[SURBL-Discuss] fp hsc news dot com

Jeff Chan jeffc at surbl.org
Mon Sep 6 16:55:25 CEST 2004


On Monday, September 6, 2004, 7:45:40 AM, Joe Wein wrote:
> "Jose Marcio Martins da Cruz" wrote:
>> "hsc - news dot com" is listed at ws and multi.surbl.
>>
>> This a very serious french security consulting group. Surely
>> a false positive.

> According to the whois data hsc-news.com was only registered on 10-aug-2004.
> I can see how seeing such a new domain used with a mailing list would raise
> red flags with some people.

> Nevertheless this FP illustrates the need for hand checking of domains.

> Joe

Indeed, when I hand-checked the domain I found it uses
nameservers in hsc-labs.com and had registration contacts
with address in hsc.fr.  Those other domains  are reasonably
certainly associated with the same organization, and their
registration addresses are similar, etc.  While hsc-news.com
is relatively new, the other domains are several years old.

Given the short lives of most spam domains and the increasing
likelyhood that major spammer domains would tend to get noticed
and shut down over time, the older a domain registration is,
the less generally likely it's spammy.

Jeff C.



More information about the Discuss mailing list