SURBL Question |
Post Reply 
|
| Author | |
Desperado 
Senior Member 
Joined: 27 January 2005 Location: United States Status: Offline Points: 1143 |
 Post Options
 Thanks(0)
 Quote Reply
 Topic: SURBL QuestionPosted: 24 May 2005 at 6:44pm |
|
Roberto, Will the SURBL pick up a URL that is obfuscated as: I am seeing a lot of urls and address formed this way. I have a filter, for now, that looks like: ((?i)http://.*=2ecom) But it seems to me that there is a good chance of false positives with this RegEx. Regards,
|
|
|
The Desperado
Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
|
 |
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4106 |
Post Options
Thanks(0)
Quote Reply
Posted: 24 May 2005 at 10:37pm |
|
Is that the actual syntax (=2E) rather than the period? Yes or no,
SpamFilter won't catch it, we're looking for URI separators that don't
include the "=". We're definetly going to try to catch these as well in
the near future.
|
|
|
|
|
Desperado
Senior Member
Joined: 27 January 2005 Location: United States Status: Offline Points: 1143 |
Post Options
Thanks(0)
Quote Reply
Posted: 24 May 2005 at 10:41pm |
|
YES! They are using the =2E to "make" a period. Sneaky So in Sos! |
|
|
The Desperado
Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4106 |
Post Options
Thanks(0)
Quote Reply
Posted: 24 May 2005 at 11:03pm |
|
That's why I was asking... the =2E *should* not work, as it's %2e that
translates to the period. But it's late and I *am* falling asleep... so
could very well be already dreaming.
|
|
|
|
|
Desperado
Senior Member
Joined: 27 January 2005 Location: United States Status: Offline Points: 1143 |
Post Options
Thanks(0)
Quote Reply
Posted: 25 May 2005 at 1:18pm |
|
Roberto, Sending a source message by email. Regards, |
|
|
The Desperado
Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4106 |
Post Options
Thanks(0)
Quote Reply
Posted: 25 May 2005 at 4:05pm |
|
Got it, working on it to see if there's anything that can be done (and trying to see why the "=" works as you say...!
|
|
|
|
|
Desperado
Senior Member
Joined: 27 January 2005 Location: United States Status: Offline Points: 1143 |
Post Options
Thanks(0)
Quote Reply
Posted: 25 May 2005 at 4:21pm |
|
Roberto, When you figure our why it works ... let me know! Just weird. |
|
|
The Desperado
Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
|
|
|
Topic Options
LogSat wrote:|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.203 seconds.