[SURBL-Discuss] registrar boundary inconsistencies

Daniel Quinlan quinlan at pathname.com
Thu May 5 07:19:07 CEST 2005


I ran SURBL (well, a copy a few weeks old) through the split_domains()
function in SpamAssassin to see which listings contained both a
host+domain rather than just domain from the perspective of
SpamAssassin.  Those listings would be missed by the URIBL module.

These are reversed for easier reading, but basically, it works like this:

if this is listed:

  com.50megs.brisisbri
  com.50megs.cddvdmp3
  com.50megs.slashbackman

were these then in SURBL:

  brisisbri.50megs.com
  cddvdmp3.50megs.com
  slashbackman.50megs.com

However, the URIDNSBL plugin would catch none of those unless 50megs.com
was listed (it's not) since 50megs.com is the domain as far as
SpamAssassin is concerned.  However, it would catch them if 50megs.com
was in SURBL in addition or instead of those hostname.domain
combinations.

Here is the data.  We (SURBL or SpamAssassin) need to do one of these
actions for each of these listings and SURBL probably has more to say
about it (initially, at least) since it's your database.

  - change the domain code in SA to consider the domain a registry like
    eu.org or demon.co.uk (let us know and we'll change our code as long
    as it makes sense ;-).  This means we don't expect blacklist the
    entire "registry".
 
  - SURBL (or your data provider) blacklists the entire domain

  - remove the hostname.domain listings ... why bother if nothing's
    going to hit them

Daniel

------- start of cut text --------------
br.adm.etiquetabordada
br.adm.hbl
br.adm.max
br.adm.mensagemonline
br.adm.mundial
br.adm.ondec-sp
br.adm.wfh1000
br.pro.additionalservices
br.pro.adorationsofallinvoled
br.pro.allourchoices
br.pro.applieapplestosciene
br.pro.bojengles
br.pro.clemts
br.pro.considerothers
br.pro.crazyarrra
br.pro.e-server
br.pro.exodus
br.pro.havealook
br.pro.ifnotnowwhen
br.pro.interarmaenimsilentleges
br.pro.keepthepeaceprocess
br.pro.keepyourheadup
br.pro.krisenmj
br.pro.mastrmnd
br.pro.muchmorefor-you
br.pro.raisetheblackflag
br.pro.saveourselves
br.pro.solarityinfstr
br.pro.strcturedsizeappl
br.pro.thisisthetime
br.pro.trabalho
br.pro.wwolf359
br.pro.xerion
com.50megs.brisisbri
com.50megs.cddvdmp3
com.50megs.slashbackman
com.netfirms.chasyfogin
com.netfirms.chrterone
com.netfirms.citl5d8rdsir
com.netfirms.desynecyx
com.netfirms.ebfeesycom
com.netfirms.gsternal
com.netfirms.minakis30
com.netfirms.ww2-serv-wm
com.port5.1stsource
com.port5.e-suntrust
com.proxymyworld
com.proxymyworld.charterone
com.proxymyworld.citifinancial
com.proxymyworld.citizensbank
com.proxymyworld.regionsnet
com.tripod.billebay
com.tripod.paypalzzzz
ee.pri.highlight
ee.pri.zammy
kg.pe
kg.pe.ebaycom
kg.pe.halifax-online
kr.es
kr.es.bos
kr.es.cabs
kr.es.wbong
net.cjb.account-overdue
net.cjb.cgi4-awconfirmisapidll-38u3428
net.cjb.dh7wznrj
net.cjb.updateyourpaypai
net.ebay-online
net.ebay-online.information
net.ebay-online.verify
net.ohaime.bankofoklahoma
net.ohaime.charterone
net.ohaime.lasallebank
net.userset.uk.co.barclays
net.userset.uk.co.halifax-online
net.userset.uk.co.nationwide
nr.co.hahano
nr.co.moot
ro.go
ro.go.accshert
ro.go.citicards1
ro.go.luca2003
ro.home.hai-saruta-ma
ro.home.login543644
ro.home.rranostand
ro.home.xyxca
ru.da.49
ru.da.5120
ru.da.aavm59jk
ru.da.gvqw30fsg
ru.nm.berawepoy
ru.nm.lo409fds
ru.nm.m5nu728f
ru.nm.saoretwas
st.cn.adult-portal
st.cn.boysarchive
st.cn.gowdot
st.cn.kindyraod
st.cn.underageworld
st.hk.7now
st.hk.adult-portal
st.hk.adultworld
st.hk.animeangels
st.hk.boys-portal
st.hk.comics-evolution
st.hk.hotgirlsphotos
st.hk.lollyedition7
st.hk.mydreamlo
st.hk.ppvcd
st.hk.uderageworld
st.hk.ummmyea
st.hk.undersites
st.hk.underworld
st.hk.undworld
st.hk.x-adult
st.sg.adult-portal
st.sg.adultworld
st.sg.comics-evolution
st.sg.factoryb
st.sg.felcorp
st.sg.jklos
st.sg.lolmag4
st.sg.ptz-portal
st.sg.undworld
st.sg.uworld
st.tw.adult-portal
st.tw.adultworld
st.tw.redvids2
st.ye.hegre
st.ye.lesbian
us.onlinehome.s110082232
us.onlinehome.s117107589
us.onlinehome.s118791939
------- end ----------------------------

-- 
Daniel Quinlan
http://www.pathname.com/~quinlan/


More information about the Discuss mailing list