You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Jon Bjorn Njalsson <jo...@mbl.is> on 2007/01/17 11:24:45 UTC
URIBL
Is it possible to have SA find URL in a mail and lookup the ipaddress
for the URL and check if that ipaddress is listed in some rbl zone and
score acordingly.
Example, I reveice lot of spam containing URL like
http://www.thesillyguy.info or thenopers.info and these sites all
resolve to the same ipaddress 216.40.47.17. Instead of writing rules
based on these sites is it possible to write a rule based on the
ipaddress ?
Re: URIBL
Posted by Chris Purves <ch...@northfolk.ca>.
Jon Bjorn Njalsson wrote:
> Is it possible to have SA find URL in a mail and lookup the ipaddress
> for the URL and check if that ipaddress is listed in some rbl zone and
> score acordingly.
>
> Example, I reveice lot of spam containing URL like
> http://www.thesillyguy.info or thenopers.info and these sites all
> resolve to the same ipaddress 216.40.47.17. Instead of writing rules
> based on these sites is it possible to write a rule based on the
> ipaddress ?
>
Your e-mail hit the following rules for me:
* 3.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist
* [URIs: thenopers.info thesillyguy.info]
* 4.1 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
* [URIs: thenopers.info thesillyguy.info]
I have 'loadplugin Mail::SpamAssassin::Plugin::URIDNSBL' set in init.pre.
--
Chris
Re: URIBL
Posted by Nigel Frankcom <ni...@blue-canoe.net>.
On Wed, 17 Jan 2007 14:46:36 +0000, Jon Bjorn Njalsson
<jo...@mbl.is> wrote:
>I have Net::DNS module installed.
>
>
>[14934] dbg: dns: is Net::DNS::Resolver available? yes
>[14934] dbg: dns: Net::DNS version: 0.57
>
>and
>
>[14934] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from
>@INC
>[14934] dbg: plugin: registered
>Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xa5822f0)
>
>and in v310.pre i have
>
>loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
>
>but still spam regarding penis enlargement (some) are getting through.
>
>any other ideas ?
>
>
>
>On mið, 2007-01-17 at 11:32 +0000, Martin.Hepworth wrote:
>> Jon
>>
>> Yes this functionality has been built in since SA version 3.0 (and via
>> an additional 'plugin' since 2.6.?4?).
>>
>> Make sure you are using network tests, Net::DNS perl module is installed
>> and the URI-RBL plugin is enabled in the *.pre files which are located
>> in the same place as local.cf (normally /etc/mail/spamassassin).
>>
>>
>> --
>> Martin Hepworth
>> Snr Systems Administrator
>> Solid State Logic
>> Tel: +44 (0)1865 842300
>>
>> > -----Original Message-----
>> > From: Jon Bjorn Njalsson [mailto:jonbjorn@mbl.is]
>> > Sent: 17 January 2007 10:25
>> > To: users@spamassassin.apache.org
>> > Subject: URIBL
>> >
>> > Is it possible to have SA find URL in a mail and lookup the ipaddress
>> > for the URL and check if that ipaddress is listed in some rbl zone and
>> > score acordingly.
>> >
>> > Example, I reveice lot of spam containing URL like
>> > http://www.thesillyguy.info or thenopers.info and these sites all
>> > resolve to the same ipaddress 216.40.47.17. Instead of writing rules
>> > based on these sites is it possible to write a rule based on the
>> > ipaddress ?
>> >
>> >
Net::DNS, version 0.59 is the current version. It upgrades clean
through CPAN or yum
0.57 can have some odd effects.
Nigel
RE: URIBL
Posted by "Martin.Hepworth" <ma...@solidstatelogic.com>.
Jon
Dcc, pyzor (using a working server) and razor are useful..
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
> -----Original Message-----
> From: Jon Bjorn Njalsson [mailto:jonbjorn@mbl.is]
> Sent: 17 January 2007 14:47
> To: Martin.Hepworth
> Cc: users@spamassassin.apache.org
> Subject: RE: URIBL
>
> I have Net::DNS module installed.
