You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Tim Donahue <td...@haynes-group.com> on 2004/12/02 22:15:14 UTC

SURBL Reporting/Scoring Question

I was wondering if subdomains need to be reported for SURBL rules to get
triggered.  I just found an address in a spam that I grabbed from one of
my umm... "throw away" accounts that is a subdomain of a domain that is
listed in the SURBL lists.  I was using the spam (on that is advertizing
software at discount rates) to test my new SA 3.01 setup and I when that
the following domain wasn't triggering the SURBL rules even though its
parent was listed.


ajicccln.info is 218.76.249.10 [ rbl lookup  ]
domain registered: 19-Nov-2004 15:35:23 UTC [ full whois  ]

      * URIBL: ws.surbl.org: listed [Blocked, See:
        http://www.stearns.org/sa-blacklist/] 
      * URIBL: uc.sasknow.com: not listed 
      * URIBL: sc.surbl.org: listed [Message body contains SpamCop
        spamvertised domain.] 
      * URIBL: ob.surbl.org: listed [Blocked, See:
        http://www.surbl.org/lists.html#ob] 
      * URIBL: multi.surbl.org: listed [Blocked, ajicccln.info on lists
        [sc][ws][ob][jp], See: http://www.surbl.org/lists.html] 
      * URIBL: ab.surbl.org: not listed 
      * RBL: skipping uri lookups on ip-based RBLs


________________________________________________________________________
mercury.ajicccln.info is 218.76.249.10 [ rbl lookup  ]
domain registered: unknown [ full whois  ]

      * URIBL: ws.surbl.org: not listed [ report ] 
      * URIBL: uc.sasknow.com: not listed 
      * URIBL: sc.surbl.org: not listed 
      * URIBL: ob.surbl.org: not listed 
      * URIBL: multi.surbl.org: not listed 
      * URIBL: ab.surbl.org: not listed 
      * RBL: skipping uri lookups on ip-based RBLs

-- 
Tim Donahue <td...@haynes-group.com>
Haynes Group, Incorporated

Re: SURBL Reporting/Scoring Question

Posted by Jeff Chan <je...@surbl.org>.
On Thursday, December 2, 2004, 1:15:14 PM, Tim Donahue wrote:
> I was wondering if subdomains need to be reported for SURBL rules to get
> triggered.  I just found an address in a spam that I grabbed from one of
> my umm... "throw away" accounts that is a subdomain of a domain that is
> listed in the SURBL lists.  I was using the spam (on that is advertizing
> software at discount rates) to test my new SA 3.01 setup and I when that
> the following domain wasn't triggering the SURBL rules even though its
> parent was listed.

SURBL applications are supposed to strip URI domains down to
a base, registrar domain.  If they do that, then they should
match.   What was the full URI please?    Munge it if needed.

Jeff C.
-- 
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/