[SURBL-Discuss] newly registered domains
csanterre at MerchantsOverseas.com
Mon May 9 16:20:04 CEST 2005
Because they don't take to kindly to anyone doing tons of whois looksups an
hour. Trust me ;)
>From: Matthew Wilson [mailto:matthew at boomer.com]
>Sent: Monday, May 09, 2005 9:44 AM
>To: SURBL Discussion list
>Subject: RE: [SURBL-Discuss] newly registered domains
>Why not integrate a whois date lookup directly into SURBL or URIBL?
>Design an encoding system whereby
>suspectedspammydomain.spammertld.dr.surbl.org (or uribl.com) would
>return the date somehow regex encoded in the IP address. Then write a
>nice SA rule that decodes it, also using regex. Are there any regex
>geniuses out there that could encode a date in an IP address?
>> Well this has been brought up before. It is a very good idea,
>> however difficult to implement. Unfortunetly the date
>> returned by a whois querey comes in a wide variety of
>> flavors. We (SARE) thought we had all of the returned date
>> codes figured out. Nope. New ones still keep coming.
>> uribl.com has some ideas on how to attack this very issue,
>> but not sure it is worth it yet.
>> In short, it would be wonderful to start doing whois lookups
>> for every domain in an email. Lots of things could be flagged
>> off of it. Think of a sort of baysien whois DB. But the
>> traffic would be pretty dam big.
>> Discuss mailing list
>> Discuss at lists.surbl.org
>Discuss mailing list
>Discuss at lists.surbl.org
More information about the Discuss