Am 22.03.2012 10:40, schrieb Robert Schetterer: > Am 22.03.2012 10:33, schrieb Axb: >> On 03/22/2012 10:19 AM, Per Jessen wrote: >>> Robert Schetterer wrote: >>> >>>> Am 22.03.2012 08:23, schrieb Per Jessen: >>>>> Robert Schetterer wrote: >>>>> >>>>>> Am 21.03.2012 09:09, schrieb Per Jessen: >>>>>>> Has anyone else noticed this stream of new spamvertized domains : >>>>>>> >>>>>>> http://files.jessen.ch/list-of-new-domains >>>>>>> >>>>>>> Typically accompanied by messages/subject lines such as: >>>>>>> >>>>>>> You should check your status update and see if it changed >>>>>>> This method of language learning is super easy. >>>>>>> Please confirm that this update is accurate. >>>>>>> Teach yourself a new foreign language in 10 days >>>>>>> >>>>>>> Just being curious. Yesterday I got another 10 different domains. >>>>>>> >>>>>>> >>>>>> >>>>>> Hi Per, nothing special like that, was noticed here >>>>>> >>>>> >>>>> Thanks Robert - amazing that nobody else seems to have noticed. I've >>>>> added a rule to catch some of them, but yesterday I still got another >>>>> 15 brand-new such domains. >>>> >>>> sorry i dont follow new spam domains, until there is no significant >>>> rise but if grepped your domains yesterday on few servers with no >>>> result >>> >>> I don't normally follow them either, but these are coming through to one >>> of my personal addresses. It's also the rate of change that is >>> interesting - I very rarely see two emails with the same link. >> >> Aren't the URIs being detected by SBL/DBL/SURBL/URIBL ? >> > > domain name related rbls/lists are mostly not making very much sense > also tagging by "new domains" isnt very helpfull > > that all may lead to too much false positives > > but policies like that must be decided by the postmaster > related to his local needs
not tested but this looks as good choice for tagging registrars http://anonwhois.org/usage.html in pers domains Moniker was the matching one http://anonwhois.org/99_anonwhois.cf ... urirhssub ANONWHOIS_11 list.anonwhois.net. A 127.0.0.11 body ANONWHOIS_11 eval:check_uridnsbl('ANONWHOIS_11') describe ANONWHOIS_11 Domain protected by Moniker Privacy Protection tflags ANONWHOIS_11 net score ANONWHOIS_11 0.001 ..... -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria
