We are deprecating be.surbl.org, the SURBL list made from a stale snapshot of the BigEvil list before it got ws added into it. BE probably isn't too useful anymore since it's not getting updated, so please change to using ws.surbl.org instead. Eventually we would like to get rid of BE entirely.

http://www.surbl.org/lists.html#ws

WS has:

1. BigEvil by Chris Santerre and his SARE cohorts 2. Paul Barbeau's MidEvil.cf 3. Bill Stearns' sa-blacklist 4. filtered spamtrap records from Joe Wein's jwSpamSpy 5. MailSecurity's formerly proprietary SURBL lists 6. data from Raymond Dijkxhoorn's Prolocation RBL 7. some other manual lists, mostly maintained by Chris.

So if you were using BE, please change to WS instead. Config file entries for SpamAssassin look like this:

An SA 2.63/2.64 rule and score using SpamCopURI (but not the SpamCop data!) looks like this:

uri WS_URI_RBL eval:check_spamcop_uri_rbl('ws.surbl.org','127.0.0.2') describe WS_URI_RBL URI's domain appears in sa-blacklist tflags WS_URI_RBL net

score WS_URI_RBL 3.0

An SA 3.0 rule and score using URIBL's urirhsbl looks like this:

urirhsbl URIBL_WS_SURBL ws.surbl.org. A header URIBL_WS_SURBL eval:check_uridnsbl('URIBL_WS_SURBL') describe URIBL_WS_SURBL Contains a URL listed in sa-blacklist tflags URIBL_WS_SURBL net

score URIBL_WS_SURBL 3.0

An SA 3.0 rule and score using URIBL's urirhssub looks like this:

urirhssub URIBL_WS_SURBL multi.surbl.org. A 4 header URIBL_WS_SURBL eval:check_uridnsbl('URIBL_WS_SURBL') describe URIBL_WS_SURBL Contains a URL listed in the WS SURBL blocklist tflags URIBL_WS_SURBL net

score URIBL_WS_SURBL 3.0

Jeff C.