|
Donation/Premium |
|
 |
|
|
|
|
|
|
|
Survey |
|
 |
|
|
|
|
|
|
|
 |
 |
| View previous topic :: View next topic |
| Author |
Message |
efa
Sergeant

 Joined: Aug 31, 2007 Posts: 139 Location: Italy
|
Posted: Mon May 05, 2008 7:09 pm Post subject: |
|
|
I tried the V0.04.03, and this new one V0.04.04 attached, with your spamvertized domain, but to me seem works well.
I post my complete output.
# V0.04.04 2008/05/05
# Fix: sometimes 'host' report Name Servers not "found:"
Maybe, the registration was updated, or maybe some other bug.
Can you post some more output, just before the error, to understand what can be the step that fail.
...@01ath3200:~/script$ xComplaint hxxp://oiwenierl.com/
xComplaint V.0.04.04 2008/05/05 GNU GPL Copyright � 2008 ...
URL : "hxxp://oiwenierl.com/"
Domain : "oiwenierl.com"
Registrar : "XIN NET"
Registrar To: "tousu@xinnet.com,registrar@xinnet.com"
Registrar Cc: "jiww@xinnet.com,wanghuan@xinnet.com,spam@ccert.edu.cn"
Name Servers: "ns1.faratnesa.com. ns2.faratnesa.com."
DNS1: "ns1.faratnesa.com"
DNS2: "ns2.faratnesa.com"
DNS1 Registrar : "XIN NET"
DNS2 Registrar : "XIN NET"
DNS3 Registrar : "XIN NET"
DNS4 Registrar : "XIN NET"
DNS1 Registrar To: tousu@xinnet.com,registrar@xinnet.com
DNS1 Registrar Cc: jiww@xinnet.com,wanghuan@xinnet.com,spam@ccert.edu.cn
DNS2 Registrar To: tousu@xinnet.com,registrar@xinnet.com
DNS2 Registrar Cc: jiww@xinnet.com,wanghuan@xinnet.com,spam@ccert.edu.cn
DNS3 Registrar To: tousu@xinnet.com,registrar@xinnet.com
DNS3 Registrar Cc: jiww@xinnet.com,wanghuan@xinnet.com,spam@ccert.edu.cn
DNS4 Registrar To: tousu@xinnet.com,registrar@xinnet.com
DNS4 Registrar Cc: jiww@xinnet.com,wanghuan@xinnet.com,spam@ccert.edu.cn
User-Agent: xComplaint V.0.04.04 2008/05/05 on Ubuntu 7.10 Linux 2.6.22-14-generic #1 SMP i686 GNU/Linux
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
From: ... <...>
To: tousu@xinnet.com,registrar@xinnet.com
Cc: jiww@xinnet.com,wanghuan@xinnet.com,spam@ccert.edu.cn
Subject: Removal request: oiwenierl.com
XIN NET
Dear Registrar
This is a request for you to remove the spamvertized illegal domain
oiwenierl.com
ACTION
Removal instructions for 'spammed domains' are in this link
> http://www.spamtrackers.eu/wiki/index.php?title=Registrar_Advice
> http://www.spamtrackers.hk/wiki/index.php?title=Registrar_Advice for China
Once removed with that method, this xComplaint generator tool will create
no more requests on this domain.
Thank you for your efforts to reduce spam and to keep criminals from
abusing your terms of service.
-----
This message was generated by the xComplaint
-----
Press a key to send. Hit 'n' to skip
Trying <ip>...
Connected to <smtp>.
Escape character is '^]'.
Connection closed by foreign host.
Mail sended. Exit.
====================================================
User-Agent: xComplaint V.0.04.04 2008/05/05 on Ubuntu 7.10 Linux 2.6.22-14-generic #1 SMP i686 GNU/Linux
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
From: ... <...>
To: tousu@xinnet.com,registrar@xinnet.com
Cc: jiww@xinnet.com,wanghuan@xinnet.com,spam@ccert.edu.cn
Subject: Removal request: ns1.faratnesa.com
XIN NET
Dear Registrar
This is a request for you to remove the domain faratnesa.com and to remove
its name server Address record ns1.faratnesa.com [221.230.2.216]
EVIDENCE
It is used as a name server for the spammed site oiwenierl.com
ACTION
Use the removal instructions for name servers in this link
> http://www.spamtrackers.eu/wiki/index.php?title=Registrar_Advice
> http://www.spamtrackers.hk/wiki/index.php?title=Registrar_Advice for China
Once removed in that manner, this xComplaint generator tool will generate
no more requests on this domain.
Thank you for your efforts to reduce spam and to keep criminals from
abusing your terms of service.
-----
This message was generated by the xComplaint
-----
Press a key to send. Hit 'n' to skip
Trying <ip>...
Connected to <smtp>.
Escape character is '^]'.
Connection closed by foreign host.
Mail sended. Exit.
====================================================
| Description: |
|
 Download |
| Filename: |
xComplaint00404.tgz |
| Filesize: |
10.09 KB |
| Downloaded: |
19 Time(s) |
|
|
| Back to top |
|
 |
kamaraju
Corporal

