SURBL Question
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5190
Printed Date: 10 May 2025 at 1:47am
Topic: SURBL Question
Posted By: Desperado
Subject: SURBL Question
Date Posted: 24 May 2005 at 6:44pm
|
Roberto, Will the SURBL pick up a URL that is obfuscated as: http://ePronAR=2Ecom - http://eProNAR=2Ecom I am seeing a lot of urls and address formed this way. I have a filter, for now, that looks like: ((?i)http://.*=2ecom) But it seems to me that there is a good chance of false positives with this RegEx. Regards,
------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
Replies:
Posted By: LogSat
Date Posted: 24 May 2005 at 10:37pm
|
Is that the actual syntax (=2E) rather than the period? Yes or no,
SpamFilter won't catch it, we're looking for URI separators that don't
include the "=". We're definetly going to try to catch these as well in
the near future.
------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: Desperado
Date Posted: 24 May 2005 at 10:41pm
|
YES! They are using the =2E to "make" a period. Sneaky So in Sos! ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
LogSat wrote:Posted By: LogSat
Date Posted: 24 May 2005 at 11:03pm
|
That's why I was asking... the =2E *should* not work, as it's %2e that
translates to the period. But it's late and I *am* falling asleep... so
could very well be already dreaming.
------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: Desperado
Date Posted: 25 May 2005 at 1:18pm
|
Roberto, Sending a source message by email. Regards, ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
Posted By: LogSat
Date Posted: 25 May 2005 at 4:05pm
|
Got it, working on it to see if there's anything that can be done (and trying to see why the "=" works as you say...!
------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: Desperado
Date Posted: 25 May 2005 at 4:21pm
|
Roberto, When you figure our why it works ... let me know! Just weird. ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |