On Friday, October 8, 2004, 8:01:44 AM, Matt Kettler wrote: > At 08:43 AM 10/8/2004, Matt wrote: >>I have a question on the new(ish) scanning that spamassassin does on >>URI's. It seems to be working very well for us here, but I have a >>question.. >>WIll it catch: >> >>http://www.blah.com/?jj38942 >> >>as well as >> >>http://www.blah.com/?34223
> The URI blacklists only check the domain name, not the full target of the > link. > Theoretically, it should also match if the hostname changes, as long as the > domain+TLD part is the same (ie: foo.blah.com) > That said I've heard some mumblings the SA 3.0 implementation of domain > stripping is a bit different than the Mail::SpamCopURI version, and the > latter matches the SURBL back-end behavior more closely. However, this is > really a subject for Jeff Chan. It looks like urirhsbl and urirhssub in SA 3 check gtld domains at two levels: i.e. host.domain.com and domain.com are both checked if host.domain.com or blah.blah.blah.host.domain.com is found in a URI. cctlds (country code top level domains) are checked at more levels under the control of RegistrarBoundaries.pm. Please see that code for details. SpamCopURI may handle these a little differently but in all cases domains are reduced to their base (registered) domain and sometimes a level above. The data un the SURBL lists usually only has the base domains. Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
