On Thursday, June 22, 2006, 3:21:36 PM, Ken A wrote:
> Jeff Chan wrote:
>> On Thursday, June 22, 2006, 10:35:10 AM, Ken A wrote:
>>> Rick Wesson over at Alice's Registry has a dnsrbl listing recently
>>> registered domains (see below). I thought this might be of interest to
>>> SA users. Anyone used this, or other rbl with similar functions?
>>> Scoring?
>>> Accuracy?
>>
>>> Thanks,
>>> Ken A
>>> Pacific.Net
>>
>> Hi Ken,
>> I was corresponding with Rick about how to test this and was
>> going to suggest the developers add a test rule.
> # test for Day Old Bread DNSRBL of recently registered domains.
> header FROM_IN_DOB
> eval:check_rbl_envfrom('dob','dob.sibl.support-intelligence.net.')
> describe FROM_IN_DOB Domain recently registered
> tflags FROM_IN_DOB net
> score FROM_IN_DOB 0.1
> This has hit a few spams today. ymmv..
> Ken A
> Pacific.Net
Hi Ken,
It's probably much more useful to use this list to check message
body URIs than envelope froms. Envelope froms sometimes use
spammy domains, but URIs usually (must) advertise spammer's
sites. IOW envelope froms can be arbitrarily anything, but URIs
must be real; they must go to some site for the spam to be useful.
Jeff C.
--
Jeff Chan
mailto:[EMAIL PROTECTED]
http://www.surbl.org/
