There is a lot of flexiblity in the invuribl scoring.
I consider the surbl.org to be a consolidation of separate uribl lists and
use the bitmask scoring option.
So if somebody is listed on more than one list, they'll get higher weights.
I can also score lists such as ws.surbl.org lower because they tend to get
more false positives.
The maxweight coming out of URIBL would be 200 for me. (100 subject tag, 200
hold, 300 delete)
Here's much of my config file:
<add key="Enable_Max_Weight" value="true" />
<add key="MAXWEIGHT" value="200" />
<add key="URIBL_List1" value="multi.surbl.org" />
<!-- Will return the last octet as the weight. If Custom Bitmask Values
Are Enabled-->
<!-- their values will take precedence over this setting -->
<!-- <add key="URIBL_Return_Result_As_Weight" value="false" /> -->
<!-- Weight added to the result code or custom bitmask total. -->
<add key="URIBL_Weight_List1" value="0" />
<!--Allows you to override the normal values for bitmasks for a custom
return weight-->
<add key="Enable_Custom_Bitmask_Values_URIBL_List1" value="true" />
<!--If using multi.surbl.org see http://www.surbl.org/lists.html#multi
for which lists correspond -->
<!--to which bitmask values -->
<!-- BitValue_2 = comes from sc.surbl.org -->
<!-- BitValue_4 = comes from ws.surbl.org -->
<!-- BitValue_8 = comes from phishing data source (labelled as [ph] in
multi) -->
<!-- BitValue_16 = comes from ob.surbl.org -->
<!-- BitValue_32 = comes from ab.surbl.org -->
<!-- BitValue_64 = comes from jp data source (labelled as [jp] in
multi) -->
<add key="URI_Bitmask_BitValue_1_Weight_URIBL_List1" value="0" />
<add key="URI_Bitmask_BitValue_2_Weight_URIBL_List1" value="100" />
<add key="URI_Bitmask_BitValue_4_Weight_URIBL_List1" value="50" />
<add key="URI_Bitmask_BitValue_8_Weight_URIBL_List1" value="100" />
<add key="URI_Bitmask_BitValue_16_Weight_URIBL_List1" value="100" />
<add key="URI_Bitmask_BitValue_32_Weight_URIBL_List1" value="100" />
<add key="URI_Bitmask_BitValue_64_Weight_URIBL_List1" value="100" />
<add key="URI_Bitmask_BitValue_128_Weight_URIBL_List1" value="0" />
<!--URI LIST 2-->
<add key="URIBL_List2" value="multi.uribl.com" />
<add key="URIBL_Weight_List2" value="0" />
<!-- BitValue_2 = comes from black.uribl.org -->
<!-- BitValue_4 = comes from grey.uribl.org -->
<!-- BitValue_8 = comes from red.uribl.org -->
<add key="Enable_Custom_Bitmask_Values_URIBL_List2" value="true" />
<add key="URI_Bitmask_BitValue_1_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_2_Weight_URIBL_List2" value="100" />
<add key="URI_Bitmask_BitValue_4_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_8_Weight_URIBL_List2" value="25" />
<add key="URI_Bitmask_BitValue_16_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_32_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_64_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_128_Weight_URIBL_List2" value="0" />
<!--Enables the checking of the URI's name servers against an RBL. -->
<!--If the name servers are listed in the RBL the defined weight
will -->
<!--be added. You also have an option to skip looking up the
nameservers -->
<!--if the URI is already listed in one of the URI lists (Beta 5)-->
<add key="Enable_URI_Name_Server_Check" value="true" />
<add key="Skip_Check_If_URI_Listed_In_URI_List" value="false" />
<add key="Name_Server_RBL" value="sbl.spamhaus.org" />
<add key="Name_Server_Weight" value="100" />
<add key="Max_Name_Servers_To_Check" value="3" />
----- Original Message -----
From: "Dave Beckstrom" <[EMAIL PROTECTED]>
To: <declude.junkmail@declude.com>
Sent: Tuesday, October 10, 2006 10:39 AM
Subject: [Declude.JunkMail] INV-URIBL Scoring?
Hi Guys,
Considering that INV-URIBL looks at just the links contained in known
spam,
is it safe to set the weight on this test so high that this single test
would trigger a hold or delete weight?
Right now I have it set to score fairly low, and it adds to the total
score,
but would not cause a hold without other tests adding to the weight.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
