[SURBL-Discuss] Selectively looking up the IPs to which uri's resolve

Steven Champeon schampeo at hesketh.com
Tue Aug 3 17:25:51 CEST 2004


on Tue, Aug 03, 2004 at 10:06:09PM +0200, Patrik Nilsson wrote:
> At 15:36 2004-08-03 -0400, Steven Champeon wrote:
> >These guys (I've been calling them "Sergey Katchenko", but it appears
> >"Sergey" is a front for yet another spamgang) have been running a joe
> >job against one of my domains for a couple of months now. Want to
> >pre-emptively block all their crud? Run this script:
> >
> >#!/usr/bin/perl
> >
> >my @bits = 
> >("akiana","bertikas","bortsimis","enofakel","enomy","fagony","fenium","fikals","frakles","inacalo","indakitos","kitaros","manics","mipatarios","neynano","nimphos","ownaros","pazda","pikas","pitovshe","poises","polishe","porchma","potkasi","pritkeras","sayara","simptomps","sofikals","tronits","valdisimus","xesros");
> >foreach $front (sort @bits) {
> > foreach $back (sort @bits) {
> >   print "$front$back.org\n";
> > }
> >}
> >
> >Should give you 961 domains, approximately 300 or so of which are
> >registered at the moment, but all of them have fallen into this pattern
> >so far. He's registered 100 more since I first started keeping track
> >last month, and AFAICT they're all on that generated list.
> 
> He seems to have added a few new bits:
> 
> http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&c2coff=1&th=29aec2df5f63eb2d&rnum=1

Hm. OK, I see 'sopinas', 'katanataro', and 'benoka'. Any others I missed?
 
> Anyway - this is why urirhsbl is such a good idea.
> All of those domains use the same SBL-listed name server IP.

Yep, agreed. 

-- 
hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com
Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today!
http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/


More information about the Discuss mailing list