According to their "lists" page, I don't see any other lists that are:
a) small enough to reasonably search with declude BODY filters b) differentiated enough from the SpamCop-derived info to be worth the cost For example, the Outblaze list is ten times the size of the SpamCop list. This may change in the future, as they've noted that several lists, like the phishing list, may be broken out eventually. I'm including my customized version of Roger's script as a .txt file. As noted in the header, I've updated the URL, and included more short-circuit features to the resulting Declude filter file. You can choose up to 9 new lines in there. In my example, I'm including lines that include a real test I use that I posted a few days ago, as well as some of Matt Bramble's test names if you were to use his "beta" Size.vbs or Scott Fisher's Size.exe compiled version. If you use my version, you'll see a huge drop in your execution time, because you'll be skipping messages that are large enough to be ham. You didn't really need to scan every .xls, .doc, .pdf, .jpg, .gif, .bmp, .zip and everything else for SURBL URIs, did you? Andrew 8) -----Original Message----- From: Mark E. Smith [mailto:[EMAIL PROTECTED] Sent: Friday, October 29, 2004 2:03 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SURBL Lists. I recently added Roger Eriksson's SURBL filter and was wondering if anyone was using this to also pull the other SURBL lists at http://www.surbl.org/ Currently Roger's script only uses the sc.surbl.org.rbldnsd list. http://www.botany.gu.se/download/decludescript/SURBL_filter.zip --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
@echo off setlocal rem ----- surbl_filter.cmd version 1.2 ----- rem ----- [EMAIL PROTECTED] (April 18, 2004) ----- rem rem This script downloads the rbldns zone file of the Spam URI Realtime Blocklist, rem converts it to a body filter, and updates the existing filter file. It also rem creates a log file (surbl_log.txt). The filter is named surbl.txt and requires rem Declude JunkMail Pro 1.78b or later. Domains and ip addresses in the file rem surbl_exclude.txt will be excluded from the filter (by partial match). The script rem uses wget.exe for the download and todos.exe to convert the Unix line breaks. rem It should be scheduled to run at least once a day. rem rem These settings must be done (SETTINGS section below) before the script is used: rem v_path: path to this folder rem v_limit: update limit (max number of entries; blank or 0 if size should be unlimited) rem v_maxweight: filter max weight (blank or 0 if no max weight should be used) rem and filter entry weight (defaults to 0 if blank) rem v_skipweight: filter skip weight (blank or 0 if filter never should be skipped) rem v_url: download URL for the rbldns zone file rem v_exclude: test entries in the rbldns zone file (excluded from the filter file) rem rem AC Updated Sep-09-2004 to update the v_url value and v_exclude value as per rem changes posted in the News section at surbl.org rem AC Updated Oct-07-2004 to add in skipstrings to complement the maxweight and skipweight rem short-circuit logic rem --------------- SETTINGS --------------- rem --- Settings (see explanation above): --- set v_path=D:\SURBL set v_limit=3000 set v_maxweight=10 set v_skipweight=25 set v_skipstring1=TESTSFAILED END CONTAINS SKIPATTACH set v_skipstring2=TESTSFAILED END CONTAINS SIZE-L set v_skipstring3=TESTSFAILED END CONTAINS SIZE-XL set v_skipstring4=TESTSFAILED END CONTAINS SIZE-XXL set v_skipstring5= set v_skipstring6= set v_skipstring7= set v_skipstring8= set v_skipstring9= set v_url=http://www.surbl.org/sc.surbl.org.rbldnsd set v_exclude=test.surbl.org test.sc.surbl.org surbl-org-permanent-test-point.com 2.0.0.127 rem --------------- MAIN SCRIPT --------------- rem --- Create timestamp: --- for /f "tokens=*" %%a in ('date /t') do set v_time=%%a for /f "tokens=*" %%b in ('time /t') do set v_time=%v_time% %%b rem --- Check settings and change current folder (or exit if path is incorrect): --- if "%v_limit%"=="" set v_limit=0 if "%v_maxweight%"=="" set v_maxweight=0 if "%v_skipweight%"=="" set v_skipweight=0 if not exist %v_path%\nul (set v_result=path error) & (goto :s_end) cd /d %v_path% rem --- Download rbldns zone file (or exit if download failed): --- if exist surbl.rbldns.tmp del surbl.rbldns.tmp WGet %v_url% -O surbl.rbldns.tmp if not exist surbl.rbldns.tmp (set v_result=download error) & (goto :s_end) rem --- Convert line breaks from LF to CRLF (or exit if conversion