On Monday, September 6, 2004, 7:45:40 AM, Joe Wein wrote:
"Jose Marcio Martins da Cruz" wrote:
"hsc - news dot com" is listed at ws and multi.surbl.
This a very serious french security consulting group. Surely a false positive.
According to the whois data hsc-news.com was only registered on 10-aug-2004. I can see how seeing such a new domain used with a mailing list would raise red flags with some people.
Nevertheless this FP illustrates the need for hand checking of domains.
Joe
Indeed, when I hand-checked the domain I found it uses nameservers in hsc-labs.com and had registration contacts with address in hsc.fr. Those other domains are reasonably certainly associated with the same organization, and their registration addresses are similar, etc. While hsc-news.com is relatively new, the other domains are several years old.
Given the short lives of most spam domains and the increasing likelyhood that major spammer domains would tend to get noticed and shut down over time, the older a domain registration is, the less generally likely it's spammy.
Jeff C.