I found the following domains listed in a ~20K ham corpus from the last couple of days:
Domain Age in Days Score (#msgs) attac.biz 826 -3.3333 (1) blah.com 3462 -3.3333 (1) chartshop.com 2275 -3.3333 (1) publicaster.com 965 -3.3333 (1) resortvacationstogo.com 1849 -3.3333 (1) send4fun.com 1681 -30.0000 (1) surveymonkey.com 1770 -3.3333 (4) topcities.com 1926 -2.5000 (1) whtirc.com 246 -3.2491 (1) whtradio.com 196 -2.3630 (1)
Full GetURI output: http://ry.ca/geturi/runs/20040910-fps.html
Quick look:
attac.biz Looks real fishy, but appeared in some travel newsletter. Related to eturbonews.com. Maybe de-list, but don't whitelist.
blah.com This was in a ProFTPd mailing list message "how do I set up a virtual host for "blah.com".
chartshop.com Astrology.com newsletter. People really do sign up for those things.
surveymonkey.com AFAICT, mostly legit surveys
send4fun.com Jokes, example was person to person links
topcities.com Free subdomain host.
whtirc.com, whtradio.com Web Hosting Talk newsletter. Yes, it's legit.
publicaster.com Used in some legit newsletters/mass media
resortvacationstogo.com Looks mostly legit, and they've been around for 1800+ days without any NANAS hits at all. Related to vacationstogo.com.
With the exception of attac.biz, I'd say whitelist the lot of these, unless anyone knows some reason why not. :-)
The *real* cool part is GetURI (devel version) actually processed all of these messages in one run, producing ~4MB of output. Mozilla, on the other hand, crashed rather unceremoniously. Be thankful I re-ran on only the messages that generated the FPs. :-)
Also, if someone wants to go through the *other* domains (i.e., those on a grey (not blue) background), there are probably quite a few other whitelist candidates there. (gc.ca, for instance :-)
- Ryan