[SURBL-Announce] Like sc.surbl.org, ws.surbl.org works with any SURBL-compatible programs

Jeff Chan jeffc at surbl.org
Sun Oct 31 14:11:37 CET 2004


A question about whether SpamCopURI would support using the
alternative SURBL ws.surbl.org came up, so I thought I'd address
that for everyone.  Any program that knows how to extract URIs
from message bodies, then domains from the URIs, then compare
those domains against an RBL can use any or all of the SURBL
lists.  Therefore SpamCopURI will work with ws.surbl.org just
fine.  (Noting of course that the ws results won't necessarily
be related to the SpamCop-derived data in the sc list.)

All you need to do is add a rule with the name of that list:

uri       SA_URI_RBL  eval:check_spamcop_uri_rbl('ws.surbl.org','127.0.0.2')
describe  SA_URI_RBL  URI's domain appears in spamcop database at ws.surbl.org
tflags    SA_URI_RBL  net

score     SA_URI_RBL  3.0


(Likewise in SpamAssassin 3.0 with urirhsbl:)

urirhsbl        URIBL_SA_SURBL  ws.surbl.org.   A
header          URIBL_SA_SURBL  eval:check_uridnsbl('URIBL_SA_SURBL')
describe        URIBL_SA_SURBL  Contains a URL listed in the SA SURBL blocklist
tflags          URIBL_SA_SURBL  net

score           URIBL_SA_SURBL  3.0


You can run either SURBL or both if you like.  Note that
ws has a higher spam detection rate (currently) but also
a somewhat higher false positive rate than sc.  Here's
a corpus check Dan Quinlan ran:

OVERALL%   SPAM%     HAM%     S/O    RANK   SCORE  NAME
  11189     1200     9989    0.107   0.00    0.00  (all messages)
100.000  10.7248  89.2752    0.107   0.00    0.00  (all messages as %)
  6.095  56.2500   0.0701    0.999   1.00    1.00  URIBL_SC_SURBL
  6.855  59.7500   0.5006    0.992   0.98    1.00  URIBL_SBL
  9.545  72.8333   1.9421    0.974   0.95    0.01  T_URIBL_SA_SURBL
  0.116   0.5000   0.0701    0.877   0.58    0.01  T_URIBL_DSBL

SA_SURBL above reflects the old name for ws; SC_SURBL is
sc.surbl.org.  ws detected ~73% of spams in the spam corpus
with a ~1.9% FP rate in the ham corups.  sc detected ~56%
with a <0.1% FP rate.

We're still tuning how the SpamCop data is used, so the sc
hit rates should improve and FPs decrease hopefully in the
next version of the sc data engine.

Cheers,

Jeff C.
-- 
Jeff Chan
mailto:jeffc at surbl.org
http://www.jeffchan.com/



More information about the Announce mailing list