Just got one of those sneak through. So here's a quick hack, already running life here. First, see it in action:
$ spamassassin -D uridnsbl < example.net 2>&1 | grep example.net [19364] dbg: uridnsbl: domains to query: example.net [19364] dbg: uridnsbl: domain "example.net" listed (URIBL_BLACK): 127.0.0.2 [19364] dbg: uridnsbl: domain "example.net" listed (URIBL_JP_SURBL): 127.0.0.64 From: "Buy V1agra Professional on www.example.net" <u...@example.com> The hack is rather trivial. Sorry, that's 3.2.x only. The for loop in the function _get_parsed_uri_list changed slightly in 3.3, so the patch doesn't apply. The change should be easy enough to do manually. I did *not* test this with 3.3, though. Parse URIs in From:name, the real-name part of the From header. $ diff -u PerMsgStatus.pm{-,} --- PerMsgStatus.pm- 2010-03-07 16:11:22.000000000 +0100 +++ PerMsgStatus.pm 2010-03-07 16:23:09.000000000 +0100 @@ -1956,7 +1956,7 @@ my $text; - for (@$textary) { + for ($self->get('From:name'), @$textary) { # NOTE: do not modify $_ in this loop while (/($uriRe)/igo) { my $uri = $1; -- char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}