 Joined: Mar 07, 2007 Posts: 65 Location: USA
|
Posted: Mon May 05, 2008 8:46 pm Post subject: |
|
|
Here is the complete output. I am using Debian Etch.
$./xComplaint hxxp://oiwenierl.com/
xComplaint V.0.04.04 2008/05/05 GNU GPL Copyright � 2008
URL : "http://oiwenierl.com/"
Domain : "oiwenierl.com"
Registrar : "XIN NET"
Registrar To: "tousu@xinnet.com,registrar@xinnet.com"
Registrar Cc: "jiww@xinnet.com,wanghuan@xinnet.com,spam@ccert.edu.cn"
oiwenierl.com NS record currently not present
Name Servers: ""
DNS1: ""
DNS2: ""
awk: (FILENAME=- FNR=1) fatal: attempt to access field -1
awk: (FILENAME=- FNR=1) fatal: attempt to access field -1
awk: (FILENAME=- FNR=1) fatal: attempt to access field -1
awk: (FILENAME=- FNR=1) fatal: attempt to access field -1
Usage: whois [OPTION]... OBJECT...
-l one level less specific lookup [RPSL only]
-L find all Less specific matches
-m find first level more specific matches
-M find all More specific matches
-c find the smallest match containing a mnt-irt attribute
-x exact match [RPSL only]
-d return DNS reverse delegation objects too [RPSL only]
-i ATTR[,ATTR]... do an inverse lookup for specified ATTRibutes
-T TYPE[,TYPE]... only look for objects of TYPE
-K only primary keys are returned [RPSL only]
-r turn off recursive lookups for contact information
-R force to show local copy of the domain object even
if it contains referral
-a search all databases
-s SOURCE[,SOURCE]... search the database from SOURCE
-g SOURCE:FIRST-LAST find updates from SOURCE from serial FIRST to LAST
-t TYPE request template for object of TYPE ('all' for a list)
-v TYPE request verbose template for object of TYPE
-q [version|sources|types] query specified server info [RPSL only]
-F fast raw output (implies -r)
-h HOST connect to server HOST
-p PORT connect to PORT
-H hide legal disclaimers
--verbose explain what is being done
--help display this help and exit
--version output version information and exit
DNS1 Registrar : ""
Usage: whois [OPTION]... OBJECT...
-l one level less specific lookup [RPSL only]
-L find all Less specific matches
-m find first level more specific matches
-M find all More specific matches
-c find the smallest match containing a mnt-irt attribute
-x exact match [RPSL only]
-d return DNS reverse delegation objects too [RPSL only]
-i ATTR[,ATTR]... do an inverse lookup for specified ATTRibutes
-T TYPE[,TYPE]... only look for objects of TYPE
-K only primary keys are returned [RPSL only]
-r turn off recursive lookups for contact information
-R force to show local copy of the domain object even
if it contains referral
-a search all databases
-s SOURCE[,SOURCE]... search the database from SOURCE
-g SOURCE:FIRST-LAST find updates from SOURCE from serial FIRST to LAST
-t TYPE request template for object of TYPE ('all' for a list)
-v TYPE request verbose template for object of TYPE
-q [version|sources|types] query specified server info [RPSL only]
-F fast raw output (implies -r)
-h HOST connect to server HOST
-p PORT connect to PORT
-H hide legal disclaimers
--verbose explain what is being done
--help display this help and exit
--version output version information and exit
DNS2 Registrar : ""
Usage: whois [OPTION]... OBJECT...
-l one level less specific lookup [RPSL only]
-L find all Less specific matches
-m find first level more specific matches
-M find all More specific matches
-c find the smallest match containing a mnt-irt attribute
-x exact match [RPSL only]
-d return DNS reverse delegation objects too [RPSL only]
-i ATTR[,ATTR]... do an inverse lookup for specified ATTRibutes
-T TYPE[,TYPE]... only look for objects of TYPE
-K only primary keys are returned [RPSL only]
-r turn off recursive lookups for contact information
-R force to show local copy of the domain object even
if it contains referral
-a search all databases
-s SOURCE[,SOURCE]... search the database from SOURCE
-g SOURCE:FIRST-LAST find updates from SOURCE from serial FIRST to LAST
-t TYPE request template for object of TYPE ('all' for a list)
-v TYPE request verbose template for object of TYPE
-q [version|sources|types] query specified server info [RPSL only]
-F fast raw output (implies -r)
-h HOST connect to server HOST
-p PORT connect to PORT
-H hide legal disclaimers
--verbose explain what is being done
--help display this help and exit
--version output version information and exit
DNS3 Registrar : ""
Usage: whois [OPTION]... OBJECT...
-l one level less specific lookup [RPSL only]
-L find all Less specific matches
-m find first level more specific matches
-M find all More specific matches
-c find the smallest match containing a mnt-irt attribute
-x exact match [RPSL only]
-d return DNS reverse delegation objects too [RPSL only]
-i ATTR[,ATTR]... do an inverse lookup for specified ATTRibutes
-T TYPE[,TYPE]... only look for objects of TYPE
-K only primary keys are returned [RPSL only]
-r turn off recursive lookups for contact information
-R force to show local copy of the domain object even
if it contains referral
-a search all databases
-s SOURCE[,SOURCE]... search the database from SOURCE
-g SOURCE:FIRST-LAST find updates from SOURCE from serial FIRST to LAST
-t TYPE request template for object of TYPE ('all' for a list)
-v TYPE request verbose template for object of TYPE
-q [version|sources|types] query specified server info [RPSL only]
-F fast raw output (implies -r)
-h HOST connect to server HOST
-p PORT connect to PORT
-H hide legal disclaimers
--verbose explain what is being done
--help display this help and exit
--version output version information and exit
DNS4 Registrar : ""
DNS1 Registrar To: ***_PASTE_INTO_http://www.ppcmarketingllc.com/support/index.html
DNS1 Registrar Cc:
DNS2 Registrar To: ***_PASTE_INTO_http://www.ppcmarketingllc.com/support/index.html
DNS2 Registrar Cc:
DNS3 Registrar To: ***_PASTE_INTO_http://www.ppcmarketingllc.com/support/index.html
DNS3 Registrar Cc:
DNS4 Registrar To: ***_PASTE_INTO_http://www.ppcmarketingllc.com/support/index.html
DNS4 Registrar Cc:
User-Agent: xComplaint V.0.04.04 2008/05/05 on Debian GNU/Linux 4.0 (etch) Linux 2.6.18-6-686 #1 SMP i686 GNU/Linux
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
From:
To: tousu@xinnet.com,registrar@xinnet.com
Cc: jiww@xinnet.com,wanghuan@xinnet.com,spam@ccert.edu.cn
Subject: Removal request: oiwenierl.com
XIN NET
Dear Registrar
This is a request for you to remove the spamvertized illegal domain
oiwenierl.com
ACTION
Removal instructions for 'spammed domains' are in this link
> http://www.spamtrackers.eu/wiki/index.php?title=Registrar_Advice
> http://www.spamtrackers.hk/wiki/index.php?title=Registrar_Advice for China
Once removed with that method, this xComplaint generator tool will create
no more requests on this domain.
Thank you for your efforts to reduce spam and to keep criminals from
abusing your terms of service.
-----
This message was generated by the xComplaint
-----
Press a key to send. Hit 'n' to skip
|
|
| Back to top |
|
 |
efa
Sergeant

 Joined: Aug 31, 2007 Posts: 139 Location: Italy
|
Posted: Tue May 06, 2008 12:23 am Post subject: |
|
|
please post the output of:
host -t ns oiwenierl.com
|
|
| Back to top |
|
 |
kamaraju
Corporal

 Joined: Mar 07, 2007 Posts: 65 Location: USA
|
Posted: Tue May 06, 2008 2:36 pm Post subject: |
|
|
$host -t ns oiwenierl.com
oiwenierl.com NS ns1.faratnesa.com
oiwenierl.com NS ns2.faratnesa.com
$host --version
host version 991529
|
|
| Back to top |
|
 |
efa
Sergeant

 Joined: Aug 31, 2007 Posts: 139 Location: Italy
|
Posted: Tue May 06, 2008 11:30 pm Post subject: |
|
|
try this one and let me know if works
# V0.04.05 2008/05/06
# Fix: use always 'dig' as 'host' report is too variable
| Description: |
|
 Download |
| Filename: |
xComplaint00405.tgz |
| Filesize: |
10.13 KB |
| Downloaded: |
20 Time(s) |
|
|
| Back to top |
|
 |
kamaraju
Corporal

 Joined: Mar 07, 2007 Posts: 65 Location: USA
|
Posted: Wed May 07, 2008 1:07 pm Post subject: |
|
|
Yeah! The latest version 0.04.05 is working fine.
Thanks.
raju
|
|
| Back to top |
|
 |
efa
Sergeant

 Joined: Aug 31, 2007 Posts: 139 Location: Italy
|
Posted: Thu May 08, 2008 11:57 pm Post subject: |
|
|
Here another bugfix release:
# V0.04.06 2008/05/08
# Fix: look for field 6->3 in 'dig' output. Es. ultimatepharmacyguide.com
# Fix: check if userSmtp or userMail are empty, exit error
# Fix: sometimes registrar of NS1 is mistakely used for NS2-4
# Fix: really more robust on domain and NS check before do the whois
| Description: |
|
 Download |
| Filename: |
xComplaint00406.tgz |
| Filesize: |
10.58 KB |
| Downloaded: |
21 Time(s) |
|
|
| Back to top |
|
 |
efa
Sergeant

 Joined: Aug 31, 2007 Posts: 139 Location: Italy
|
Posted: Tue May 20, 2008 11:03 pm Post subject: |
|
|
Here another bugfix release:
# V0.04.07 2008/05/20
# Fix: exit if Domain is already removed
# Fix: exit if do not find Registrar in contact file
# Fix: exit if do not find Registrar
# Fix: doesn't confused with 3th level domain or TLD with dot
| Description: |
|
 Download |
| Filename: |
xComplaint00407.tgz |
| Filesize: |
11.7 KB |
| Downloaded: |
24 Time(s) |
|
|
| Back to top |
|
 |
efa
Sergeant

 Joined: Aug 31, 2007 Posts: 139 Location: Italy
|
Posted: Sun Jun 08, 2008 9:41 am Post subject: |
|
|
Here another bugfix release:
# V.0.04.08 2008/06/07
# Fix: recover Registrar when on the next line of whois report
# Fix: recover Registrar when [Rr]egistrar is lowercase also
# Fix: recover Registrar when is labeled "Organization:"
# Fix: recover Registrar when is labeled "Sponsoring Registrar:"
# Fix: use grep -m1 to replace awk to avoid duplicate line
# Fix: exit if do not find Registrar Contact File
# Fix: doesn't confused with Nth level domain (with N>3) or ccTLD with dot
# Fix: some cosmetic debug print
| Description: |
|
 Download |
| Filename: |
xComplaint00408.tgz |
| Filesize: |
12.18 KB |
| Downloaded: |
15 Time(s) |
|
|
| Back to top |
|
 |
efa
Sergeant

