[SURBL-Discuss] second and third level domains - again!

Jeff Chan jeffc at surbl.org
Mon Apr 26 04:03:44 CEST 2004


On Sunday, April 25, 2004, 10:50:08 AM, Eric Kolve wrote:
> RBL Hit - wildcard 3rd level
> URL: http://www.foo.co.uk
> DNS Query: www.foo.co.uk
> Server Record: *.foo.co.uk
> Result: 127.0.0.2

I'd rather catch all of foo.co.uk. If they were a real
spammer domain we should hose them entirely.

> RBL Hit - 3rd level
> URL: http://ads.msn.com
> DNS Query: ads.msn.com
> Server Record: ads.msn.com  # note 3rd level
> Result: 127.0.0.2

Possible, but very unlikely case.  Legitimate domains generally
aren't going to have large, abusive subdomains.  Redirection
sites can't really be listed for some of the reasons mentioned
in the previous message.  However purely spam redirection
sites could be listed.

> RBL Hit 2nd level wildcard
> URL: http://bad.viagra.spammer.biz
> DNS Query: viagra.spammer.biz
> Server Record: *.spammer.biz
> Result: 127.0.0.2

I'd rather hit all of spammer.biz .

In my simplistic view of the world, wildcards don't buy us much.
A base domain is either legitimate or it isn't.

Jeff C.



More information about the Discuss mailing list