I can't reproduce this - the URI is detected in a HTML header. But is not
detected by the URIBL providers.
I've included the URI this way:
<HTML><HEAD>
<script type=3D"text/javascript" src=3D"
http://kanaatbiber.com.tr/images/cr=
editcard.js"></script>
</HEAD>
Jul-20-13 10:56:22 [Worker_1] Info: found raw URI/URL kanaatbiber.com.tr/
Jul-20-13 10:56:22 [Worker_1] LDAP - @com.tr not found in LDAP-cache
(ldaplistdb)
Jul-20-13 10:56:22 [Worker_1] LDAP - @kanaatbiber.com.tr not found in
LDAP-cache (ldaplistdb)
Jul-20-13 10:56:22 [Worker_1] Info: found URI kanaatbiber.com.tr
Jul-20-13 10:56:22 [Worker_1] Info: registered TLD(2/3) URI
kanaatbiber.com.tr for check
.....
Jul-20-13 10:56:23 [Worker_1] Sending DNS(A)-query to 192.168.2.1[:53] on
multi.surbl.org for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(TXT)-query to 194.25.2.129[:53]
on multi.surbl.org for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(A)-query to 10.69.5.50[:53] on
black.uribl.com for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(TXT)-query to 192.168.2.1[:53]
on black.uribl.com for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(A)-query to 194.25.2.129[:53] on
multi.uribl.com for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(TXT)-query to 10.69.5.50[:53] on
multi.uribl.com for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(A)-query to 192.168.2.1[:53] on
uribl.swinog.ch for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(TXT)-query to 194.25.2.129[:53]
on uribl.swinog.ch for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(A)-query to 10.69.5.50[:53] on
sbl.spamhaus.org for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(TXT)-query to 192.168.2.1[:53]
on sbl.spamhaus.org for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(A)-query to 194.25.2.129[:53] on
uribl.spameatingmonkey.net for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(TXT)-query to 10.69.5.50[:53] on
uribl.spameatingmonkey.net for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(A)-query to 192.168.2.1[:53] on
dob.sibl.support-intelligence.net for URIBL checks on kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Sending DNS(TXT)-query to 194.25.2.129[:53]
on dob.sibl.support-intelligence.net for URIBL checks on
kanaatbiber.com.tr
Jul-20-13 10:56:23 [Worker_1] Commencing URIBL checks on
'kanaatbiber.com.tr'
Jul-20-13 10:56:23 [Worker_1] Got 4 answers, 4 replies and 0 hits after 0
seconds for URIBL checks on 'kanaatbiber.com.tr'
Jul-20-13 10:56:23 [Worker_1] Got OK replies from (black.uribl.com
multi.uribl.com uribl.swinog.ch) - NOTOK replies from () for URIBL on
'kanaatbiber.com.tr'
Jul-20-13 10:56:23 [Worker_1] Completed URIBL checks on
'kanaatbiber.com.tr'
Jul-20-13 10:56:23 [Worker_1] URIBL: lookup returned <1> for
kanaatbiber.com.tr - res: ''
Thomas
Von: Michael Thomas <[email protected]>
An: ASSP development mailing list <[email protected]>,
Datum: 20.07.2013 06:03
Betreff: [Assp-test] Javascript SRC URI
Thomas,
ASSP version 2.3.4(13187)
Failed to detect URI in head section of HTML section. This message was a
bank scam. The only external URI in the body of the message were image
src URI of actual bank image URI. The active scam URI were all
javascript invocations.
<script type=3D"text/javascript" src=3D"
http://kanaatbiber.com.tr/images/cr=
editcard.js"></script>
--
Michael Thomas
Mathbox
978-687-3300
Toll Free: 1-877-MATHBOX (1-877-628-4269)
------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally
privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
