Discuss

discuss@lists.surbl.org

2 participants
1873 discussions

another new TLD?
by Chris Santerre 26 Aug '04

26 Aug '04

File.to from http://File.to/ooo OK to add as well? Looks like spammers are trying to get around the standard com, net, info , biz. --Chris

3 2

SpamCop URI Compilation
by Robin, Rob 26 Aug '04

26 Aug '04

All, My company has the policy of not throwing away default build from the OS install. Therefore, all my perl libs have been compiled under /usr/local/blah/blah without doing UNINST=1. After downloading all the necessary modules, etc, I am close to getting Spamcop URI compile. Details: Perl 5.005_03, SpamAssassin 2.63. perl ./Makefile.PL went through fine. Problem w/ it is extract_url.t test script. PERL5LIB="/usr/local/spamassassin/2.63/lib: /usr/local/perl5lib/HTML/Parser/3.26/lib: /usr/local/perl5lib/File/Spec/0.82/lib:/usr/local/perl5lib/URI/1.31/lib /usr/local/perl5lib/Test/Simple/0.47/lib /usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker /usr/local/perl5lib/podlators/1.27/lib /usr/local/perl5lib/Pod/Parser/1.28/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22" Export PERL5LIB The reason why I called the test script directly is because "make test" put my PERL5LIB directories as a less preferred lib and thus loaded older version of other libs that failed. I needed to circumvent by calling the test script directly. All the test scripts passed, except extract_urls.t. I defined "/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib" as part of PERL5LIB, since I know that SpamCopURI.pm is located at /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin/SpamCopURI.pm. Perl -V confirms that everything is defined properly. From the error message, could it be my perl version is too old ? Please note that all other test scripts went through just fine. bash-2.02# perl ./t/extract_urls.t 1..23 Undefined subroutine &Mail::SpamAssassin::SpamCopURI::_extract_urls called at ./t/extract_urls.t line 46. # Looks like your test died before it could output anything. Any input will be appreciated. #Perl -V (output). I verify that all the dir for my PERL5LIB existed just fine. Characteristics of this binary (from libperl): Built under bsdos Compiled at Oct 8 2000 21:58:54 %ENV: PERL5LIB="/usr/local/spamassassin/current/lib:/usr/local/perl5lib/HTML/Parser/current/lib:/usr/local/perl5lib/File/Spec/current/lib:/usr/local/perl5lib/URI/current/lib:/usr/local/perl5lib/Test/Simple/current/lib:/usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker:/usr/local/perl5lib/podlators/current/lib:/usr/local/perl5lib/Pod/Parser/current/lib:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin:/usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22" @INC: /usr/local/spamassassin/current/lib /usr/local/perl5lib/HTML/Parser/current/lib /usr/local/perl5lib/File/Spec/current/lib /usr/local/perl5lib/URI/current/lib /usr/local/perl5lib/Test/Simple/current/lib /usr/local/perl5lib/ExtUtils/MakeMaker/6.21/lib/ExtUtils/MakeMaker /usr/local/perl5lib/podlators/current/lib /usr/local/perl5lib/Pod/Parser/current/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22/lib/Mail/SpamAssassin /usr/local/src/20040807/Mail-SpamAssassin-SpamCopURI-0.22 /usr/libdata/perl5/5.00503/i386-bsdos /usr/libdata/perl5/5.00503 /usr/libdata/perl5/site_perl/i386-bsdos /usr/libdata/perl5/site_perl /usr/libdata/perl5/site_perl/i386-bsdos/include . Thanks, ------------------------ Rob Robin Network Analyst Green Apple, Inc. 740-653-9890 rrobin(a)greenapple.com www.greenapple.com Internet access, hosting and development solutions since 1995.

