On Monday, April 26, 2004, 1:27:28 AM, Robert Brooks wrote:
how many unique IPs are there in the spamcop blacklist?
has anyone considered creating a blacklist of the IP addresses of the hosts in the url blacklist?
I'm guessing that the spammers are stuffing their sites on a relatively small number of webhosts.
Hi Rob, Yes indeed, there are quite a few repeated IPs or /24s amongst the resolved URI hosts. (Though there are not quite as many as one might imagine; for the resolved IPs from Bill Stearns' list, see: http://www.stearns.org/sa-blacklist/spamip.current.txt .) We will be using IP addresses (probably /24s) to prejudice incoming domain reports in the next version of the sc.surbl.org data engine. This prejudice means that if a new domain resolves to an IP block that has had a lot of previous reports, the new domain will probably get on the list with its very first report. But I don't envision us offering a number-based RBL.
Names are useful for a number of reasons, probably primary of which is the lack of need to do name resolution on incoming message URI domains, which can cause a very significant network resource/time saving, especially on high volume mail servers. Another major problem is that spammers could add a lot of other domains to a message and flood those domains' name servers with requests. Turning the names into numbers would also conflict with some of our other principles and assumptions, some of which are outlined on the web site.
Cheers,
Jeff C.