On Tue, 17 Oct 2006, Peter H. Lemieux wrote: > Date: Tue, 17 Oct 2006 16:33:49 -0400 > From: Peter H. Lemieux <[EMAIL PROTECTED]> > To: John D. Hardin <[EMAIL PROTECTED]> > Cc: "users@spamassassin.apache.org" <users@spamassassin.apache.org> > Subject: Re: New ebay phish > > John D. Hardin wrote: > >> The Obtuse daemon also has a function that can reject mail > >> according to the domain of the sending server's DNS host. That > >> works well with some spamming operations that have dozens of bogus > >> domains all pointing at a common DNS host. > > > > Any stats for that? > > I'm not sure I know what kind of stats you're looking for, John.
Primarily % hit rate, but... > Uncovering situations like this requires a bit of detective work. > Sometimes when I get messages from obviously spammy domains like > randomword-anotherrandomword.com, I'll do some checking into their IP and > domain whois records. I might also use nmap to ping-scan their class-C > subnet to see what other hostnames are nearby. Following those domains > back can often uncover a common DNS server. If the DNS server doesn't > have reverse-DNS configured (e.g., dns[12].superduperspecials.com), it's > *really* suspicious. > > My list isn't all that long because this takes a bit of work. I usually > resort to such measures when I get really annoyed by a particular set of > spams. Most of my rules depend on the IP/hostname of the sending server, > not this indirect approach based on DNS servers, but the latter can come > in handy sometimes. ...this is useful, too. I was thinking of perhaps extending my spamfriendly-registrar plugin to do domain DNS checks like this and was wondering if it looked to be worth it. You'd still have to have somebody do the work to identify the spamfriendly DNS domains... It's probably not worth it. -- John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/ [EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- ...the Fates notice those who buy chainsaws... -- www.darwinawards.com ----------------------------------------------------------------------- 14 days until Halloween
