[SURBL-Discuss] RFC: SURBL inclusion policy

Jeff Chan jeffc at surbl.org
Tue Sep 28 02:15:03 CEST 2004

On Monday, September 27, 2004, 4:51:27 PM, Frank Ellermann wrote:
> Some days ago I got a feedback mail from ICANN's WDPRS, it
> was about a complaint in May.  So attacking domains on the
> "whois data problem" track takes some time, certainly more
> than 90 days.  At the moment Joe's idea "don't add anything
> older than 90 days" probably works, but the spammers will
> as always try to bypass any strict rules.

Actually it's Outblaze that tries to cut off domains at
90 days.  Joe is more flexible, suggesting that domains
older than 90 days can be included if, for example, they
use name servers or hosting addresses in SBL.

Joe's statistics did show a large drop off in spam
domain registrations older 1 year however:

> 50% of all blacklisted domains are registered no more than 35 days before
> listing, 60% within two months, 66% within three months, 70% with four
> months. As you see, the incremental gain per extra month gets smaller and
> smaller. Six months cover 80%, 12 months 90%, 24 months 97%.

So there is a point of diminishing returns in going with
the older domains.  There is also perhaps an increasing
chance of FPs with older domains.

(I didn't graph the above, but the numbers look like a
nice exponential decay....)

Jeff C.
"If it appears in hams, then don't list it."

More information about the Discuss mailing list