After working through today's spam I was amused we (almost) only received spam for 3 site's:
The following (some old) url's to these sites are still alive: - : sublunary1132nx.com - : ourpillsdirect.com - : naturalwellnessessence.com
Naturally all domains were added to the prolocation rbl and the (low)spam decreased within the hour :). But I was wondering .. a small test with a simple 'diff' script showed me that comparing output from url's found in 'fresh' spam with known spam-sites is doable. These guys seem to be changing domains every 8 hours or so...
Would it be bad to have some of these (stupid) 'static webpage hosting' spammers automaticly being added to the WS list by comparing the output of their home page advertised in the url?
It's fairly easy to create a script to do this ... that's not the issue.... what could go wrong ?.. any input would be appreciated :)
Secondly, while doing these tests I noticed that a lot of the sites listed in (our) WS-list are not longer 'alive'. Is there any clean-up procedure defined yet ?... or will the list just keep on growing ;)
bye, Chris