>
>
> [14934] dbg: dns: is Net::DNS::Resolver available? yes
> [14934] dbg: dns: Net::DNS version: 0.57
>
> and
>
> [14934] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from
> @INC
> [14934] dbg: plugin: registered
> Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xa5822f0)
>
> and in v310.pre i have
>
> loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
>
> but still spam regarding penis enlargement (some) are getting through.
>
> any other ideas ?
>
>
>
> On mið, 2007-01-17 at 11:32 +0000, Martin.Hepworth wrote:
> > Jon
> >
> > Yes this functionality has been built in since SA version 3.0 (and
via
> > an additional 'plugin' since 2.6.?4?).
> >
> > Make sure you are using network tests, Net::DNS perl module is
installed
> > and the URI-RBL plugin is enabled in the *.pre files which are
located
> > in the same place as local.cf (normally /etc/mail/spamassassin).
> >
> >
> > --
> > Martin Hepworth
> > Snr Systems Administrator
> > Solid State Logic
> > Tel: +44 (0)1865 842300
> >
> > > -----Original Message-----
> > > From: Jon Bjorn Njalsson [mailto:jonbjorn@mbl.is]
> > > Sent: 17 January 2007 10:25
> > > To: users@spamassassin.apache.org
> > > Subject: URIBL
> > >
> > > Is it possible to have SA find URL in a mail and lookup the
ipaddress
> > > for the URL and check if that ipaddress is listed in some rbl zone
and
> > > score acordingly.
> > >
> > > Example, I reveice lot of spam containing URL like
> > > http://www.thesillyguy.info or thenopers.info and these sites all
> > > resolve to the same ipaddress 216.40.47.17. Instead of writing
rules
> > > based on these sites is it possible to write a rule based on the
> > > ipaddress ?
> > >
> > >
> >
> >
> >
> >
> >
> >
**********************************************************************
> > Confidentiality : This e-mail and any attachments are intended for
the
> > addressee only and may be confidential. If they come to you in error
> > you must take no action based on them, nor must you copy or show
them
> > to anyone. Please advise the sender by replying to this e-mail
> > immediately and then delete the original from your computer.
> >
> > Opinion : Any opinions expressed in this e-mail are entirely those
of
> > the author and unless specifically stated to the contrary, are not
> > necessarily those of the author's employer.
> >
> > Security Warning : Internet e-mail is not necessarily a secure
> > communications medium and can be subject to data corruption. We
advise
> > that you consider this fact when e-mailing us.
> >
> > Viruses : We have taken steps to ensure that this e-mail and any
> > attachments are free from known viruses but in keeping with good
> > computing practice, you should ensure that they are virus free.
> >
> > Red Lion 49 Ltd T/A Solid State Logic
> > Registered as a limited company in England and Wales
> > (Company No:5362730)
> > Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
> > United Kingdom
> >
**********************************************************************
> >
**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the
addressee only and may be confidential. If they come to you in error
you must take no action based on them, nor must you copy or show them
to anyone. Please advise the sender by replying to this e-mail
immediately and then delete the original from your computer.
Opinion : Any opinions expressed in this e-mail are entirely those of
the author and unless specifically stated to the contrary, are not
necessarily those of the author's employer.
Security Warning : Internet e-mail is not necessarily a secure
communications medium and can be subject to data corruption. We advise
that you consider this fact when e-mailing us.
Viruses : We have taken steps to ensure that this e-mail and any
attachments are free from known viruses but in keeping with good
computing practice, you should ensure that they are virus free.
Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
United Kingdom
**********************************************************************
RE: URIBL
Posted by Jon Bjorn Njalsson <jo...@mbl.is>.
I have Net::DNS module installed.
[14934] dbg: dns: is Net::DNS::Resolver available? yes
[14934] dbg: dns: Net::DNS version: 0.57
and
[14934] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from
@INC
[14934] dbg: plugin: registered
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xa5822f0)
and in v310.pre i have
loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
but still spam regarding penis enlargement (some) are getting through.
any other ideas ?
