Introduction

SURBL is an RBL designed to be used to block or tag spam based on URIs (usually their domain names) contained within the message body. It is not a conventional RBL in that it's not intended to block the source of spam messages. Instead, SURBL can be used to block spams based on their message content. It's somewhat analogous to Rev. Martin Luther King's philosophy in his famous "I have a dream" speech:
I have a dream that my four children will one day live in a nation where they will not be judged by the color of their skin but by the content of their character.
Similarly, we judge spam messages based on what they say, not where they come from.

We feel this is a promising approach since it addresses the core problem of spam most directly: the sites advertised in the spams. Spammers have found ways to get around conventional RBLs by stealing services from multiple open relays or hijacking computers using viruses or trojan horse programs. Because of this theft of services and forced entry into unsuspecting victim computers, spammers are able to exploit multiple new mail sources, sometimes for only a few minutes at a time, faster than RBLs can identify and block mail from those addresses. This is a significant weakness in conventional RBLs, and spammers have devised various ways to exploit it. There are other problems with conventional RBLs that can make their use potentially problematic. (This is not meant to be a criticism of RBLs however. Like most other mail administrators, I use some conventional RBLs on my mail servers to do things like block open relays, etc. So conventional RBLs can be used effectively together with SURBL.)

In contrast, the sites advertised in spams tend to be fairly stable and widely referenced across multiple spams from multiple sources. Since most spam aims to drive traffic to some web site, it tends to contain URIs which we can block on. That is the main, common weakness of spam, and it's about time we fought back with this information.

<< News & Notes Previous Section, Next Section Usage >>

introduction.html version 1.60 12/30/04