You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Ryan L. Sun" <li...@gmail.com> on 2005/08/10 19:07:44 UTC
What the hell is that?
*Date:* {%LOGWITHID:Tue, 09 Aug 2005 06:21:42 +0600%}
*From:* "bobby shirley" <at...@stockstorm.com>
*To:* xxxxxx
*Subject:* re: buffy
buffy
http://{%LOGWITHID:{%ROTF:E:\EveryDayDomain\all01.txt%}?{%RND:^<m8>%}={%ROT
F:E:\EveryDayDomain\CompanyTest\pharrotates.txt%}%}
Regards
I followed the link and it goes to:
http://mail.sarai.net/pipermail/aaj-ke-naam/2005-August/005327.html
I am using firefox 1.0 on RedHat ES3
Re: What the hell is that?
Posted by Loren Wilton <lw...@earthlink.net>.
Isn't that a cute spam misfire? Certainly shows something about how some of these programs work.
Loren
Re: What the hell is that?
Posted by Brett Cove <br...@ActiveState.com>.
Ryan L. Sun wrote:
> That explanation makes senses.
> Spammers show their scripts to us, lol.
Yep, and if anyone was wondering, those ratware templates were supposto
generate one of our friendly (and increasingly common) geocities links.
ex) 'http://uk.geocities.com/Freddie_Shuler/?ElxF8=US FDA approves all
of our'
-Brett
> On 8/10/05, *Steve Martin* <steve@planomartins.com
> <ma...@planomartins.com>> wrote:
>
> So basically, the spammer's script failed to "generate" a URL from
> the "code" containing %LOGWITHID, etc. and send you the raw template
> instead.
>
> Your browser played too smart and figured out a place to go from that.
>
> Safari just complains that it is an invalid address.
>
> On Aug 10, 2005, at 12:21 PM, Matt Kettler wrote:
>
> >> http://{%LOGWITHID:{%ROTF:E:\EveryDayDomain\all01.txt%}?{%RND:^<m8>
> >> %}={%ROT
> >> F:E:\EveryDayDomain\CompanyTest\pharrotates.txt%}%}
>
> --
> Steve Martin http://www.cheezmo.com/
> Smart Calibration, LLC http://www.smartcalibration.com/
> The Widescreen Movie Center http://www.widemovies.com/
> Letterboxed Movie TV Schedule http://www.widemovies.com/lbx.html
>
>
Re: What the hell is that?
Posted by "Ryan L. Sun" <li...@gmail.com>.
That explanation makes senses.
Spammers show their scripts to us, lol.
On 8/10/05, Steve Martin <st...@planomartins.com> wrote:
>
> So basically, the spammer's script failed to "generate" a URL from
> the "code" containing %LOGWITHID, etc. and send you the raw template
> instead.
>
> Your browser played too smart and figured out a place to go from that.
>
> Safari just complains that it is an invalid address.
>
> On Aug 10, 2005, at 12:21 PM, Matt Kettler wrote:
>
> >> http://{%LOGWITHID:{%ROTF:E:\EveryDayDomain\all01.txt%}?{%RND:^<m8>
> >> %}={%ROT
> >> F:E:\EveryDayDomain\CompanyTest\pharrotates.txt%}%}
>
> --
> Steve Martin http://www.cheezmo.com/
> Smart Calibration, LLC http://www.smartcalibration.com/
> The Widescreen Movie Center http://www.widemovies.com/
> Letterboxed Movie TV Schedule http://www.widemovies.com/lbx.html
>
>
Re: What the hell is that?
Posted by Steve Martin <st...@planomartins.com>.
So basically, the spammer's script failed to "generate" a URL from
the "code" containing %LOGWITHID, etc. and send you the raw template
instead.
Your browser played too smart and figured out a place to go from that.
Safari just complains that it is an invalid address.
On Aug 10, 2005, at 12:21 PM, Matt Kettler wrote:
>> http://{%LOGWITHID:{%ROTF:E:\EveryDayDomain\all01.txt%}?{%RND:^<m8>
>> %}={%ROT
>> F:E:\EveryDayDomain\CompanyTest\pharrotates.txt%}%}
--
Steve Martin http://www.cheezmo.com/
Smart Calibration, LLC http://www.smartcalibration.com/
The Widescreen Movie Center http://www.widemovies.com/
Letterboxed Movie TV Schedule http://www.widemovies.com/lbx.html
Re: What the hell is that?
Posted by Jonathan Nichols <jn...@pbp.net>.
Steven Dickenson wrote:
>
> On Aug 10, 2005, at 1:21 PM, Matt Kettler wrote:
>
>> For example, try doing "turkeybacon" as a destination. Firefox will
>> fail the
>> lookup, do a web search (using google or whatever your default search
>> engine is)
>> and jump to the first hit:
>>
>> http://www.livejournal.com/userinfo.bml?user=turkeybacon
>
>
> Damn shame that's not a cooking blog. Turkey with bacon, damn good eats.
>
The bacon blog you're looking for is here:
http://baconshow.blogspot.com/
Re: What the hell is that?
Posted by Steven Dickenson <st...@mrchuckles.net>.
