[SURBL-Discuss] Re: registrar boundary inconsistencies

[List Mail User]

>From discuss-bounces at lists.surbl.org Thu May  5 11:47:09 2005
>To: John Gardiner Myers <jgmyers at proofpoint.com>
>In-Reply-To: <427A6488.8020603 at proofpoint.com> 
>From: jm at jmason.org (Justin Mason)
>...
>Cc: Chris Santerre <csanterre at MerchantsOverseas.com>, quinlan at pathname.com,
>        dev at spamassassin.apache.org, discuss at lists.surbl.org
>Subject: [SURBL-Discuss] Re: registrar boundary inconsistencies
>...
>
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>
>John Gardiner Myers writes:
>> Daniel Quinlan wrote:
>> 
>> > We can't just add them willy-nilly.
>> 
>> Why not?  Treat them like .us -- do two queries.
>
>we don't currently do that.  but that may be a good option, actually!
>allow url_to_domain to return >1 datum, and query all of them.
>
>In the case of .us, and these private registrars, return 2
>domains, "foo.eu.org" and "eu.org", or "foo.state.us" and
>"bar.foo.state.us".
>
>- --j.
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.2.5 (GNU/Linux)
>Comment: Exmh CVS
>
>iD4DBQFCemjHMJF5cimLx9ARAsWsAJ91vAjk0Mn7J7M+TbFUKxn3b1bDOwCWKbuw
>b/NvALdeCXRn600SsZ4trw==
>=6YpK
>-----END PGP SIGNATURE-----
>
>_______________________________________________
>Discuss mailing list
>Discuss at lists.surbl.org
>http://lists.surbl.org/mailman/listinfo/discuss
>

	Anybody look at bloomington.in. us recently?  Care to guess who
registered it.  (Hint: It seem only to be used to get SpamCop reports for
certain IP ranges in China.)

	Paul Shupak
	track at plectere.com

P.S.  Unfortunately the sets of spammers and registrars are not disjoint
(and the set of large scale spammers seems almost to be a subset of the
set of registrar resellers).