You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by Jari Fredriksson <ja...@iki.fi> on 2016/06/03 08:32:16 UTC
Rule URIBL_SBL
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I guess that is just some external list causing the hit, but I got these
in a 190% HAM:
1.6 URIBL_SBL Contains an URL's NS IP listed in the SBL
blocklist
[URIs: <munged>.com]
0.1 URIBL_SBL_A Contains URL's A record listed in the SBL
blocklist
[URIs: <munged>.com]
The DNS name <munged> appears ONLY as receiver's DNS name, and some
footer declaration where the sender tells me that I am a opted in
customer with this email, and that...
The sender is IBM and I work in the munged.com as a partner to IBM.
What can I do to get rid of this annoyance? I mean URIBL_SBL. I went to
Spam House and tried their website to find out it we are there, and so.
It responds:
<munged> is not listed in the DBL
- --
jarif@iki.fi
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAldRQJAACgkQKL4IzOyjSrY1OACfe5s+2vXw0HEu9SuMwGUvFsUE
wO0AoPzIYHWOl7MB34+oPWQCd0XZfses
=cXry
-----END PGP SIGNATURE-----
Re: Rule URIBL_SBL
Posted by Jari Fredriksson <ja...@iki.fi>.
3. kes�kuuta 2016 14.23.17 GMT+03:00 RW <rw...@googlemail.com> kirjoitti:
>On Fri, 03 Jun 2016 11:32:16 +0300
>Jari Fredriksson wrote:
>
>
>> I guess that is just some external list causing the hit, but I got
>> these in a 190% HAM:
>>
>>
>> 1.6 URIBL_SBL Contains an URL's NS IP listed in the SBL
>> blocklist
>> [URIs: <munged>.com]
>> 0.1 URIBL_SBL_A Contains URL's A record listed in the SBL
>> blocklist
>> [URIs: <munged>.com]
>
>> <munged> is not listed in the DBL
>
>It's not the domain that's listed. As the descriptions say, the IP
>addresses of the web-server and it's DNS server are listed in the SBL
>blocklist.
The IP is hosted by hetzner.de, should not send spam, and dns server is google-gloud-dns ...
Quite strange this...
The IP is only a week old, I put it up. To serve secure email and ecommerce solutions ;)
--
L�hetetty Android-laitteestani K-9 Maililla. Pahoittelut v�h�sanaisuudestani.
Re: Rule URIBL_SBL
Posted by Benny Pedersen <me...@junc.eu>.
On 2016-06-03 20:31, Jari Fredriksson wrote:
> This is not a compromized email-server, but a web-server. Email is
> handled by Google Apps Mail (GMail).
let say it never happend
https://www.google.dk/search?q=gmail+compromized
Re: Rule URIBL_SBL
Posted by Jari Fredriksson <ja...@iki.fi>.
On 3.6.2016 20.55, Benny Pedersen wrote:
> On 2016-06-03 15:35, Jari Fredriksson wrote:
>
>> Thanks for the feedback off-list! The site my employee has bought from
>> external provider seems to be compromised. I got to send my 1st
>> commercial to my my own CEO & Other management about my new offerings.
>
> http://www.protonmail.com/
>
> jusst not DANE-ONLY yet
>
> but prette good anyway with android and ios
>
> ymmi
>
>
This is not a compromized email-server, but a web-server. Email is
handled by Google Apps Mail (GMail).
--
jarif.bit
Re: Rule URIBL_SBL
Posted by Benny Pedersen <me...@junc.eu>.
On 2016-06-03 15:35, Jari Fredriksson wrote:
> Thanks for the feedback off-list! The site my employee has bought from
> external provider seems to be compromised. I got to send my 1st
> commercial to my my own CEO & Other management about my new offerings.
http://www.protonmail.com/
jusst not DANE-ONLY yet
but prette good anyway with android and ios
ymmi
Re: Rule URIBL_SBL
Posted by Jari Fredriksson <ja...@iki.fi>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Jari Fredriksson kirjoitti 3.6.2016 15:11:
> RW kirjoitti 3.6.2016 14:58:
>> On Fri, 03 Jun 2016 14:43:20 +0300
>> Jari Fredriksson wrote:
>>
>>
>>> >It's not the domain that's listed. As the descriptions say, the IP
>>> >addresses of the web-server and it's DNS server are listed in the SBL
>>> >blocklist.
