On Wed, 29 Oct 2008, Claudia Burman wrote:

> ...if the URI is not listed in www.uribl.com ?
>
> Return-Path:
> Received: from [...] (sending to my server)
> Received: from pikachu.nic.ar (unknown [140.191.48.11])
> by maderna.nic.ar (Postfix) with ESMTP id 83E07D7049;
> Wed, 29 Oct 2008 12:23:19 -0200 (ARST)
> Received: by pikachu.nic.ar (Postfix, from userid 2)
> id 0C59B17873; Wed, 29 Oct 2008 12:23:18 -0200 (ARST)
> Subject: Solicitud de Modificacion de Datos de xxxx.com.ar Recibida
> From: tramites-ack@nic.ar
> To: tramites-ack@nic.ar
> Reply-To: info@nic.ar
> Errors-To: domar_errors@mrecic.gov.ar
> Message-Id: <20081029142319.0C59B17873@pikachu.nic.ar>
> Date: Wed, 29 Oct 2008 12:23:18 -0200 (ARST)
> X-Virus-Scanned: amavisd-new at xxxxx.com
> X-Spam-Status: Yes, score=6.469 required=5 tests=[DNS_FROM_RFC_ABUSE=0.479,
> DNS_FROM_RFC_POST=1.44, EXCLAMACION_ES=1, NO_REAL_NAME=0.55, URIBL_BLACK=3]
> X-Spam-Score: 6.469
> X-Spam-Level: ******
> X-Spam-Flag: YES


Where's a URI in that?

Look in the message body for URIs and/or domain names and check those
against www.uribl.com.

> Another message from the same domain doesn't hit the rule


URIBL != DNSBL

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
2 days until Halloween