...

when browsing unsubscribe links like http://www.signoffcorp.biz/uns.htm to enter a spamtrap address I just noticed that quite a few of the pages look extremely similar, DNS lookups show:

$ host www.signoffcorp.biz www.signoffcorp.biz has address 217.107.217.8 $ host www.bestcds.biz www.bestcds.biz has address 217.107.217.8 $ host www.wonder-pills.com www.wonder-pills.com has address 217.107.217.8 $ host www.multimed.ws www.multimed.ws has address 217.107.217.8

$ host 217.107.217.8 8.217.107.217.in-addr.arpa is an alias for 8.0/27.217.107.217.in-addr.arpa. 8.0/27.217.107.217.in-addr.arpa domain name pointer webrider.ru. $ host webrider.ru webrider.ru has address 217.107.216.26

so i wonder if it is possible (or already done) to also list (and save) the IPs of URIBL listed domains and check newly queried, yet unlisted domains against those IPs.

any comments?

regards,

wolfgang _______________________________________________ Discuss mailing list Discuss@lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

All multitrade group - look at multitrade-corp. {biz,com}. Also, you can lookup all those domains at rfc-ignorant.org for more comments.

BTW. You suggestion is the fundamental difference between IP based BLs and RHS BLs - That is why there is a place in the world for both.

Paul Shupak track@plectere.com

P.S. There are a least a few hundred domains at those IPs - I think there's a partial list on one Spamhaus page (don't have the SBL at hand).