[SURBL-Discuss] RE: Image Composition Analysis

John Hardin johnh at aproposretail.com
Thu Dec 2 00:25:42 CET 2004


On Wed, 2004-12-01 at 14:35, Chris Santerre wrote:
> We are seeing an increase in throw away domains being used to reroute
> to other domains that will NEVER show up directly in a spam. All in
> attempts to get passed SURBL.

I'm going to bring up this idea again, in a slightly different context
this time:

Perhaps it would be useful to have a SURBL list that is automatically
generated daily from the registrars' notifications of domains that have
been recently created. This information is available for free download -
I'm pretty sure I posted the location here a while ago.

The definition of "recently" might require some testing to set properly,
perhaps a starting point would be one week.

Granted this SURBL would be more subject to FPs than a hand-maintained
list, so it should have a correspondingly lower default score. And it
wouldn't help too much if spammers don't start using their throwaway
domains immediately after registering them.

--
John Hardin
Internal Systems Administrator (Seattle)
CRS Retail Systems, Inc.
3400 188th Street SW, Suite 185
Lynnwood, WA 98037
voice: (425) 672-1304
  fax: (425) 672-0192
email: jhardin at crsretail.com
  web: http://www.crsretail.com
-----------------------------------------------------------------------
 If you smash a computer to bits with a mallet, that appears to count
 as encryption in the state of Nevada.
                                               - CRYPTO-GRAM 12/2001
-----------------------------------------------------------------------



More information about the Discuss mailing list