Re: [SURBL-Announce] fraud.rhs.mailpolice.com phishing data added to ph SURBL

[Jeff Chan <je...@surbl.org>]

On Thursday, November 11, 2004, 10:35:02 PM, Jeff Chan wrote:
> As of 12 November 2004, we have added data from
> fraud.rhs.mailpolice.com into ph, joining our exiting phishing
> data from mailsecurity.net.au.

I should add, this means if you were testing
fraud.rhs.mailpolice.com as a separate list, as in SA 2.63 or
2.64 with SpamCopURI:

uri       MP_URI_RBL
eval:check_spamcop_uri_rbl('fraud.rhs.mailpolice.com','127.0.0.2')
describe  MP_URI_RBL     URI's domain appears in MailPolice fraud list
tflags    MP_URI_RBL     net
score     MP_URI_RBL     2.0

or SpamAssassin 3.0.0:

urirhsbl URIBL_MP fraud.rhs.mailpolice.com.   A
header   URIBL_MP eval:check_uridnsbl('URIBL_MP')
describe URIBL_MP URI's domain appears in MailPolice fraud list
tflags   URIBL_MP net
score    URIBL_MP 2.0

or SpamAssassin 3.0.1:

urirhsbl URIBL_MP fraud.rhs.mailpolice.com.   A
body     URIBL_MP eval:check_uridnsbl('URIBL_MP')
describe URIBL_MP URI's domain appears in MailPolice fraud list
tflags   URIBL_MP net
score    URIBL_MP 2.0

Then you should remove or disable the above rule as redundant if you
are also using ph in multi.surbl.org, which SpamAssassin 3.0.0
and 3.0.1 do *by default*:

  http://spamassassin.apache.org/full/3.0.x/dist/rules/25_uribl.cf

urirhssub       URIBL_PH_SURBL  multi.surbl.org.        A   8
body            URIBL_PH_SURBL  eval:check_uridnsbl('URIBL_PH_SURBL')
describe        URIBL_PH_SURBL  Contains an URL listed in the PH SURBL blocklist
tflags          URIBL_PH_SURBL  net
score           URIBL_PH_SURBL  3.0

(IIRC you can disable rules simply by setting them to zero, but
in this case I'd probably recommend commenting them out or
deleting them.)

So keep the PH rule and delete any test rule using
fraud.rhs.mailpolice.com separately.

Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/