[SURBL-Discuss] BigEvil + MidEvil as SURBL

Jeff Chan jeffc at surbl.org
Thu Apr 22 00:41:26 CEST 2004


On Wednesday, April 21, 2004, 11:32:52 PM, Raymond Dijkxhoorn wrote:
>> > Perhaps the ideal would be if the script that converts bigevil to rbl
>> > form could also generate a separate "wildevil" cf file containing only
>> > the wildcard entries from bigevil, so that people can have the best of
>> > both worlds...
>> 
>> That's an interesting idea.  I'd need to investigate how
>> reversible the transforms are however.  Note that the number of
>> wildcarded base domains discarded is currently 2%.

> Just give back:

> 127.0.0.2 SC
> 127.0.0.3 WS
> 127.0.0.4 BE
> 127.0.0.5 WE

> Then you can even with a combined BE/WE decide what to do depending on the 
> results, this is also needed for the combined list anyway.

The problem is that the wildcarded domains coming from BE don't
look like resolvable domains that can be put into an RBL.  They
look like:

> bestmedicine?sonline.biz
> bestmedicine?sonline.com
> bestmedicine?sonline.net
> blue-0[15].com
> boomnetworks2?.com
> cabledeals?.biz
> car[bdl]march.biz
...
> dfhfksd{1,5}.info
> drugs?d{0,4}.biz
> drugs?d{0,4}.com
> drugs?d{0,4}.info
> e-?xtremepenetration.biz
> e-?xtremepenetration.com
> e-?xtremepenetration.net
> e?meds?d{1,3}.com
> ehostzz?z?.biz
> ehostzz?z?.com
> ehostzz?z?.net

What I think John is asking for in essence is a version of
BigEvil.cf with the non-wildcarded domains removed, i.e. a subset
of the original ruleset with *only* the wildcarded domains.

Jeff C.



More information about the Discuss mailing list