On Thursday, August 11, 2005, 9:36:47 AM, Theo Dinter wrote: > On Thu, Aug 11, 2005 at 03:31:57AM -0700, Jeff Chan wrote: >> > the IP >> > 219 dot 144 dot 194 dot 158 >> > is shown as listed by http://www.rulesemporium.com/cgi-bin/uribl.cgi - a >> > phishing mail with >> > http://219dot144dot194dot158:8081/secure.dresdner-privat.de/fb/privat/login/login.htm >> > in it's body does not trigger any uribl rules tho. Why is that so? >> >> What happens if you give the message to SpamAssassin in debug >> mode:
> Unless I'm missing something obvious, the URIBL plugin doesn't check IPs, > only domains. (At least I don't see where it differentiates and checks IPs.) We would like the URIBL plugin to check IPs, per #5: http://www.surbl.org/implementation.html "Handle numeric IPs in URIs similarly, but reverse the octet ordering before comparison against the RBL. This is a standard practice for RBLs. For example, http://10.20.30.40/ is checked as 40.30.20.10.multi.surbl.org. Numeric addresses should be in base-10 representation." IIRC 3.1 may do that, right? Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