>>>
>>> The SENDER webserver and dns? That is ibm.com ... or something
>>> related.
>>
>>
>> SA parses-out anything in the body that looks like a domain, including
>> the RHS of an address. It would be the part where it says you opted-in.
>
> I can send the mail offlist to someone, if somebody wants to see it. I
> want to know if the problem is in our end or ibm's ... That's all.
Thanks for the feedback off-list! The site my employee has bought from
external provider seems to be compromised. I got to send my 1st
commercial to my my own CEO & Other management about my new offerings.
Wow ;)
- --
jarif@iki.fi
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAldRh58ACgkQKL4IzOyjSraF8ACg5/N/ifEDQVKHUStmPsDhuF44
MCEAn0hUI3eV0aNTBI8y7dI1oRiSDPdo
=ivyu
-----END PGP SIGNATURE-----
Re: Rule URIBL_SBL
Posted by Jari Fredriksson <ja...@iki.fi>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
RW kirjoitti 3.6.2016 14:58:
> On Fri, 03 Jun 2016 14:43:20 +0300
> Jari Fredriksson wrote:
>
>
>> >It's not the domain that's listed. As the descriptions say, the IP
>> >addresses of the web-server and it's DNS server are listed in the SBL
>> >blocklist.
>>
>> The SENDER webserver and dns? That is ibm.com ... or something
>> related.
>
>
> SA parses-out anything in the body that looks like a domain, including
> the RHS of an address. It would be the part where it says you opted-in.
I can send the mail offlist to someone, if somebody wants to see it. I
want to know if the problem is in our end or ibm's ... That's all.
- --
jarif@iki.fi
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAldRc/gACgkQKL4IzOyjSrbUtwCeIjJGEmxjUZjw4xSIc7yaTN6X
MosAni6/Ux2TPgTRchU9lp6wmTfzeUS6
=5dps
-----END PGP SIGNATURE-----
Re: Rule URIBL_SBL
Posted by RW <rw...@googlemail.com>.
On Fri, 03 Jun 2016 14:43:20 +0300
Jari Fredriksson wrote:
> >It's not the domain that's listed. As the descriptions say, the IP
> >addresses of the web-server and it's DNS server are listed in the SBL
> >blocklist.
>
> The SENDER webserver and dns? That is ibm.com ... or something
> related.
SA parses-out anything in the body that looks like a domain, including
the RHS of an address. It would be the part where it says you opted-in.
Re: Rule URIBL_SBL
Posted by Jari Fredriksson <ja...@iki.fi>.
3. kes�kuuta 2016 14.23.17 GMT+03:00 RW <rw...@googlemail.com> kirjoitti:
>On Fri, 03 Jun 2016 11:32:16 +0300
>Jari Fredriksson wrote:
>
>
>> I guess that is just some external list causing the hit, but I got
>> these in a 190% HAM:
>>
>>
>> 1.6 URIBL_SBL Contains an URL's NS IP listed in the SBL
>> blocklist
>> [URIs: <munged>.com]
>> 0.1 URIBL_SBL_A Contains URL's A record listed in the SBL
>> blocklist
>> [URIs: <munged>.com]
>
>> <munged> is not listed in the DBL
>
>It's not the domain that's listed. As the descriptions say, the IP
>addresses of the web-server and it's DNS server are listed in the SBL
>blocklist.
The SENDER webserver and dns? That is ibm.com ... or something related.
--
L�hetetty Android-laitteestani K-9 Maililla. Pahoittelut v�h�sanaisuudestani.
Re: Rule URIBL_SBL
Posted by RW <rw...@googlemail.com>.
On Fri, 03 Jun 2016 11:32:16 +0300
Jari Fredriksson wrote:
> I guess that is just some external list causing the hit, but I got
> these in a 190% HAM:
>
>
> 1.6 URIBL_SBL Contains an URL's NS IP listed in the SBL
> blocklist
> [URIs: <munged>.com]
> 0.1 URIBL_SBL_A Contains URL's A record listed in the SBL
> blocklist
> [URIs: <munged>.com]
> <munged> is not listed in the DBL
It's not the domain that's listed. As the descriptions say, the IP
addresses of the web-server and it's DNS server are listed in the SBL
blocklist.