On Mon, 2009-07-20 at 21:51 +0200, Tomasz Chmielewski wrote: > Karsten Bräckelmann wrote:
> > No need to debug any issues with open-whois.org lookups, no value > > either. Do run sa-update instead. > > > > open-whois.org has been cybersquatted. Bug 6157, FIXED [1]. > > [1] https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6157 > > Didn't know this, thanks for the info. > > Anyway, I guess lots of people will not update their spamassassin > installations. Then they are likely to get FPs on the open-whois rules, in case the squatter acts maliciously. In the best case, just timeouts. > Is there a way to check the envelope sender against open-whois.org (even > if it's cybersquatted)? The first step to gather that information is, to check the BLs website. Generally, they do provide such details. You did not try that. The site vanished. The entire domain is no longer controlled by the previous BL operators. That includes DNS. You can NOT trust the result. Seriously, please read up on the term cybersquatting. Anyway, as with all urirhssub rules, you'd do a manual lookup like this: $ host -t A spamassassin.org.bl.open-whois.org spamassassin.org.bl.open-whois.org has address 127.0.0.2 According to that, spamassassin.org is "registered to 1&1 Private Registration", WHOIS_1AND1PR hit. And for some more fun... $ host -t A apache.org.bl.open-whois.org apache.org.bl.open-whois.org has address 216.8.179.24 $ host -t A open-whois.org open-whois.org has address 216.8.179.24 -- char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
