After all this arguing about whether a URI can be over-weighted (or
if a group of related lists are), on one of my local servers I tested the
short message (with the URL "intact") with arbitray innocuous headers:-------------------------------------------------------------------------------- Test this: http://checpri.com-MUNG/ -------------------------------------------------------------------------------- With my local rules included, the URI rules hit included: RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50% [cf: 100] RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist [URIs: checpri.com-MUNG] URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist [URIs: checpri.com-MUNG] URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist [URIs: checpri.com-MUNG] URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist [URIs: checpri.com-MUNG] URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: checpri.com-MUNG] URIBL_SBL Contains an URL listed in the SBL blocklist [URIs: checpri.com-MUNG] URIBL_RHS_URIBL_BLACK Contains an URI listed in [black] uribl.com [URIs: checpri.com-MUNG] URI_IN_SORBS_DNS_SPAM URI in spam.dnsbl.sorbs.net [URIs: checpri.com-MUNG] URIBL_RHS_POST Contains an URI in postmaster.rfc-ignorant.org [URIs: checpri.com-MUNG] URIBL_RHS_ABUSE Contains an URI listed in abuse.rfc-ignorant.org [URIs: checpri.com-MUNG] URIBL_RHS_NOCOMPLAINTS Domain doesn't accept abuse@ or postmaster@ URIBL_RHS_DSN Contains an URI listed in dsn.rfc-ignorant.org [URIs: checpri.com-MUNG] URIBL_RHS_NOSTDMAIL Domain doesn't accept abuse@ or postmaster@ or DSN For a Kuvayev pill domain, the about 20 points for just mentioning the domain seems about correct to me. The example of one friend complaining to another doesn't hold up: If you were complaining about profanity, you wouldn't reproduce it verbatim. People need to learn the same is true for spam, and any of many simple methods to "MUNG" the URIs (if nothing else, so your friend can't "accidentally" follow a link) will prevent many mistakes; The problem and solution (i.e. "MUNG"'ing) is even more important when trojan sites are being discussed. BTW. I believe the standard filter operating on this list will now score the domain alone at over 15 points (i.e. > the 10 points that ChrisS complained about in his hockey-deprived state). Paul Shupak [EMAIL PROTECTED]
