SURBL installation

[Peter Bonivart]

Drew Marshall wrote:
> I have just moved to the bit masked list but I can't find any .cf file
> examples to check my syntax. I am getting hits but I'm not convinced for
> any combined results (e.g. a return of 127.0.0.6 being a 'hit' on 2
> lists). Is there any chance you could give some examples of what the
> surbl_url.cf should look like for the multi-list (like do I have to list
> the multiple options also or will SpamCopURI do that for me?)

Here's the whole file I use. Note that I use SpamCopURI 0.20 with the
127.0.0.0/X syntax, with 0.21+ you should move to 127.0.0.0+X even
though both will work for some time.

Think of it as binary, every 1 is a match so 6 is a match for list 2 and
4. You don't have to do anything special, SpamCopURI will decode it for
you. These are my hits so far:

AB_URI_RBL|5093
OB_URI_RBL|7417
PH_URI_RBL|15
SC_URI_RBL|5613
WS_URI_RBL|9077

--
/Peter Bonivart

--Unix lovers do it in the Sun

Sun Fire V210, Solaris 9, Sendmail 8.12.10, MailScanner 4.32.5,
SpamAssassin 2.63 + DCC 1.2.50, ClamAV 0.75.1 + GMP 4.1.2, Vispan 1.4

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html

    [ Part 2: "Attached Text" ]

# please see www.surbl.org for more information

# ab.surbl.org (AbuseButler)

uri       AB_URI_RBL  eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/32')
describe  AB_URI_RBL  URI's domain appears in ab.surbl.org
tflags    AB_URI_RBL  net
score     AB_URI_RBL  4.0

# ob.surbl.org (OutBlaze)

uri       OB_URI_RBL  eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/16')
describe  OB_URI_RBL  URI's domain appears in ob.surbl.org
tflags    OB_URI_RBL  net
score     OB_URI_RBL  4.0

# ph.surbl.org (Phishing)

uri       PH_URI_RBL  eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/8')
describe  PH_URI_RBL  URI's domain appears in ph.surbl.org
tflags    PH_URI_RBL  net
score     PH_URI_RBL  4.0

# sc.surbl.org (SpamCop)

uri       SC_URI_RBL  eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/2')
describe  SC_URI_RBL  URI's domain appears in spamcop database at sc.surbl.org
tflags    SC_URI_RBL  net
score     SC_URI_RBL  4.0

# ws.surbl.org (BigEvil, MidEvil, Blacklist, ...)

uri       WS_URI_RBL  eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0/4')
describe  WS_URI_RBL  URI's domain appears in sa-blacklist
tflags    WS_URI_RBL  net
score     WS_URI_RBL  4.0

# open redirect resolution off by default
# spamcop_uri_resolve_open_redirects 1

open_redirect_list_spamcop_uri   snurl.com              *.snurl.com
open_redirect_list_spamcop_uri   snipurl.com            *.snipurl.com
open_redirect_list_spamcop_uri   tinyclick.com          *.tinyclick.com
open_redirect_list_spamcop_uri   babyurl.com            *.babyurl.com
open_redirect_list_spamcop_uri   lin.kz                 *.lin.kz
open_redirect_list_spamcop_uri   *.v3.net
open_redirect_list_spamcop_uri   shorl.com              *.shorl.com
open_redirect_list_spamcop_uri   tinyurl.com            *.tinyurl.com
open_redirect_list_spamcop_uri   xurl.us

# whitelist_spamcop_uri   *.yahoo.com
# blacklist_spamcop_uri   *medz4cheap.com

# limits number of URL's checked
spamcop_uri_limit 20

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html