From schampeo@hesketh.com Wed Sep 8 00:51:27 2004 From: Steven Champeon To: discuss@lists.surbl.org Subject: Re: [SURBL-Discuss] Nonexistent domains Date: Tue, 07 Sep 2004 18:50:50 -0400 Message-ID: <20040907225050.GG31962@hesketh.com> In-Reply-To: <20040904215752.D69296@drizzle.sasknow.net> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2154565009235901773==" --===============2154565009235901773== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable on Sat, Sep 04, 2004 at 10:05:20PM -0600, Ryan Thompson wrote: >=20 > What's the deal with nonexistent domains? I've been seeing more of these > in my corpora. They don't look like typos. Are spammers making up names, > or are they registering domains and having them deleted later (either by > their choice, or the registrars'?) Should we even consider listing them, > or is poisoning not-yet-registered domains too much of a risk? They're making them up to add noise and unnecessary overhead to systems that check spam message bodies. Clearly, SURBL and others like it are having an impact on the response rates of this crud. =20 There's a cialis/levitra spammer who litters his message bodies with bogus URLs made of the localpart of the target address: davet:
V1l|*AGRA fina||y found a tough competitor -- ClA1||IS & lEV|ITTRA!

1: 8O+% savings 0rdering !
2= : no prescription required .
3: doctor & F.D.A approved !
4: Overnight shipping !

N0W V1SlT 0UR WEBS= |TE : CI|CK HERE

I strip these out into quarantine before subjecting them to surbl. Here's one with one valid domain and seven bogus ones: Xanax, \/alium ,Cia|is, \/iagra many more...= !!
We stand behind 0ur products and service.
|n fact, we're the first company to ever back a
pharmaceutica| pr0duct with a 10O% money back guaranttee

Cl|CK HERE KN0W M0RE

PxjEjnNDhaf Seems pretty obvious that their goal is to render SURBLs uselessly inundated by lookups, no? That's one reason why I recently started doing a normal NS record lookup of the hostname before I look it up at multi.surbl.org. --=20 hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=3Dnosim/ --===============2154565009235901773==--