A question about whether SpamCopURI would support using the alternative SURBL ws.surbl.org came up, so I thought I'd address that for everyone. Any program that knows how to extract URIs from message bodies, then domains from the URIs, then compare those domains against an RBL can use any or all of the SURBL lists. Therefore SpamCopURI will work with ws.surbl.org just fine. (Noting of course that the ws results won't necessarily be related to the SpamCop-derived data in the sc list.)
All you need to do is add a rule with the name of that list:
uri SA_URI_RBL eval:check_spamcop_uri_rbl('ws.surbl.org','127.0.0.2') describe SA_URI_RBL URI's domain appears in spamcop database at ws.surbl.org tflags SA_URI_RBL net
score SA_URI_RBL 3.0
(Likewise in SpamAssassin 3.0 with urirhsbl:)
urirhsbl URIBL_SA_SURBL ws.surbl.org. A header URIBL_SA_SURBL eval:check_uridnsbl('URIBL_SA_SURBL') describe URIBL_SA_SURBL Contains a URL listed in the SA SURBL blocklist tflags URIBL_SA_SURBL net
score URIBL_SA_SURBL 3.0
You can run either SURBL or both if you like. Note that ws has a higher spam detection rate (currently) but also a somewhat higher false positive rate than sc. Here's a corpus check Dan Quinlan ran:
OVERALL% SPAM% HAM% S/O RANK SCORE NAME 11189 1200 9989 0.107 0.00 0.00 (all messages) 100.000 10.7248 89.2752 0.107 0.00 0.00 (all messages as %) 6.095 56.2500 0.0701 0.999 1.00 1.00 URIBL_SC_SURBL 6.855 59.7500 0.5006 0.992 0.98 1.00 URIBL_SBL 9.545 72.8333 1.9421 0.974 0.95 0.01 T_URIBL_SA_SURBL 0.116 0.5000 0.0701 0.877 0.58 0.01 T_URIBL_DSBL
SA_SURBL above reflects the old name for ws; SC_SURBL is sc.surbl.org. ws detected ~73% of spams in the spam corpus with a ~1.9% FP rate in the ham corups. sc detected ~56% with a <0.1% FP rate.
We're still tuning how the SpamCop data is used, so the sc hit rates should improve and FPs decrease hopefully in the next version of the sc data engine.
Cheers,
Jeff C.