Re: Strange URIBL_SBL false positive?

[Tom Hendrikx]

On 10/17/2013 12:25 PM, Marco wrote:
> Hello,
> 
>  If I submit this to Spamassassin 3.3.2:
> 
>   <div><b>Da:</b> &lt;<a
> href="mailto:ziop...@errebian.it";>ziop...@errebian.it</a>&gt;<br>;
>    <b>Cc:</b> Alice &lt;<a
> href="mailto:al...@errebian.it";>al...@errebian.it</a>&gt;,
>    Bob &lt;<a href="mailto:b...@errebian.it";>b...@errebian.it</a>&gt;<br>;
> 
> I see:
> 
>  7.0 URIBL_SBL              Contains an URL listed in the SBL blocklist
>                             [URIs: errebian.it]
> 
> ...but errebian.it IPs are not in SBL..!
> 
> Could you help me to understand?
> Thank you very much!!
> 
> Marco
> 

We had this too for one of our customers. Your problem is that one of
the nameservers of the domain is listed:

http://www.spamhaus.org/query/ip/151.1.141.150

I'm not really sure whether it's a feature or a bug that the rule/plugin
goes that deep while searching for possible wrongdoing ip addresses...

Regards,
        Tom

signature.asc
Description: OpenPGP digital signature