On Aug 10, 2005, at 1:21 PM, Matt Kettler wrote:
> For example, try doing "turkeybacon" as a destination. Firefox will
> fail the
> lookup, do a web search (using google or whatever your default
> search engine is)
> and jump to the first hit:
>
> http://www.livejournal.com/userinfo.bml?user=turkeybacon
Damn shame that's not a cooking blog. Turkey with bacon, damn good
eats.
Steven
---
Steven Dickenson <st...@mrchuckles.net>
http://www.mrchuckles.net
Re: What the hell is that?
Posted by Matt Kettler <mk...@evi-inc.com>.
Ryan L. Sun wrote:
> *Date:* {%LOGWITHID:Tue, 09 Aug 2005 06:21:42 +0600%}
> *From:* "bobby shirley" <atian@stockstorm.com
> <ma...@stockstorm.com>>
> *To:* xxxxxx
> *Subject:* re: buffy
> buffy
>
> http://{%LOGWITHID:{%ROTF:E:\EveryDayDomain\all01.txt%}?{%RND:^<m8>%}={%ROT
> F:E:\EveryDayDomain\CompanyTest\pharrotates.txt%}%}
>
>
> Regards
>
> I followed the link and it goes to:
> http://mail.sarai.net/pipermail/aaj-ke-naam/2005-August/005327.html
> I am using firefox 1.0 on RedHat ES3
Looks like your firefox failed to lookup "%LOGWITHID" as a hostname. After it
failed it did a web search for "%LOGWITHID" and ended up there.
For example, try doing "turkeybacon" as a destination. Firefox will fail the
lookup, do a web search (using google or whatever your default search engine is)
and jump to the first hit:
http://www.livejournal.com/userinfo.bml?user=turkeybacon
Re: How to use Multilog ?
Posted by "Chr. v. Stuckrad" <st...@mi.fu-berlin.de>.
On Mon, Aug 15, 2005 at 09:09:20AM -0400, Matt Kettler wrote:
> Perhaps you want something like:
>
> spamd -s stdout | multilog {insert multilog options here}
This should be exactly what you want.
BUT in the manual I only see 'stderr' allowed
for '... -s stderr'. If 'stdout' does not work
you might need to run
/bin/sh -c 'exec spamassassin -s stderr ... ... ... 2>&1'
instead of
'spamassassin -s stdout ... ... ...'
This way you'll get stderr redirected to stdout by the shell,
and multilog gets the output.
Multilog (normally started by Bernsteins Daemontools
via supervisor) analyses standard input!
See: http://cr.yp.to/daemontools/multilog.html
Stucki
--
Christoph von Stuckrad * * |nickname |<st...@mi.fu-berlin.de> \
Freie Universitaet Berlin |/_*|'stucki' |Tel(days):+49 30 838-75 459|
Mathematik & Informatik EDV |\ *|if online|Tel(else):+49 30 77 39 6600|
Arnimallee 2-6/14195 Berlin * * |on IRCnet|Fax(alle):+49 30 838-75454/
Re: How to use Multilog ?
Posted by Matt Kettler <mk...@comcast.net>.
At 07:45 AM 8/15/2005, Dhanny Kosasih wrote:
>I use SpamAssassin 3.0.4 with FC3, and i use script from Fedora to start
>and stop spamd. But qmailmrtg7 can't read log with standard SpamAssassin.
>The qmailmrtg can only read log with multilog format.
>I try --syslog=stderr but i don't know where is the log file ?
Well, if spamd is daemonized, stderr goes to /dev/null unless you redirect
it somewhere.
Perhaps you want something like:
spamd -s stdout | multilog {insert multilog options here}
Or if you want it to just directly log to to a file:
spamd -s /var/log/spamassassin.log
And you can crunch that through multilog later..
>How SpamAssassin use multilog format ?
Re: How to use Multilog ?
Posted by George Georgalis <ge...@galis.org>.
On Mon, Aug 15, 2005 at 06:45:52PM +0700, Dhanny Kosasih wrote:
>I use SpamAssassin 3.0.4 with FC3, and i use script from Fedora to start
>and stop spamd. But qmailmrtg7 can't read log with standard
>SpamAssassin. The qmailmrtg can only read log with multilog format. I
>try --syslog=stderr but i don't know where is the log file ? How
>SpamAssassin use multilog format ?
$ head -n3 /service/spamd/run /service/spamd/log/run
==> /service/spamd/run <==
#!/bin/sh
MAX=3
exec spamd -i -A 127.0.0.0/8,10.0.0.0/8,192.168.0.0/16 -m ${MAX} --username=qmaild --syslog=stderr 2>&1
==> /service/spamd/log/run <==
#!/bin/sh
exec setuidgid log multilog t /var/log/spamd
--
George Georgalis, systems architect, administrator <IXOYE><
http://galis.org/ cell:646-331-2027 mailto:george@galis.org
How to use Multilog ?
Posted by Dhanny Kosasih <dh...@gmail.com>.
I use SpamAssassin 3.0.4 with FC3, and i use script from Fedora to start
and stop spamd. But qmailmrtg7 can't read log with standard
SpamAssassin. The qmailmrtg can only read log with multilog format. I
try --syslog=stderr but i don't know where is the log file ? How
SpamAssassin use multilog format ?
Regards,
Dhanny Kosasih.
___________________________________________________________
How much free photo storage do you get? Store your holiday
snaps for FREE with Yahoo! Photos http://uk.photos.yahoo.com