Re: Spamssassin seems to append .com TLD to uri link domains found

2021-03-13 Thread Kevin A. McGrail
Tobi, can you open a bug about this and add a spample of the issue? ch is in the TLD list 20_aux_tlds.cf. -- Kevin A. McGrail Member, Apache Software Foundation Chair Emeritus Apache SpamAssassin Project https://www.linkedin.com/in/kmcgrail - 703.798.0171 On Mon, Nov 9, 2020 at 9:56 AM Tobi

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-09 Thread Tobi
On 11/9/20 3:18 PM, RW wrote: > When you say FP do you mean that ch.com was listed in a domain > blocklist? yes, the "ch.com" was listed in one of the domain blocklists. And as the customer used his own domain "www.ch" as footer it got caught by the lookup for "ch.com" which seems to be a

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-09 Thread RW
On Mon, 9 Nov 2020 08:26:59 +0100 Tobi wrote: > John, > > > Because I think that suppressing that behavior for valid TLDs would > > be > an appropriate modification to avoid potential URIBL FPs > > fully agree. SA should not append .com if the domain has a valid tld > and a domain label.

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-08 Thread Tobi
John, > Because I think that suppressing that behavior for valid TLDs would be an appropriate modification to avoid potential URIBL FPs fully agree. SA should not append .com if the domain has a valid tld and a domain label. We know of at least one FP related to "www.ch" when (the expanded

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-07 Thread John Hardin
On Sat, 7 Nov 2020, RW wrote: On Sat, 7 Nov 2020 10:05:21 -0800 (PST) John Hardin wrote: On Sat, 7 Nov 2020, RW wrote: On Fri, 6 Nov 2020 16:10:18 + RW wrote: However, I can't get an up-to-date Firefox to add .com, so the feature may already be obsolete. I take that back, it does.

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-07 Thread RW
On Sat, 7 Nov 2020 10:05:21 -0800 (PST) John Hardin wrote: > On Sat, 7 Nov 2020, RW wrote: > > > On Fri, 6 Nov 2020 16:10:18 + > > RW wrote: > > > > > >> However, I can't get an up-to-date Firefox to add .com, so the > >> feature may already be obsolete. > > > > I take that back, it

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-07 Thread John Hardin
On Sat, 7 Nov 2020, RW wrote: On Fri, 6 Nov 2020 16:10:18 + RW wrote: However, I can't get an up-to-date Firefox to add .com, so the feature may already be obsolete. It take that back, it does. What does it do for the example at hand, http://www.ch ? -- John Hardin KA7OHZ

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-07 Thread John Hardin
On Sat, 7 Nov 2020, Benny Pedersen wrote: Tobi skrev den 2020-11-06 17:51: ah understand, should have better checked what SA really adds to domain list. So both versions are checked. Just bad luck if the expanded version of the uri domain (ex ch.com) has a blacklisting at uribl or spamhaus ;-)

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-07 Thread RW
On Fri, 6 Nov 2020 16:10:18 + RW wrote: > However, I can't get an up-to-date Firefox to add .com, so the feature > may already be obsolete. It take that back, it does.

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-07 Thread RW
On Sat, 07 Nov 2020 09:32:39 +0100 Benny Pedersen wrote: > Tobi skrev den 2020-11-06 17:51: > > ah understand, should have better checked what SA really adds to > > domain list. So both versions are checked. Just bad luck if the > > expanded version of the uri domain (ex ch.com) has a

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-07 Thread Benny Pedersen
Tobi skrev den 2020-11-06 17:51: ah understand, should have better checked what SA really adds to domain list. So both versions are checked. Just bad luck if the expanded version of the uri domain (ex ch.com) has a blacklisting at uribl or spamhaus ;-) But that's another story Have a good

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-06 Thread Tobi
ah understand, should have better checked what SA really adds to domain list. So both versions are checked. Just bad luck if the expanded version of the uri domain (ex ch.com) has a blacklisting at uribl or spamhaus ;-) But that's another story Have a good weekend tobi On 11/6/20 5:42 PM, RW

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-06 Thread RW
On Fri, 6 Nov 2020 17:24:58 +0100 Tobi wrote: > > www.ch is a weird special case as a > > domain name > > Did you check whois for www.ch? It's a registered domain and it > resolves, so the owner has a whitelisting in SA or better his www.ch > links which may host a very sophisticated

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-06 Thread Tobi
> www.ch is a weird special case as a > domain name Did you check whois for www.ch? It's a registered domain and it resolves, so the owner has a whitelisting in SA or better his www.ch links which may host a very sophisticated spearphish page will never be queried by SA against blacklists. Sorry

Re: Spamssassin seems to append .com TLD to uri link domains found

2020-11-06 Thread RW
On Fri, 6 Nov 2020 15:40:31 +0100 "Tobi wrote: > Hi list > > we currently see the following "issue" where SA does append .com TLD > to uri domains found in body. > > Add a uri like "www.ch" to a txt body part and SA will add "ch.com" to > domains to be checked > > Nov 6 15:23:52.527 [16955]

Spamssassin seems to append .com TLD to uri link domains found

2020-11-06 Thread "Tobi
Hi list we currently see the following "issue" where SA does append .com TLD to uri domains found in body. Add a uri like "www.ch" to a txt body part and SA will add "ch.com" to domains to be checked Nov 6 15:23:52.527 [16955] dbg: uri: canonicalizing parsed uri: http://www.ch Nov 6