> www.ch is a weird special case as a > domain name Did you check whois for www.ch? It's a registered domain and it resolves, so the owner has a whitelisting in SA or better his www.ch links which may host a very sophisticated spearphish page will never be queried by SA against blacklists.
Sorry but that imho is a bug that should (better must) be fixed :-) Cheers tobi On 11/6/20 5:10 PM, RW wrote: > On Fri, 6 Nov 2020 15:40:31 +0100 > "Tobi wrote: > >> Hi list >> >> we currently see the following "issue" where SA does append .com TLD >> to uri domains found in body. >> >> Add a uri like "www.ch" to a txt body part and SA will add "ch.com" to >> domains to be checked >> >> Nov 6 15:23:52.527 [16955] dbg: uri: canonicalizing parsed uri: >> http://www.ch >> Nov 6 15:23:52.527 [16955] dbg: uri: cleaned uri: http://www.ch.com >> Nov 6 15:23:52.527 [16955] dbg: uri: added host: www.ch.com domain: >> ch.com [...] >> Nov 6 15:23:52.602 [16955] dbg: async: launching >> A/ch.com.multi.uribl.com for DNSBL:ch.com:multi.uribl.com >> >> Any other hostname than "www" does not trigger that behavior. So >> ftp.ch get correctly queried as ftp.ch and not ch.com > > I think it's from: > > https://bz.apache.org/SpamAssassin/show_bug.cgi?id=6596 > > It looks to be about Firefox adding .com in some cases where the > apparent domain is not resolving. www.ch is a weird special case as a > domain name, so I'm not surprized it isn't handled separately. > > However, I can't get an up-to-date Firefox to add .com, so the feature > may already be obsolete. >
