[SURBL-Discuss] Would SURBL block Yahoo redirect?

[Jeff Chan]

On Tuesday, May 17, 2005, 2:38:07 AM, Raymond Dijkxhoorn wrote:
>> http://rds.yahoo.com/*-http://www.thelumbercartel.com/
>>
>> I caught a few spams using yahoo to disguise their URL. saw somthing like 
>> this:

> The old plugin could follow these links....

SpamAssasin 3 checks all the visible links.  So it checks
yahoo.com and thelumbercartel.com .  I ran the message
through spamassassin -D and the output is below.  (It actually
skips yahoo.com because it's in the skip list (local whitelist),
but if it weren't, it too would be checked.)

Jeff C.
__

debug: uri found: http://rds.yahoo.com/*-http://www.thelumbercartel.com/
debug: uri found: mailto:Discuss at lists.surbl.org
debug: uri found: http://www.thelumbercartel.com/
debug: uri found: http://lists.surbl.org/mailman/listinfo/discuss
debug: URIDNSBL: found domain yahoo.com in skip list
debug: URIDNSBL: domains to query: surbl.org thelumbercartel.com
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.48
debug: all '*From' addrs: discuss-bounces at lists.surbl.org raymond at surbl.org
debug: Running tests for priority: 0
debug: running header regexp tests; score so far=0
debug: registering glue method for check_hashcash_double_spend (Mail::SpamAssass
in::Plugin::Hashcash=HASH(0x8ba1500))
debug: registering glue method for check_for_spf_helo_pass (Mail::SpamAssassin::
Plugin::SPF=HASH(0x8bb208c))
debug: SPF: checking HELO (helo=mailbox.prolocation.net, ip=81.23.230.7)
debug: SPF: trimmed HELO down to 'prolocation.net'
debug: SPF: cannot load or create Mail::SPF::Query module
debug: forged-HELO: from=prolocation.net helo=prolocation.net by=freeapp.net
debug: forged-HELO: from=(undef) helo=prolocation.net by=prolocation.net
debug: forged-HELO: from=prolocation.net helo=prolocation.net by=prolocation.net
debug: forged-HELO: from=prolocation.net helo=prolocation.net by=prolocation.net
debug: forged-HELO: from=prolocation.net helo=prolocation.net by=prolocation.net
debug: forged-HELO: from=(undef) helo=prolocation.net by=prolocation.net
debug: registering glue method for check_hashcash_value (Mail::SpamAssassin::Plu
gin::Hashcash=HASH(0x8ba1500))
debug: all '*To' addrs: surbl at supranet.net discuss at lists.surbl.org
debug: registering glue method for check_for_spf_softfail (Mail::SpamAssassin::P
lugin::SPF=HASH(0x8bb208c))
debug: SPF: relayed through one or more trusted relays, cannot use header-based
Envelope-From, skipping
debug: registering glue method for check_for_spf_pass (Mail::SpamAssassin::Plugi
n::SPF=HASH(0x8bb208c))
debug: registering glue method for check_for_spf_helo_softfail (Mail::SpamAssass
in::Plugin::SPF=HASH(0x8bb208c))
debug: registering glue method for check_for_spf_helo_fail (Mail::SpamAssassin::
Plugin::SPF=HASH(0x8bb208c))
debug: running body-text per-line regexp tests; score so far=0
debug: running uri tests; score so far=0
debug: registering glue method for check_uridnsbl (Mail::SpamAssassin::Plugin::U
RIDNSBL=HASH(0x8b8c6e0))
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8b8c6e0) implements '
check_tick'
debug: URIDNSBL: query for thelumbercartel.com took 0 seconds to look up (multi.
surbl.org.:thelumbercartel.com)
debug: URIDNSBL: query for surbl.org took 0 seconds to look up (multi.surbl.org.
:surbl.org)
debug: URIDNSBL: queries completed: 4 started: 12
debug: URIDNSBL: queries active:  at Tue May 17 05:42:30 2005
debug: running raw-body-text per-line regexp tests; score so far=0
debug: running full-text regexp tests; score so far=0
debug: DCCifd is not available: no r/w dccifd socket found.
debug: Running tests for priority: 500
debug: URIDNSBL: queries completed: 12 started: 12
debug: URIDNSBL: queries active:  at Tue May 17 05:42:30 2005
debug: RBL: success for 33 of 33 queries
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8b8c6e0) implements '
check_post_dnsbl'
debug: URIDNSBL: queries completed: 0 started: 0
debug: URIDNSBL: queries active: DNSBL=12 at Tue May 17 05:42:30 2005
debug: waiting 2 seconds for URIDNSBL lookups to complete
debug: URIDNSBL: queries completed: 0 started: 0
debug: URIDNSBL: queries active: DNSBL=12 at Tue May 17 05:42:30 2005
debug: URIDNSBL: query for thelumbercartel.com took 1 seconds to look up (sbl.sp
amhaus.org.:185.244.49.64)
[...]
debug: URIDNSBL: queries completed: 12 started: 0
debug: URIDNSBL: queries active:  at Tue May 17 05:42:31 2005
debug: done waiting for URIDNSBL lookups to complete

--
Don't harm innocent bystanders.