 Joined: Aug 31, 2007 Posts: 139 Location: Italy
|
Posted: Sun Jun 08, 2008 11:04 pm Post subject: |
|
|
This version does not complaint asking to remove the more common Registrars NameServers
# V.0.05.09 2008/06/08
# Add: does not complaint to remove more common Registrars NameServers
# Add: warn about updating contact file when not found registrar of NS
# Fix: regression on TLD, sometimes doesn't remove www. before whois
# Fix: sometimes doesn't found Registrar NameServers
| Description: |
|
 Download |
| Filename: |
xComplaint00509.tgz |
| Filesize: |
13.23 KB |
| Downloaded: |
18 Time(s) |
|
|
| Back to top |
|
 |
efa
Sergeant

 Joined: Aug 31, 2007 Posts: 139 Location: Italy
|
Posted: Sun Jun 29, 2008 1:47 pm Post subject: |
|
|
This release is packaged together with 'xComplaint2' that download spam from spam folder on an Imap server, and parse for links. Then it pass to 'xComplaint' to recover registrars, emails and name servers.
So if you have a single domain to complaint on, you can continue use 'xComplaint'.
For full automation on reporting, you can:
1 - process your Inbox with a Bayesian spam filtering:
http://en.wikipedia.org/wiki/Bayesian_spam_filtering
like the one that is integrated in Mozilla Mail (Seamonkey or Thunderbird), that after a week of training, give you the certainty that the mail moved to spam folder are 100% only and all the spam mails.
2 - use 'xComplaint2'
'xComplaint2':
- download all the spam from the spam folder
- do quoted-printable decoding if necessary
- look for all links in the mails
- do a simple redirect check (with wget) and collect also the redirected domain.
- on collected links, call 'xComplaint'
- send a copy of every spam to a configured email, using spamvertized links as subject
ChangeLog:
xComplaint
# V.0.05.10 2008/06/29
# first release packaged with 'xComplaint2' to download spam and parse for links
# Fix: with some whois report needed conversion to unix style NewLine
# Fix: with some NS whois report needed conversion to unix style NewLine
# Fix: recover Registrar when is labeled "registrar name:"
# Fix: skip duplicate NS query
# Fix: with .info TLDomain doesn'f found the registrar
# Fix: put always fulldomain in complaint mails
# Fix: recover DNS registrar in some ccTLD strange case
xComplaint2
# V.0.05.10 2008/06/29
# Add: look for two or more link per line. Fixed.
# Add: check 3th level domain simple redirect URL and complaint also for that
# Add: remove ending / from redirect URL
# Add: complete quoted-printable decoding. Example:" : =3A, / =2F, . =2E "
# Add: eliminate soft break =\n from quoted-printable
# Fix: URL: plaeust.c= URL: "g=" è: URL: "gejanne.com" milf= milfoors.com
# "lumi=" "luminutt.com": remove "=\n"
# Fix: Strange char in URL. Es." \ufffdwww.visodue.com". Fixed.
# Fix: seems two complaint per domain, no DNS in complaints.txt. Fixed
# Fix: eliminate ending space in URL. Es."teethshort.com :-","dearspeed.com :-"
# Fix: eliminate w3.org from founded links
# Fix: check if userImap, userUser or spamFold are empty, exit error
# Fix: multiple point encoded in domain: Es. a763.g=2Eakamai=2Enet. Fixed
| Description: |
|
 Download |
| Filename: |
xComplaint00510.tgz |
| Filesize: |
17.23 KB |
| Downloaded: |
17 Time(s) |
Last edited by efa on Sun Jun 29, 2008 1:58 pm, edited 3 times in total |
|
| Back to top |
|
 |
efa
Sergeant

 Joined: Aug 31, 2007 Posts: 139 Location: Italy
|
Posted: Sun Jun 29, 2008 1:51 pm Post subject: |
|
|
what to do now?
at least use SpiderMonkey interpreter for obfuscated javascript redirected URL. I had already tried and work with all the spam script. Need some customization and integration.
Then I have a project to port this CLI bash scripts to a crossplatform C program with the GUI in GTK+, obviusly in GPL license.
|
|
| Back to top |
|
 |
efa
Sergeant

