New subject: Start an IP list to block?

9 Sep 2004


      ...
-----Original Message-----
From: Matt Kettler [mailto:mkettler@evi-inc.com]
Sent: Thursday, September 09, 2004 5:18 PM
To: Chris Santerre; SURBL Discussion list (E-mail)
Cc: Spamassassin-Talk (E-mail)
Subject: Re: Start an IP list to block?
At 04:56 PM 9/9/2004, Chris Santerre wrote:
...
So is there a way to use the IP info in a good way? Could SA
or SURBL do a
...
quick ping of the URL and match against a URL? This would
allow us to simply
...
list 1 IP instead of all these domains.
Chris, SA 3.0 appears to already support checking DNS 
blacklisting of URLs 
based on resolved IP. (as well as surbl-style based on domain 
name). So 
theoretically, SURBL could open up a separate list based on 
IP's (i.e.: 
multi.dnsbl.surbl.org)
Take a look at the example where it checks the resolved IP of 
a URL against 
the SBL (an IP based list):
    uridnsbl        URIBL_SBL       sbl.spamhaus.org.       TXT
    header          URIBL_SBL       

eval:check_uridnsbl('URIBL_SBL')
        describe        URIBL_SBL       Contains a URL listed 
in the SBL 
blocklist
        tflags          URIBL_SBL       net
and from URIDNSBL.pm:
    This works by analysing message text and HTML for 

URLs, extracting the
        domain names from those, querying their NS records in 
DNS, resolving
        the hostnames used therein, and querying various DNS 
blocklists for
        those IP addresses.  This is quite effective.
    SYNOPSIS

    loadplugin    Mail::SpamAssassin::Plugin::URIDNSBL
    uridnsbl      URIBL_SBLXBL    sbl-xbl.spamhaus.org.   TXT


OOOOOOHHHHH yeah! I didn't know that! Are we sure this is actually what it
means and not just a miss-syntaxed paragraph? It actually resolves the IP
against the RBL lookup?
If so....well then...problem solved, and devs get a cookie :)
--Chris (todays choices are: Oreo or NutterButter.)

RE: Start an IP list to block?