blacklisting throwaway domains, was Re: [Asrg] Re: 6 - Yahoo Domain Keys

[Tony Finch <dot at dotat.at>]

Philip Miller <millenix at zemos.net> wrote:
>
>> As far as I can tell spammers have now become domain registries and
>> just generate random-appearing, generated domains like www.fxbrezd.com
>> (or, more often, .info or .somecountryyoudon'twanttoknowmoreabout.)
>
>These types of things could potentially be blacklisted. Has anyone created a 
>functioning BL of domain registrars, rather than domains?

It's easier to blacklist nameservers than registrars -- working out a
domain's name servers is much simpler than getting to grips with whois.
You need the right kind of blacklist for this purpose, because it must
target nameservers that are only used for spam domains. Fortunately
such a blacklist already exists: the SBL. SpamAssassin 3.0 includes
a module that checks the nameservers of any URL in the message against
the SBL, and this has proved to be very effective. The same technique
should work well against the nameservers of domains in email addresses.

Tony.
-- 
f.a.n.finch  <dot at dotat.at>  http://dotat.at/
THE MULL OF GALLOWAY TO MULL OF KINTYRE INCLUDING THE FIRTH OF CLYDE AND THE
NORTH CHANNEL: WEST 3 OR 4 VEERING NORTHWEST 4 OR 5. VARIABLE CLOUD AMOUNTS,
RISK LIGHT SHOWER. MAINLY GOOD. SLIGHT TO MODERATE BECOMING MODERATE.

_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg