Jeff Chan wrote:
I replace sc.surbl.org by multi.surbl.org in my script.
OK, I should have mentioned that's not the preferred way to do things. :-)
For my purposes (I'm only interested in the listing status, it's not used for blocking mail) it is, one GetHostByName is faster than three.
You *could* make many rules to handle every numeric combination of the bits
All I do is something like `rxwhois -a qualitycorner.biz` resulting in...
| qualitycorner.biz not found at .rfc-ignorant.org or | .multi.surbl.org | whois -h whois.abuse.net qualitycorner.biz | postmaster@qualitycorner.biz (default, no info)
Hm, not very convincing, this spam was 30 minutes old. But for an older spamervized site `rxwhois -a eedqmed.com`
| eedqmed.com (6): .multi.surbl.org | whois -h whois.abuse.net eedqmed.com | postmaster@eedqmed.com (default, no info)
So that result tells me "unknown at abuse.net and RFCI, but listed in sc (2) and ws (4)", because multi said 6.
Therefore it could be interesting to attack this site at abuse@ and postmaster@, hoping for at least 1 bounce.
Then I'd submit the bounce to rfc-ignorant.org with an info to the Tech-C / Admin-C listed in the whois data for eedqmed.com
Maybe the latter results again in a bounce, and then I could report the domain as "whois ignorant" at RFCI and ICANN's whois data problem report system.
Of course I only do this when I'm very angry, normally SpamCop is good enough for me (and feeds sc.surbl.org :-)
Bye, Frank