[SURBL-Discuss] Lookup of (phishing) URLs with an IP

Dirk Bonengel dirk at bonengel.de
Fri Aug 12 19:07:47 CEST 2005


sorry for crossposting, but I think this concerns both SURBL and URIBL.

Given: A (phishing-)mail containg a  link to the IP

The lookup page on rulesemporium.com says it's listed on ws and ph in SURBL

However, I find that the current SpamAssassin (3.0.4) does not appear to 
lookup IP-based URLs. Is that correct?

Secondly, which form would be correct to lookup that IP via dig (or 
whatever), and how should SA handle it if it tried to lookup IP-based URIs?
dig gives no results back, but the 
reversed dotted decimal form does:
dig returns

Lastly: The URIBL-Lookup page says that the IP is 
neither listed on SURBL nor URIBL but claims that is 
listed both in SURBL (ws and ph) and URIBL (black). I take that to be 
simply wrong.


More information about the Discuss mailing list