> > > > www.achat-montre-rolex.net./
> Yes, all the discussions on this list that contain the above text
> are being flagged by my SA as hitting the OB SURBL list.
>
> That particular host/URL is only registered in the OB list, do you
> have a check against:
> check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0+16')
>
> in your spamcop_uri.cf (or what ever ".cf" that you've got your
> check_spamcop_uri_rbl rules)?
In spamcop_uri.cf, I've got:
uri OB_URI_RBL
eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0+16')
describe OB_URI_RBL Has URI in OB at http://www.surbl.org/lists.html
tflags OB_URI_RBL net
and:
score OB_URI_RBL 2.2
> Also which version of SpamCopURI are you running? (need 0.22
> or newer).
I upgraded just the other day (at which point I suspect I broke something)
as I saw on a site somewhere that 2.6.3 was vulnerable to a DOS attack. I
upgraded to 2.6.4 for SA, and 0.25 for SpamCopURI
Grepping through my messages file, it looks like the only URI_RBL rule I've
seen triggered is SPAMCOP_URI_RBL; none of the others have been triggered at
all.
I'm using amavisd-new, not spamd, but that does not appear to matter. When
running spammassassin -t manually on that last email you sent, David, I get
ZERO hits:
Content analysis details: (0.0 points, 5.0 required)
An nslookup on the spam box shows that it should be flagged:
[EMAIL PROTECTED] spamassassin]# nslookup achat-montre-rolex.net.ob.surbl.org
Non-authoritative answer:
Name: achat-montre-rolex.net.ob.surbl.org
Address: 127.0.0.2
Hmmm... any ideas?
thanks!
johnS