2 1

RE: [SURBL-Discuss] Strange happenings...
by Chris Santerre 26 Aug '04

26 Aug '04

Older Steve submission. Yup same file. And I can see why these guys would have been added. Looks like spammers were using a spacer.gif image from them in theis spams. Hence lots of NANAS hits. This was before we looked for posion like this. Removed. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, August 18, 2004 9:52 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Strange happenings... > > >On Wednesday, August 18, 2004, 6:17:26 PM, Bill Landry wrote: > >> Replying to my own post. I see now that the URI above gets >redirected to: > >> >http://qspace.iplace.MUNGEDcom/cobrands/41/?sc=1452NLCRamp;&CM= MHHNewsletterServices&CE=TextArea3 > >> and "iplace.com" is listed in WS. So my next questions is, should >> "iplace.com" be listed in WS? > >Probably not. Anyone know if these guys are spammers or why it's >on WS? > >Name: icreditreport.com >Address: 205.180.159.210 >Aliases: qspace.iplace.com > >If this appeared in a legitimate message, then we probably should >whitelist. Was it in a ham? > >Comments? > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

3 2

New tld?
by Chris Santerre 26 Aug '04

26 Aug '04

I've never seen this TLD??? www.sdlkjfdd.it.tt Can I add to surbl? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

4 3

RE: [SURBL-Discuss] WS FP greenfieldonline.com
by Chris Santerre 26 Aug '04

26 Aug '04

http://media.greenfieldonline.com/images/sample/greenrtop.jpg http://media.greenfieldonline.com/images/sample/first600.jpg "Free chances to win cash and prizes by filling surveys ------------------------------------------------------ $$$ (added 11/6/2000) Free Sweepstakes GreenfieldOnline.com is a survey-based site that wants your input on consumer products and services. Register for free to fill out their surveys and you could win any of their great cash and prize giveaways. http://www.bonustree.com/freebies/greenfield.html " http://signup.greenfieldonline.com/welcome.asp?wm=3823 And after all that... I actually feel like they are legit. Go figure! remove, no whitelist. (RNW - new term?) +1 RNW --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, August 26, 2004 4:52 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] WS FP greenfieldonline.com > > >WS folks, please consider removing greenfieldonline.com > >Looks white hat. > >Jeff C. >__ > >From: Jeff Chan >To: "Bill Landry" >Date: Thursday, August 26, 2004, 1:07:10 AM >Subject: WS FP? > >===8<==============Original message text=============== >On Thursday, August 26, 2004, 12:19:32 AM, Bill Landry wrote: >> Jeff, I am sending this directly to you since the list will >not deliver HTML >> e-mail attachments. Anyway, here is another MSN newsletter >with a redirect >> to greenfieldonline.MUNGEDcom that is listed in WS. The >actual link can be >> found under "Hot Offers" near the top right side of the >e-mail: "Win $2,500 >> cash for a vacation" > >> Thoughts on this one? > >> Bill > >Hi Bill, >They look legitimate to me so I whitelisted greenfieldonline.com > >Do you mind if I forward this to the discussion list? It can >be better to do these publically. > >Including the newsletter could be done as a text paste of the >raw message, but in this case it's probably not necessary. > >Jeff C. >-- >Jeff Chan >mailto:jeffc@surbl.org >http://www.surbl.org/ > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

WS FP greenfieldonline.com
by Jeff Chan 26 Aug '04

26 Aug '04

WS folks, please consider removing greenfieldonline.com Looks white hat. Jeff C. __ From: Jeff Chan To: "Bill Landry" Date: Thursday, August 26, 2004, 1:07:10 AM Subject: WS FP? ===8<==============Original message text=============== On Thursday, August 26, 2004, 12:19:32 AM, Bill Landry wrote: > Jeff, I am sending this directly to you since the list will not deliver HTML > e-mail attachments. Anyway, here is another MSN newsletter with a redirect > to greenfieldonline.MUNGEDcom that is listed in WS. The actual link can be > found under "Hot Offers" near the top right side of the e-mail: "Win $2,500 > cash for a vacation" > Thoughts on this one? > Bill Hi Bill, They look legitimate to me so I whitelisted greenfieldonline.com Do you mind if I forward this to the discussion list? It can be better to do these publically. Including the newsletter could be done as a text paste of the raw message, but in this case it's probably not necessary. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

