Invariant Systems - Invariant Systems URI Blacklist Tool

invURIBL - Version 3.1.1 (11/11/2007)
invURIBL is a tool that is used to identify SPAM by extracting URI's (domain names in links) from emails and checking them against URI based blacklists. Our application extends basic URI checking functionality by incorporating features that will allow you to check the URI's IP address and name servers against DNS based blacklists. In addition, we have added a unique feature that allows you to check the URI's IP address and remote mail server against Senderbase, the world's leading email traffic monitoring network.

URI filtering is a very effective anti-spam technique because it focuses on the sole purpose of the spam - the spamvertised link. Today spammers are creating large networks of computers with the sole purpose of distributing SPAM by hijacking virus and trojan infected computers. These networks often grow faster than RBL's are able to list the IP addresses responsible for sending out the SPAM. This is one weakness of traditional RBL's and spammers are actively exploiting this. One advantage of URI filtering over conventional RBL's is that the URI data contained within SPAM tends to be constant where as the source of the message constantly changes.

In addition to checking the URI's against URI blacklists we have added additional features that extend URI filtering. We have incorporated features such as checking the URI's name servers and IP address against blacklists. This is very effective because spammers tend to reuse the same name servers and networks that host their spamvertised sites. We have found that this type of testing is extremely effective at identifying new sources of SPAM.

URI filtering is an essential and effective component to add to your mail server's anti-spam program, because it judges SPAM based on content instead of where it was sent from.

invURIBL will work with any mail server product that can call an external program and process its return code. We have instructions on how to integrate invURIBL into several popular anti-spam products like Declude Junkmail, mxGuard, and Vamsoft's ORF.

Requirements

invURIBL.exe has the following requirements

Microsoft .NET Framework Version 2.0

Features

New and Improved URI Extraction Engine

Advanced URI Obfuscation Decoding

Domains are extracted from email addresses and checked as URI's

New Mime Parser - Handles Even The Most Structurally Flawed Messages

Ability to perform URI lookups against any URI Blacklist.

Custom bitmask handling of return codes.

Ability to check the URI's name servers against RBL's.

Ability to check the URI's IP address against RBL's.

Ability to check the URI's IP address against Senderbase

Ability to check the remote mail servers IP address against Senderbase

Ability to perform lookups against IP addresses found in http links.

Exception file to skip lookups on known non-spam domains.

Sender IP file to skip lookups of known good servers.

Ability To Skip Processing Based on a weight range

Max/Min weighting and Ability to stop processing on first hit

Enhanced Logic to prevent duplicate scoring

Performance based features like skipping the checking of attachments

Ability to add custom headers to the email message scanned

Rewrote to take advantage of the enhancements in the .Net 2.0 framework

12 months free email support and upgrades.

Documentation

For detailed configuration information and settings please consult our version 3.1.1 user guide.
invURIBL Version 3.1.1 User and Configuration Guide

Command Line Settings

Command Line:
invURIBL.exe <CURRENT WEIGHT> <REMOTE MAIL SERVER IP> <PATH TO MESSAGE>

Example:
invURIBL.exe 0 1.2.3.4 C:\SPOOL\MESSAGE.SMD

Return Codes

Invariant Systems URI lookup tool will return the weighted value that was accumulated throughout running all of the various tests that were defined in the invURIBL.exe.config file.

Declude Configuration

invURIBL easily integrates with Declude Junkmail. Once you have completed the steps outlined in the installation section of the invURIBL Version 3.1.1 User and Configuration Guide you will need to integrate invURIBL into Declude.

1.) Edit your Declude global.cfg file and add the following line.

INV-URIBL external weight "X:\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP%" 0 0

This line configures invURIBL as an external test for Declude that will add the weight generated inside of invURIBL into Declude. Please make sure you change the path to reflect the path on your system.

2.) Edit your $default$.junkmail files to add the INV-URIBL test.

