren't terribly positive - I have no problem with that. I figure I'll keep contributing as long as it continues to be useful. Cheers, - Bill --------------------------------------------------------------------------- "NT 5.0 is the last nail in the Unix coffin. Interestingly, Unix isn't in the coffin... It's wondering what the heck is sealing itself into a wooden box 6 feet underground..." (Courtesy of Jason McMullan <jmcc(a)grits.visus.com>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

4 4

RFC: New name for sa.surbl.org
by Jeff Chan 13 Apr '04

13 Apr '04

OK Looks like someone (lol I'm nominated, I guess) needs to put his foot down and set a new name for sa.surbl.org, our RBL version of Bill Stearns' sa-blacklist SA ruleset. I suggested "sb", though that's slightly confusing with sc. Bill suggested ws or sb would work for him. Does anyone else have any comments or idea? We should change this soon before too many people start coding in "sa.surbl.org". Please comment if you have any. ;-) Thanks, Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

4 7

[SURBL-Discuss] Re: Simple install instructions for spamcopuri0.09 on Win32
by ITReading ITReading 13 Apr '04

13 Apr '04

I forgot to mention that my instructions are written from the point of view of a "Guinevere" (www.beginfinite.com) user and are written for users of Guinevere. However, I expect steps 1-7 to work on just about any Win32 implementation of SA (on ActivePerl 5.6.1). I hope this makes things a little clearer. Thanks! Charles >I have successfully installed SURBL support and have it up and running in my environment. > >I documented my procedures at www.aldridge-borden.com/surbl.html if anyone is interested. > >P.S. Jeff C, if you want to host this file somewhere on surbl.org, you certainly have my blessing. If its worth hosting. Even though >the instructions are really simple, they have been helpful to some Win32 users as they often aren't too Perl savvy (I'm one of >them!). > >Charles Solomon

2 2

[SURBL-Discuss] t/dnsrbl...........ok 4/6# Failed test (t/dnsrbl.t at line 25)
by Cal Evans 13 Apr '04

13 Apr '04

PERL Version 5.8.0 Everything seems to compile just fine but make test returns: PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/bad..............ok t/blacklist........ok t/cache............ok t/dnsrbl...........ok 4/6# Failed test (t/dnsrbl.t at line 25) t/dnsrbl...........NOK 5# Looks like you failed 1 tests of 6. t/dnsrbl...........dubious Test returned status 1 (wstat 256, 0x100) DIED. FAILED test 5 Failed 1/6 tests, 83.33% okay t/good.............ok t/ipaddress........ok t/longhostname.....ok t/mailto...........ok t/merge_urls.......ok t/shorthostname....ok t/spamcop_fetch....ok t/spamcopuri.......ok t/whitelist........ok Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------------- t/dnsrbl.t 1 256 6 1 16.67% 5 Failed 1/13 test scripts, 92.31% okay. 1/63 subtests failed, 98.41% okay. make: *** [test_dynamic] Error 255 Make install works but spamassassin --lint fails on the spamcop rule: Failed to compile URI SpamAssassin tests, skipping: (syntax error at /usr/share/spamassassin/81_spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 1, near "eval:" syntax error at /usr/share/spamassassin/20_uri_tests.cf, rule URI_OFFERS, line 175, near "; }" ) Anyone have any ideas? TIA! =C= * Cal Evans * http://www.eicc.com * We take care of your IT, * So you can take care of your business. * * I think inside the sphere.

2 1

[SURBL-Discuss] Simple install instructions for spamcopuri0.09 on Win32
by ITReading ITReading 12 Apr '04

12 Apr '04

I have successfully installed SURBL support and have it up and running in my environment. I documented my procedures at www.aldridge-borden.com/surbl.html if anyone is interested. P.S. Jeff C, if you want to host this file somewhere on surbl.org, you certainly have my blessing. If its worth hosting. Even though the instructions are really simple, they have been helpful to some Win32 users as they often aren't too Perl savvy (I'm one of them!). Charles Solomon

1 0

make test fail - SpamCopURI.pm line 117
by Jason Portwood 12 Apr '04

12 Apr '04

Greetings, I'm trying to install SpamCopURI and I've hit a snag on the make test Here's what I'm getting: PERL_DL_NONLAZY=1 /usr/bin/perl -Iblib/arch -Iblib/lib -I/usr/libdata/perl/5.00503/mach -I/usr/libdata/perl/5.00503 -e 'use Test::Harness qw(&runtests $verbose); $verbose=0; runtests @ARGV;' t/*.t t/bad...............syntax error at blib/lib/Mail/SpamAssassin/SpamCopURI.pm line 117, near "$f :" BEGIN failed--compilation aborted at t/bad.t line 5. # Looks like your test died before it could output anything. dubious Test returned status 2 (wstat 512, 0x200) DIED. FAILED tests 1-5 My perl version is: This is perl, version 5.005_03 built for i386-freebsd. I also installed the URI perl module that was needed. Any thoughts on what could be going on? I may just move on to SpamAssassin 3.0 with the 3.0 plugin and see if it clears up. Thank you, Jason Portwood jason(a)wkrp.com

2 2

Slashdot about SURBL
by Jeff Chan 12 Apr '04

12 Apr '04

Made Slashdot: http://slashdot.org/ A New Type Of Realtime Blocklist: The SURBL Posted by timothy on Monday April 12, @05:02PM from the chicken-egg-spam dept. Glamdrlng writes "The SURBL, or "Spam URI Realtime Blocklist", represents a nexus of RBL's and content filtering that may bring us one step closer to a spam magic bullet. While traditional RBL's perform a DNS lookup on the connecting mail server, SURBL's take this a step further by parsing the text of the email looking for URI's and doing a lookup on those web servers. They also prevent "joe jobs" by maintaining a whitelist of legitimate web servers whose domain names may show up in spam messages, e.g. EBay, Paypal, Microsoft, etc. The only requirement to implement the SURBL is a plugin on your MTA such as spamassassin that can parse the body of each email. While there is no MTA that directly supports SURBL's without a plugin, the author hints at one being in development." http://yro.slashdot.org/yro/04/04/12/1956252.shtml?tid=111&tid=126&tid=95 Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Ok you asked for it - lol
by Paul Barbeau 12 Apr '04

12 Apr '04

I can not get this to work and i know this is a double post so sorry about that I am using OpenBSD and i update Storable in CPAN and when i run "URI::QueryParam" i get "is up to date" however i am still getting t/bad..............ok t/blacklist........ok t/cache............ok t/dnsrbl...........NOK 5# Failed test (t/dnsrbl.t at line 25) t/dnsrbl...........ok 6/6# Looks like you failed 1 tests of 6. t/dnsrbl...........dubious Test returned status 1 (wstat 256, 0x100) DIED. FAILED test 5 Failed 1/6 tests, 83.33% okay t/good.............ok

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss