[SURBL-Discuss] RE: Research wanted: age of spam gang URI domains

John_Delisle at ceridian.ca John_Delisle at ceridian.ca
Fri Apr 22 16:27:17 CEST 2005

Even if data re average age of the domains, wouldn't they just start 
registering them earlier so as to not match that pattern?

John Delisle, CISA
Senior Network Analyst, Network and Security Team
Information Systems & Technology Management Dept.
Ceridian Canada Ltd
600 - 125 Garry St
Winnipeg, MB
R3C 3P2

Chris Santerre <csanterre at MerchantsOverseas.com> 
Sent by: discuss-bounces at lists.surbl.org
04/22/2005 08:05 AM
Please respond to
SURBL Discussion list <discuss at lists.surbl.org>

"'Jeff Chan'" <jeffc at surbl.org>, SURBL Discuss <discuss at lists.surbl.org>, 
SpamAssassin Users <users at spamassassin.apache.org>

[SURBL-Discuss] RE: Research wanted: age of spam gang URI domains

>-----Original Message-----
>From: Jeff Chan [mailto:jeffc at surbl.org]
>Sent: Thursday, April 21, 2005 7:46 PM
>To: SURBL Discuss; SpamAssassin Users
>Subject: Research wanted: age of spam gang URI domains
>Does anyone have research or references for the age profiles of
>domains appearing in the URIs of spam gang (i.e. Ralsky, Lindsay,
>Richter, etc.) spams?  In other words, how old are the domains of
>sites being spamvertised *by spam gangs*?  (By age I mean how
>long ago they were (most recently) created.)
>Jeff C.

Off the top of my nogging, I've seen the major guys be about 1-3 days from


I also saw a pattern a few spammers using ones registered 3 months prior.
This is when I began to theorise that there was possibly a spam domain
service. Someone simply registering domain names full time, then selling
them out to other spammers. I started researching the idea, then got busy 
other stuff. 

When things settle I'll try to pick back up on the research. Sorry I don't
have any hard data for you. 

Discuss mailing list
Discuss at lists.surbl.org

More information about the Discuss mailing list