Re: Detecting short-TTL domains?

2007-08-10 Thread clsgis
Jim Maul wrote: > > Stream Service || Mark Scholten wrote: >> For so far I know it isn't possible to have a TTL that is to low (if I >> may believe the RFC files). It is also impossible to have [too] many >> A-records. With both facts in mind I would suggest that you find an >> other method o

Detecting short-TTL domains?

2007-08-10 Thread clsgis
We're seeing URIs in spam whose domains have between a dozen and three dozen Address records, with time-to-live TTLs less than ten minutes. Is there a test for too many Address records? What's its name? Is there a test for too-short TTLs? -- View this message in context: http://www.nabble.com/

rule for empty text + GIF or PDF ?

2007-08-08 Thread clsgis
I'm seeing a huge spam run from well distributed bots. Multi part MIME messages with an empty (three blank lines) text/plain part, *no* text/html part, and an attachment in GIF or PDF format. I want to give those a really high score. False positives when there is no text in the message are acce