yet another uribl evasion example

2005-06-13 Thread mouss
I just got the spam below (headers removed except few). this hasn't been caught at reception time. It now triggers RCVD_IN_BL_SPAMCOP_NET. however, it doesn't trigger surbl checks, since the '' is considered as the end of the url. debug: URIDNSBL: domains to query: ins.com nusv.com

Re: yet another uribl evasion example

2005-06-13 Thread Theo Van Dinter
On Mon, Jun 13, 2005 at 05:15:27PM +0200, mouss wrote: however, it doesn't trigger surbl checks, since the '' is considered as the end of the url. What version are you running? This was fixed in 3.0.4. -- Randomly Generated Tagline: Farfignewton.. the cookie of the stars..

Re: yet another uribl evasion example

2005-06-13 Thread wolfgang
In an older episode (Monday 13 June 2005 18:10), Theo Van Dinter wrote: On Mon, Jun 13, 2005 at 05:15:27PM +0200, mouss wrote: however, it doesn't trigger surbl checks, since the '' is considered as the end of the url. What version are you running? This was fixed in 3.0.4. can the fix

Re: yet another uribl evasion example

2005-06-13 Thread Raymond Dijkxhoorn
Hi! On Mon, Jun 13, 2005 at 05:15:27PM +0200, mouss wrote: however, it doesn't trigger surbl checks, since the '' is considered as the end of the url. What version are you running? This was fixed in 3.0.4. can the fix be applied to 3.0.3? Any reason not wanting to upgrade to 3.0.4 ?

Re: yet another uribl evasion example

2005-06-13 Thread wolfgang
In an older episode (Monday 13 June 2005 21:20), Raymond Dijkxhoorn wrote: Any reason not wanting to upgrade to 3.0.4 ? yes. - our spamchecker machines' distributor is slow with upgrades while i can patch existing 3.0.2 code on them. - 3.0.4 appears to bring new challenges (Net::DNS version

Re: yet another uribl evasion example

2005-06-13 Thread Niek
On 6/13/2005 9:42 PM +0200, wolfgang wrote: - 3.0.4 appears to bring new challenges (Net::DNS version and such) Eer, no. You can keep 0.49. Only if you upgrade netdns to the b0rked 0.50, you'll run into trouble. So either keep netdns @ 0.49 or upgrade to 0.51. Upgrading is not needed for sa

Re: yet another uribl evasion example

2005-06-13 Thread Theo Van Dinter
On Mon, Jun 13, 2005 at 09:42:35PM +0200, wolfgang wrote: - 3.0.4 appears to bring new challenges (Net::DNS version and such) 3.0.4 should be a drop-in replacement for earlier versions. People seem to be having issues if they also upgrade Net::DNS, but there's no requirement to do so. 3.0.4

Re: yet another uribl evasion example

2005-06-13 Thread Michele Neylon:: Blacknight
Niek wrote: Eer, no. You can keep 0.49. Only if you upgrade netdns to the b0rked 0.50, you'll run into trouble. So either keep netdns @ 0.49 or upgrade to 0.51. Upgrading is not needed for sa 3.0.4 afaik. Niek Baakman 0.51 gives me the same problems :)

Re: yet another uribl evasion example

2005-06-13 Thread mouss
Theo Van Dinter wrote: On Mon, Jun 13, 2005 at 05:15:27PM +0200, mouss wrote: however, it doesn't trigger surbl checks, since the '' is considered as the end of the url. What version are you running? This was fixed in 3.0.4. thanks for the reply. I am running 3.0.3. time to upgrade...

Re: yet another uribl evasion example

2005-06-13 Thread Robert Menschel
Hello mouss, Monday, June 13, 2005, 8:15:27 AM, you wrote: m I just got the spam below (headers removed except few). m would it be reasonable to add a rule to check for anomalies in URLs? m what's the best (TM) way? 1) As has been suggested, upgrade. 2) Grab the SARE header rules file, which

Re: yet another uribl evasion example

2005-06-13 Thread Loren Wilton
would it be reasonable to add a rule to check for anomalies in URLs? what's the best (TM) way? SARE, at least at the moment. Loren