[SURBL-Discuss] unique IPs in the blacklist

Jeff Chan jeffc at surbl.org
Mon Apr 26 02:52:16 CEST 2004


On Monday, April 26, 2004, 1:27:28 AM, Robert Brooks wrote:
> how many unique IPs are there in the spamcop blacklist?

> has anyone considered creating a blacklist of the IP addresses of the hosts in 
> the url blacklist?

> I'm guessing that the spammers are stuffing their sites on a relatively small 
> number of webhosts.

Hi Rob,
Yes indeed, there are quite a few repeated IPs or /24s amongst
the resolved URI hosts.  (Though there are not quite as many
as one might imagine; for the resolved IPs from Bill Stearns'
list, see: http://www.stearns.org/sa-blacklist/spamip.current.txt .)
We will be using IP addresses (probably /24s) to prejudice
incoming domain reports in the next version of the sc.surbl.org
data engine.  This prejudice means that if a new domain resolves
to an IP block that has had a lot of previous reports, the new
domain will probably get on the list with its very first report.
But I don't envision us offering a number-based RBL.

Names are useful for a number of reasons, probably primary of
which is the lack of need to do name resolution on incoming
message URI domains, which can cause a very significant network
resource/time saving, especially on high volume mail servers.
Another major problem is that spammers could add a lot of
other domains to a message and flood those domains' name servers
with requests.  Turning the names into numbers would also
conflict with some of our other principles and assumptions,
some of which are outlined on the web site.

Cheers,

Jeff C.



More information about the Discuss mailing list