[SURBL-Discuss] Re: Need help checking FP list from Theo

Jeff Chan jeffc at surbl.org
Wed Sep 8 03:37:57 CEST 2004


On Tuesday, September 7, 2004, 6:16:36 PM, Jeff Chan wrote:
> On Tuesday, September 7, 2004, 5:40:47 PM, Joe Wein wrote:
>> Chris Santerre wrote:
>>> Domain List matching contacts_email of hostmaster at 1and1.com
>>>
>>>     * 1: 1-asian-sex.com
>>>     * 2: 1and1.com
>> ...
>>>     * 48: uptimesoftware.com
>>>     * 49: wonderfulldeals.com

>> I think you're missing the point, Chris. The domain 1and1.com is unlikely to
>> be listed in spam, let alone *only* listed in spam. Furthermore, of the
>> domains you list I had a hard time finding one that was both active and
>> SURBL-listed.

> I hope Chris was showing us some other domains with similar
> registration information.  That said, *registrar* information
> isn't to useful except in the case of mostly blackhat registrars.

I should add, this kind of data is only useful in proving a
blackhat registrar if we also know how many other domains
they have registered.

If a registrar has 100 spam domains but 100,000 legitimate
ones they're probably not a blackhat registrar.  If another
registrar has 100 spam domains but 20 legitimate ones, they're
likely a blackhat.  Domains belonging to the second registrar
could be "scored" as more likely spammy by some yet to be
written (or revealed) software.  However that only works if
you can see the other 100,000 and the 20, which normally you
can't. 

In other words not enough information may be visible to
draw reliable conclusions about the badness of a given
registrar.  On the other hand some general information
about the number of domains some large registrar holds is
available at registration statistics sites like:

  http://www.whois.sc/internet-statistics/registrar-stats-2003.html

Jeff C.



More information about the Discuss mailing list