failed): --- ToDOS surbl.rbldns.tmp for /f "tokens=*" %%c in ('findstr /r "$" surbl.rbldns.tmp') do set v_result=ok if not "%v_result%"=="ok" (set v_result=conversion error) & (goto :s_end) rem --- Add rbldns entries to file (skip header, test entries, and trailing spaces/tabs): --- if exist surbl.rbldns.entries.tmp del surbl.rbldns.entries.tmp for /f "tokens=1 delims= " %%d in ('findstr /v /b /i /l "$ @ : ; ! # %v_exclude%" surbl.rbldns.tmp') do echo %%d>> surbl.rbldns.entries.tmp rem --- Add filter entries to file (unreversed ip addresses and domains): --- if exist surbl.filter.entries.tmp del surbl.filter.entries.tmp for /f "tokens=1-4 delims=." %%e in ('findstr /i /r "^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*\>" surbl.rbldns.entries.tmp') do echo %%h.%%g.%%f.%%e>> surbl.filter.entries.tmp for /f "tokens=1" %%i in ('findstr /i /r "^.*\.[A-Z]*\>" surbl.rbldns.entries.tmp') do echo %%i>> surbl.filter.entries.tmp rem --- Create filter file header: --- if exist surbl.filter.tmp del surbl.filter.tmp echo # SURBL filter updated %v_time%> surbl.filter.tmp echo # Spam URI Realtime Blocklist (%v_url%)>> surbl.filter.tmp if %v_maxweight%%v_skipweight% GTR 0 echo # This filter will be:>> surbl.filter.tmp if %v_maxweight% GTR 0 echo # - stopped at first match with the additional weight %v_maxweight% >> surbl.filter.tmp if %v_skipweight% GTR 0 echo # - skipped if the weight %v_skipweight% already has been reached>> surbl.filter.tmp if %v_skipweight% GTR 0 echo # - skipped if the message has not failed any previous tests>> surbl.filter.tmp if "%v_skipstring1%" NEQ "" echo # - skipped if the message matches any shortcircuit tests>> surbl.filter.tmp echo.>> surbl.filter.tmp if %v_maxweight% GTR 0 echo MAXWEIGHT %v_maxweight% >> surbl.filter.tmp if %v_skipweight% GTR 0 echo SKIPIFWEIGHT %v_skipweight% >> surbl.filter.tmp if %v_skipweight% GTR 0 echo TESTSFAILED END ISBLANK>> surbl.filter.tmp if "%v_skipstring1%" NEQ "" echo %v_skipstring1%>> surbl.filter.tmp if "%v_skipstring2%" NEQ "" echo %v_skipstring2%>> surbl.filter.tmp if "%v_skipstring3%" NEQ "" echo %v_skipstring3%>> surbl.filter.tmp if "%v_skipstring4%" NEQ "" echo %v_skipstring4%>> surbl.filter.tmp if "%v_skipstring5%" NEQ "" echo %v_skipstring5%>> surbl.filter.tmp if "%v_skipstring6%" NEQ "" echo %v_skipstring6%>> surbl.filter.tmp if "%v_skipstring7%" NEQ "" echo %v_skipstring7%>> surbl.filter.tmp if "%v_skipstring8%" NEQ "" echo %v_skipstring8%>> surbl.filter.tmp if "%v_skipstring9%" NEQ "" echo %v_skipstring9%>> surbl.filter.tmp if %v_maxweight%%v_skipweight% GTR 0 echo.>> surbl.filter.tmp rem --- Add entries to filter file (skip entries in exclusion file; exclusion --- rem --- match pattern can be modified by inserting /x [exact], /b [begins with], --- rem --- or /e [ends with] before /g:surbl_exlude.txt below): -- if not exist surbl_exclude.txt echo.> surbl_exclude.txt for /f %%j in ('findstr /i /r "." surbl_exclude.txt') do set v_excludefile=ok if "%v_excludefile%"=="ok" ( for /f "tokens=*" %%k in ('findstr /v /i /l /g:surbl_exclude.txt surbl.filter.entries.tmp') do echo BODY %v_maxweight% CONTAINS %%k>> surbl.filter.tmp ) else ( for /f "tokens=*" %%l in (surbl.filter.entries.tmp) do echo BODY %v_maxweight% CONTAINS %%l>> surbl.filter.tmp ) rem --- Count number of entries (and exit if filter file is empty or limit is exceeded): --- for /f "tokens=1 delims=:" %%m in ('findstr /v /b /i /r "# $ MAXWEIGHT SKIPIFWEIGHT TESTSFAILED" surbl.filter.tmp ^| findstr /n /l "."') do set v_count=%%m if "%v_count%"=="" (set v_result=no entries) & (goto :s_end) if %v_limit% LEQ 0 goto :s_replace if %v_count% GTR %v_limit% (set v_result=limit exceeded) & (goto :s_end) rem --- Replace existing filter file in the working folder: --- :s_replace if exist surbl.old del surbl.old if exist surbl.txt rename surbl.txt surbl.old rename surbl.filter.tmp surbl.txt rem --- Overwrite the filter in the production folder: --- copy /y surbl.txt d:\imail\declude rem --- Write log entry and clean up: --- :s_end if not exist surbl_log.txt (echo # SURBL filter log created %v_time%> surbl_log.txt) & (echo.>> surbl_log.txt) if "%v_result%"=="ok" (echo %v_time% Update successful [%v_count% entries]>> surbl_log.txt) else (echo %v_time% Update failed [%v_result%]>> surbl_log.txt) if exist surbl.rbldns.tmp del surbl.rbldns.tmp if exist surbl.rbldns.entries.tmp del surbl.rbldns.entries.tmp if exist surbl.filter.entries.tmp del surbl.filter.entries.tmp if exist surbl.filter.tmp del surbl.filter.tmp endlocal