RE: [SURBL-Discuss] Need help classifying a domain, solis2.365med ia.com
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, August 25, 2004 2:52 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Need help classifying a domain, >solis2.365media.com > > >On Wednesday, August 25, 2004, 7:51:13 AM, Chris Santerre wrote: >> Here is a link from a pure spam! No doubt in my mind it is >spam. However I'm >> not sure if the domain has legit purposes. > >> http://solis2.365media.com/galepublishing/AWDD/public/signin.asp > >365media.com was registered in 1998 and is in the U.S. >Chances are that they would probably not have survived >this long if they were a spam gang. > >To me a "pure spam" comes from a zombie and points to >a site at a spam-friendly ISP in China, Korea or Brazil. 1/2 ;-) > After further investigation, I have to go run over the head of marketing with my sports car. *sigh* it isn't a spam domain at all. An ISP in asia is blocking our company as a spammer :) IT would be funnier if a few of our vendors were not on that ISP :/ --Chris

1 0

Need help classifying a domain, solis2.365media.com
by Chris Santerre 25 Aug '04

25 Aug '04

Here is a link from a pure spam! No doubt in my mind it is spam. However I'm not sure if the domain has legit purposes. http://solis2.365media.com/galepublishing/AWDD/public/signin.asp Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

RE: [SURBL-Discuss] Fw: Your August eNewsletter from U.S. Bank
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 9:40 PM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] Fw: Your August eNewsletter from U.S. Bank > > >On Tuesday, August 24, 2004, 5:41:36 PM, Bill Landry wrote: >> ----- Original Message ----- >> From: "Jeff Chan" <jeffc(a)surbl.org> >> To: "Bill Landry" <billl(a)pointshare.com> >> Sent: Tuesday, August 24, 2004 5:28 PM >> Subject: Re: [SURBL-Discuss] Fw: Your August eNewsletter >from U.S. Bank > > >>> Hi Bill, >>> Can you forward it to me dierctly? > >> Oh, an one other key component as part of my test, I didn't >actually receive >> the newsletter that I forwarded to you until after I logged >onto my US Bank >> online account and subscribed it on the official US Bank web site. > >OK That's pretty important. You actually opted in and got the >newsletter with those references. > >Jeff C. Yes, I officially go on record as saying usbank and usbank-email should both be whitelisted. --Chris

1 0

RE: [SURBL-Discuss] FP in WS & DS?
by Chris Santerre 25 Aug '04

25 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, August 24, 2004 7:41 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] FP in WS & DS? > > >On Tuesday, August 24, 2004, 3:15:16 PM, Bill Landry wrote: >> ----- Original Message ----- >> From: "Raymond Dijkxhoorn" <raymond(a)prolocation.net> > >>> > And you know for a fact that they did not subscribe to >the newsletter? >> I am >>> > a US Back customer and I have never received their >newsletter (and they >>> > certainly have my e-mail address since I do online >banking with them) >> until >>> > just now, when I subscribed to it for testing purposes. >>> >>> I am not a customer, heck, i dont even know that US bank at >all, but i >>> have at least 10 fresh ones in my spamtrap, on never used >domains/address >>> combinations. They are a known fishing target. > >> No one is disputing that, certainly not me, since I report >US Bank phishing >> e-mails to PH almost daily. However, don't confuse these >phishing e-mails >> with "legitimate", subscription based, e-mails coming >directly from US Bank. >> Remember, they are a legitimate, national banking >institution and have a >> right to send out legitimate e-mail newsletters to their >subscribers without >> having them unnecessarily and erroneously blocked. > >> Would you dispute this? > >So bottom line: is usbank-email.com legitimate and being >mentioned in a phish? Does the phish actually direct victims >to a different site? > This is a legit site being mentioned in a fish. They should not be listed in SURBL. --Chris (I found my keys!)

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss