On Sun, 30 Jun 2019, Sean Lynch wrote:
A very large number (nearly all, in fact) of the spams I receive these days
involve domains registered with Namecheap.
I'd like to add a spam score to any message using a domain registered
with them.
Does such functionality already exist in SpamAssassin? Is there an RHSBL or
some other simple mechanism I could use to look up the registrar for a
domain?
There's really no infrastructure for it. Somebody would have to hook into
the registrar data feeds to collect it and publish it in a usable form,
and nobody has done so that I am aware of.
A decade ago I wrote a plugin that used whois to try to do this as an
experiment. The big drawback is: actually doing this could easily be
considered abuse of the whois system and could easily get you blacklisted.
This is *not* recommended for production use.
http://www.impsec.org/~jhardin/antispam/registrar_scoring/
This is just for illustration. I *strongly* discourage using this in
anything other than a limited test environment (assuming it even still
works).
If you had access to the registrar feeds you might be able to write
something that used that data which would not be considered abusive.
Is there anybody in the SA user community who does have access to the raw
registrar feeds?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
If Microsoft made hammers, everyone would whine about how poorly
screws were designed and about how they are hard to hammer in, and
wonder why it takes so long to paint a wall using the hammer.
-----------------------------------------------------------------------
4 days until the 243rd anniversary of the Declaration of Independence
