Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - SURBL Question
  FAQ FAQ  Forum Search   Register Register  Login Login

SURBL Question

 Post Reply Post Reply
Author
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Topic: SURBL Question
    Posted: 24 May 2005 at 6:44pm

Roberto,

Will the SURBL pick up a URL that is obfuscated as:

http://eProNAR=2Ecom

I am seeing a lot of urls and address formed this way.  I have a filter, for now, that looks like: ((?i)http://.*=2ecom)  But it seems to me that there is a good chance of false positives with this RegEx.

Regards,

 

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 24 May 2005 at 10:37pm
Is that the actual syntax (=2E) rather than the period? Yes or no, SpamFilter won't catch it, we're looking for URI separators that don't include the "=". We're definetly going to try to catch these as well in the near future.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 24 May 2005 at 10:41pm

Originally posted by LogSat LogSat wrote:

Is that the actual syntax (=2E) rather than the period? Yes or no, SpamFilter won't catch it, we're looking for URI separators that don't include the "=". We're definetly going to try to catch these as well in the near future.

YES!  They are using the =2E to "make" a period.  Sneaky So in Sos!

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 24 May 2005 at 11:03pm
That's why I was asking... the =2E *should* not work, as it's %2e that translates to the period. But it's late and I *am* falling asleep... so could very well be already dreaming.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 25 May 2005 at 1:18pm

Roberto,

Sending a source message by email.

Regards,

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 25 May 2005 at 4:05pm
Got it, working on it to see if there's anything that can be done (and trying to see why the "=" works as you say...!
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 25 May 2005 at 4:21pm

Originally posted by LogSat LogSat wrote:

Got it, working on it to see if there's anything that can be done (and trying to see why the "=" works as you say...!

Roberto,

When you figure our why it works ... let me know!  Just weird.
Regards, 

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.078 seconds.