On mið, 2007-01-17 at 11:32 +0000, Martin.Hepworth wrote:
> Jon
>
> Yes this functionality has been built in since SA version 3.0 (and via
> an additional 'plugin' since 2.6.?4?).
>
> Make sure you are using network tests, Net::DNS perl module is installed
> and the URI-RBL plugin is enabled in the *.pre files which are located
> in the same place as local.cf (normally /etc/mail/spamassassin).
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
> > -----Original Message-----
> > From: Jon Bjorn Njalsson [mailto:jonbjorn@mbl.is]
> > Sent: 17 January 2007 10:25
> > To: users@spamassassin.apache.org
> > Subject: URIBL
> >
> > Is it possible to have SA find URL in a mail and lookup the ipaddress
> > for the URL and check if that ipaddress is listed in some rbl zone and
> > score acordingly.
> >
> > Example, I reveice lot of spam containing URL like
> > http://www.thesillyguy.info or thenopers.info and these sites all
> > resolve to the same ipaddress 216.40.47.17. Instead of writing rules
> > based on these sites is it possible to write a rule based on the
> > ipaddress ?
> >
> >
>
>
>
>
>
> **********************************************************************
> Confidentiality : This e-mail and any attachments are intended for the
> addressee only and may be confidential. If they come to you in error
> you must take no action based on them, nor must you copy or show them
> to anyone. Please advise the sender by replying to this e-mail
> immediately and then delete the original from your computer.
>
> Opinion : Any opinions expressed in this e-mail are entirely those of
> the author and unless specifically stated to the contrary, are not
> necessarily those of the author's employer.
>
> Security Warning : Internet e-mail is not necessarily a secure
> communications medium and can be subject to data corruption. We advise
> that you consider this fact when e-mailing us.
>
> Viruses : We have taken steps to ensure that this e-mail and any
> attachments are free from known viruses but in keeping with good
> computing practice, you should ensure that they are virus free.
>
> Red Lion 49 Ltd T/A Solid State Logic
> Registered as a limited company in England and Wales
> (Company No:5362730)
> Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
> United Kingdom
> **********************************************************************
>
RE: URIBL
Posted by "Martin.Hepworth" <ma...@solidstatelogic.com>.
Jon
Yes this functionality has been built in since SA version 3.0 (and via
an additional 'plugin' since 2.6.?4?).
Make sure you are using network tests, Net::DNS perl module is installed
and the URI-RBL plugin is enabled in the *.pre files which are located
in the same place as local.cf (normally /etc/mail/spamassassin).
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
> -----Original Message-----
> From: Jon Bjorn Njalsson [mailto:jonbjorn@mbl.is]
> Sent: 17 January 2007 10:25
> To: users@spamassassin.apache.org
> Subject: URIBL
>
> Is it possible to have SA find URL in a mail and lookup the ipaddress
> for the URL and check if that ipaddress is listed in some rbl zone and
> score acordingly.
>
> Example, I reveice lot of spam containing URL like
> http://www.thesillyguy.info or thenopers.info and these sites all
> resolve to the same ipaddress 216.40.47.17. Instead of writing rules
> based on these sites is it possible to write a rule based on the
> ipaddress ?
>
>
**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the
addressee only and may be confidential. If they come to you in error
you must take no action based on them, nor must you copy or show them
to anyone. Please advise the sender by replying to this e-mail
immediately and then delete the original from your computer.
Opinion : Any opinions expressed in this e-mail are entirely those of
the author and unless specifically stated to the contrary, are not
necessarily those of the author's employer.
Security Warning : Internet e-mail is not necessarily a secure
communications medium and can be subject to data corruption. We advise
that you consider this fact when e-mailing us.
Viruses : We have taken steps to ensure that this e-mail and any
attachments are free from known viruses but in keeping with good
computing practice, you should ensure that they are virus free.
Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
United Kingdom
**********************************************************************