At 08:11 14-12-2008, Dave Pooser wrote:
<%word%><%otherword%>.com format and both are in the same /24. So I started
checking PTR records for the whole /24 and I'm seeing snowshoe farms like
this (mildly borked to not hit URI lists):
3.193.111.66.in-addr.arpaname = dancethree[dot]com.
Veri
As I sat manually sorting through my spambucket and submitting URIs to
URIBL, I noticed a trend: the (DKIM-signed) "from" domain is often different
from the payload URI domain, but both are in the same
<%word%><%otherword%>.com format and both are in the same /24. So I started
checking PTR records