 Joined: Aug 31, 2007 Posts: 139 Location: Italy
|
Posted: Mon Jul 07, 2008 3:05 pm Post subject: |
|
|
for who want to try this on Win32, I tested on:
- WinXP sp3
- CYGWIN_NT-5.1 1.5.25-14(0.156/4/2) May 27 2008 i686 Cygwin
The dependencies are:
=================
xComplaint
----------
cat, grep, awk, sed, cut (cygwin)
dos2unix (cygwin)
uname (cygwin)
head (cygwin)
telnet (cygwin)
host (cygwin)
read (cygwin/bash)
whois (cygwin/net)
lsb_release (linux only)
dig (http://members.shaw.ca/nicholas.fong/dig/)
xComplaint2
-----------
cat, grep, awk, sed, cut (cygwin)
dos2unix (cygwin)
wc (cygwin)
head (cygwin)
read (cygwin/bash)
fetchmail (cygwin/mail)
wget (cygwin/web)
Note: follow install instructions to get a working copy of 'dig' on Win32 system at:
http://members.shaw.ca/nicholas.fong/dig/
Next version will implement a cosmetic work around for 'lsb_release' missing.
|
|
| Back to top |
|
 |
efa
Sergeant

 Joined: Aug 31, 2007 Posts: 139 Location: Italy
|
Posted: Mon Jul 07, 2008 9:36 pm Post subject: |
|
|
Another bugfix release.
Now depend also on 'iconv' to support stressed Registrar name, used to convert in UTF-8 the whois report.
Fully tested with Cygwin on Win32
xComplaint
----------------
# V.0.05.11 2008/07/07
# Add: made compatible with Cygwin 1.5.25-14 May 27 2008 on WinXPsp3
# using 'dig' port for Win32: http://members.shaw.ca/nicholas.fong/dig/
# Add: updated xComplaintContact.txt and xComplaintRegistrarDns.txt
# Fix: support stressed Registrar name converting from ISO-8859-15 to UTF-8
# Fix: remove some unusefull print
# Fix: workaround for 'lsb_release' on Cygwin
xComplaint2
------------------
# V.0.05.11 2008/07/07
# Add: made compatible with Cygwin 1.5.25-14 May 27 2008 on WinXPsp3
# Add: cosmetic User Agent change in mail header
# Fix: skip two complaint when redirect is local
# Fix: workaround for 'lsb_release' on Cygwin
| Description: |
|
 Download |
| Filename: |
xComplaint00511.tgz |
| Filesize: |
17.83 KB |
| Downloaded: |
17 Time(s) |
|
|
| Back to top |
|
 |
efa
Sergeant

 Joined: Aug 31, 2007 Posts: 139 Location: Italy
|
Posted: Tue Jul 08, 2008 11:47 pm Post subject: |
|
|
Re-integrated script 'xComplaint' and 'xComplaint2' in one procedural.
Now if you run 'xComplaint' with no parameter, it fetch the spam from the Imap server, parse the mail body looking for URL, then complaint for every URL founded or redirected.
If you run 'xComplaint' with a parameter, complaint for that URL only.
Other Minor fix
# V.0.06.12 2008/07/08
# Add: integrated script 'xComplaint' and 'xComplaint2'
# recover spam mails from IMAP server, '/spam' folder
# parse mail body looking for URLs/domains
# send copy of spam to a configured email (like spamcop, knujon, ecc...)
# Fix: found registrar when is on next line of 'Registrar:'
# Fix: support for whois server busy
# Fix: test UTF-8 format before try to convert. Needed for chinese registrar
# Fix: remove temporary files on exit when debug is OFF
| Description: |
|
 Download |
| Filename: |
xComplaint00612.tgz |
| Filesize: |
17.9 KB |
| Downloaded: |
18 Time(s) |
|
|
| Back to top |
|
 |
|
|
|
You can post new topics in this forum You can reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You can attach files in this forum You can download files in this forum
|
Powered by phpBB © 2001 phpBB Group
|