SmarterMail Configuration

invURIBL easily integrates with SmarterMail 4.x. Once you have completed the steps outlined in the installation section of the invURIBL Version 3.1.1 User and Configuration Guide you will need to integrate invURIBL into SmarterMail.

After you install invURIBL there will be a PDF in the folder named "invURIBL Installation Instructions For SmarterMail 4.pdf"

Please follow the instructions in those files for integration. If you have any questions at all please contact us and we will help you out.

Vamsoft's ORF Configuration

invURIBL easily integrates with Vamsoft's ORF. Once you have completed the steps outlined in the installation section of the invURIBL Version 3.1.1 User and Configuration Guide you will need to integrate invURIBL into ORF.

In the contents of the latest version of invURIBL there will be a folder named ORF. Underneath that folder will contain the following files Readme.txt which is basic installation instructions and a PDF called invURIBL-ORF-Installation.pdf.

Please follow the instructions in those files for integration. If you have any questions at all please contact us and we will help you out.

mxGuard Configuration

invURIBL easily integrates with mxGuard 2.0+. Once you have completed the steps outlined in the installation section of the invURIBL Version 3.1.1 User and Configuration Guide you will need to integrate invURIBL into MxGuard.

To enable invURIBL in MxGuard you will need to update two sections in your mxGuard.ini

[Global]
SpamFilterTypes=Native
to
SpamFilterTypes=Native, invURIBL

[invURIBL]
PathToEXE=<invuribl program here>
to
PathToEXE=<path on your server>invuribl.exe

If you have any questions at all please contact us and we will help you out.

Download

Latest Version: 3.1.1 (Updated 11/11/2007)
Runs on Windows 2000, Windows XP, Windows 2003

THE TRIAL VERSION WILL NOT WORK WITH ANYTHING OTHER THAN A TRIAL LICENSE KEY. PLEASE MAKE SURE YOU DOWNLOAD THE RIGHT VERSION.

To Download The Trial Version click here.
To Download The Registered Version click here.
Documentation: invURIBL Version 3.1.1 User and Configuration Guide

Please note invURIBL requires an activation code to run. You can request one online from our trial request form here. Once you receive your license key please add it into your invuribl.exe.config file.

Purchase

To order a copy of invURIBL please click the link below.
invURIBL - 1 License $49.99

To renew your invURIBL maintenance agreement please click the link below.
invURIBL - 12 Month Service Agreement Renewal $30.00

Support

Please contact us at our Or join our

FAQ

Q. If I want to try this tool what should I use as my license key?
A. You can register for a trial license key by clicking here. The trial version is time limited and will expire in 30 days. When you receive your license key make sure you add it into your invuribl.exe.config configuration file. When the application expires it will default to returning "0" indicating that the message was clean and log a message into it's log file. If you would like to continue using invURIBL please purchase a license for your server.

Q. How is invURIBL licensed?
A. invURIBL is licensed in the per server model. Every server that runs a copy of invURIBL needs to have a license.

Q. Will my version 2.7 license key work with version 3.1.1
A. No, invURIBL 3.1.1 requires a new key. If you are eligible for the upgrade you can download your new license key from the My Account portal.

Q. Will my version 3.0.x version license key work with version 3.1.1
A. Yes, invURIBL 3.1.1 uses the same license key as 3.0.x. If you are eligible for the upgrade you can download the upgrade from the My Account portal.

Q. How can I monitor what invURIBL.exe is doing?
A. In the directory where you installed the application a text file will be created when each message is scanned.

Q. How are IP addresses handled when encountered in a message.
A. We handle numeric IP's by reversing the octet ordering before comparison against the RBL. This is standard practice for RBL's. For example, http://1.2.3.4/ is checked as 4.3.2.1.<list>.

Q. Do you intend to make another version not using the .Net framework?
A. We can provide a version of invURIBL that does not require the .Net Framework installed. Please send a message to our support staff for more information.