In an older episode (Saturday, 5. November 2005 01:23), [EMAIL PROTECTED] wrote: > wolfgang wrote: > > after a wave of spam mails two days ago, today there was a new wave > > advertising a different URI that resolves to the same IP. > > > > is there a built in possibility in SA (3.0.4) ro resolve a URI's > > domain to an IP and match that against a known IP, lets say 1.2.3.4 > > and thus score any hostname/domain that resolves to that IP? > > A URI black list by IP address, with name resolution?
Nope, my idea is something like a local rule/plugin(?) that resolves an URI's host/domain to an IP and afterwards checks for a known hand-picked IP also included in the local rule. And I am wondering if/how that might be possible. > It sounds to me like the potential for false positives on such a thing would > be very high. Agreed. cheers, wolfgang
