[SURBL-Discuss] Strange domains, Get no hits. Are they trying to fool SURBL?

Jeff Chan jeffc at surbl.org
Fri Oct 8 14:15:49 CEST 2004


On Friday, October 8, 2004, 4:47:39 AM, Martin Martin wrote:
> Hi,

> Got two different spams not getting caught by SURBL. The domains for 
> both of the spams looks like this:

> http://ss.net.yourstuffspotMUNGED.com?qd="and a tracking id"

> AND

> http://mq.net.yourstuffspotMUNGED.com?r="and a tracking id"

> I checked the domain at rulesemporium and got a hit on 
> yourstuffspotMUNGED.com but not at the subdomains. Somehow SURBL don't 
> catch it even though it's listed on WS.

> Are they trying to fool SURBL or what is going on?

What program are you using?  SpamAssassin?  If so,
what command: urirhssub or SpamCopURI?

If you have a generic SA 3.0, the command is urirhssub.  In
that case you should post the sample message to the
SpamAssassin users list with a description of the problem
to see if others can duplicate and debug it.

Strictly speaking this is an issue with a program using
SURBLs rather than SURBLs themselves.

Jeff C.
--
"If it appears in hams, then don't list it."



More information about the Discuss mailing list