[SURBL-Discuss] Re: multi.surbl.org combined list available for development

Frank Ellermann nobody at xyzzy.claranet.de
Wed Jun 16 12:25:23 CEST 2004


Jeff Chan wrote:

>> I replace sc.surbl.org by multi.surbl.org in my script.

> OK, I should have mentioned that's not the preferred way
> to do things.  :-)

For my purposes (I'm only interested in the listing status,
it's not used for blocking mail) it is, one GetHostByName
is faster than three.

> You *could* make many rules to handle every numeric
> combination of the bits

All I do is something like `rxwhois -a qualitycorner.biz`
resulting in...

| qualitycorner.biz not found at .rfc-ignorant.org or 
| .multi.surbl.org
| whois -h whois.abuse.net qualitycorner.biz
| postmaster at qualitycorner.biz (default, no info)

Hm, not very convincing, this spam was 30 minutes old.
But for an older spamervized site `rxwhois -a eedqmed.com`

| eedqmed.com (6): .multi.surbl.org
| whois -h whois.abuse.net eedqmed.com
| postmaster at eedqmed.com (default, no info)

So that result tells me "unknown at abuse.net and RFCI,
but listed in sc (2) and ws (4)", because multi said 6.

Therefore it could be interesting to attack this site
at abuse@ and postmaster@, hoping for at least 1 bounce.

Then I'd submit the bounce to rfc-ignorant.org with an
info to the Tech-C / Admin-C listed in the whois data
for eedqmed.com

Maybe the latter results again in a bounce, and then I
could report the domain as "whois ignorant" at RFCI and
ICANN's whois data problem report system.

Of course I only do this when I'm very angry, normally
SpamCop is good enough for me (and feeds sc.surbl.org :-)

                       Bye, Frank




More information about the Discuss mailing list