Re: Trying out a new concept

2008-09-24 Thread Matthias Leisi
Karl Pearson schrieb: > So, what about doing a whois query and 'grep' for the setup date? You Good luck with parsing the myriad of output formats from the different whois services. And good luck going after those that do not publish a setup date (like eg the .de ccTLD). -- Matthias

Re: Trying out a new concept

2008-09-24 Thread Matthias Leisi
Marc Perkel schrieb: > And I don't yet know if it will work. I'm still building the list. I > just wanted to throw the concept out there and see if it sparks > innovation. It might turn out to be a dead end. I don't think if this is really innovative (my own recollection goes back to an experim

Re: Trying out a new concept

2008-09-24 Thread Ken A
Marc Perkel wrote: Blaine Fleming wrote: John Hardin wrote: Why is it so flippin' difficult to get a feed of newly-registered domain names? Because the TLDs hate giving people access to the data and certainly won't provide a feed without a bunch of cash involved. Even worse, all the ccTL

Re: Trying out a new concept

2008-09-24 Thread Paweł Sasin
> I don't know how this will work but I'm building the data now. For > those of you who are familiar with Day old bread lists to detect new > domains, as you know there's a lag time in the data and they often > don't have data from all the registries. So - here's a different > solution. > > What I

Re: Trying out a new concept

2008-09-23 Thread Matt Kettler
Ken A wrote: > Marc Perkel wrote: >> >> >> Ken A wrote: >>> Marc Perkel wrote: I don't know how this will work but I'm building the data now. For those of you who are familiar with Day old bread lists to detect new domains, as you know there's a lag time in the data and they oft

Re: Trying out a new concept

2008-09-23 Thread Ken A
Marc Perkel wrote: Ken A wrote: Marc Perkel wrote: I don't know how this will work but I'm building the data now. For those of you who are familiar with Day old bread lists to detect new domains, as you know there's a lag time in the data and they often don't have data from all the registri

RE: Trying out a new concept

2008-09-23 Thread Jeff Moss
This will actually work. I've been involved in a university experiment doing this for over a year now. Simply put, trying to create a list of new spammer domains is a "count to infinity" problem. Creating a list of old domains is not. Jeff Moss From: Mar

Re: Trying out a new concept

2008-09-22 Thread Duane Hill
On Mon, 22 Sep 2008, Karl Pearson wrote: On Mon, 22 Sep 2008, Marc Perkel wrote: McDonald, Dan wrote: On Mon, 2008-09-22 at 15:44 -0700, Marc Perkel wrote: Ken A wrote: Marc Perkel wrote: I don't know how this will work but I'm building the data now. For those of you who are familiar

Re: Trying out a new concept

2008-09-22 Thread Karl Pearson
On Mon, 22 Sep 2008, Marc Perkel wrote: McDonald, Dan wrote: On Mon, 2008-09-22 at 15:44 -0700, Marc Perkel wrote: Ken A wrote: Marc Perkel wrote: I don't know how this will work but I'm building the data now. For those of you who are familiar with Day old bread lists to detect new doma

RE: Trying out a new concept

2008-09-22 Thread McDonald, Dan
: Mon 22-Sep-08 20:45 To: Blaine Fleming Cc: users@spamassassin.apache.org Subject: Re: Trying out a new concept On Mon, 2008-09-22 at 18:26 -0600, Blaine Fleming wrote: > John Hardin wrote: > > > >> This is why I started processing all the TLDs I was able to obtain > >&

Re: Trying out a new concept

2008-09-22 Thread John Hardin
On Mon, 2008-09-22 at 18:26 -0600, Blaine Fleming wrote: > John Hardin wrote: > > > >> This is why I started processing all the TLDs I was able to obtain > >> access to. There is lag but the most it could be is about 24 hours > >> and that assumes they register a new domain immediately after the

Re: Trying out a new concept

2008-09-22 Thread John Hardin
On Mon, 2008-09-22 at 17:13 -0700, Marc Perkel wrote: > Where I'm getting hits is on spam bots that link to these new domains. > Spambots are easy to detect because they never use the QUIT command to > clost the connection. So if a spambot message links to an "unfamliar" > domain (a domain NOT

Re: Trying out a new concept

2008-09-22 Thread Blaine Fleming
John Hardin wrote: This is why I started processing all the TLDs I was able to obtain access to. There is lag but the most it could be is about 24 hours and that assumes they register a new domain immediately after the TLD dumps the zone. Does your data allow mapping domain name to registr

Re: Trying out a new concept

2008-09-22 Thread Rob McEwen
Blaine Fleming wrote: John Hardin wrote: Why is it so flippin' difficult to get a feed of newly-registered domain names? Because the TLDs hate giving people access to the data and certainly won't provide a feed without a bunch of cash involved. Even worse, all the ccTLDs pretty much refuse to

Re: Trying out a new concept

2008-09-22 Thread Blaine Fleming
SM wrote: Even if your traffic patterns are different, the hit rates shouldn't be that low. There would be a difference if your MTA uses a DNSBL to reject or if you apply other pre-content filtering techniques. It's not a matter of different traffic patterns as much as a matter of when I d

Re: Trying out a new concept

2008-09-22 Thread John Hardin
On Mon, 22 Sep 2008, Blaine Fleming wrote: John Hardin wrote: Why is it so flippin' difficult to get a feed of newly-registered domain names? Because the TLDs hate giving people access to the data and certainly won't provide a feed without a bunch of cash involved. Even worse, all the cc

Re: Trying out a new concept

2008-09-22 Thread Marc Perkel
Blaine Fleming wrote: John Hardin wrote: Why is it so flippin' difficult to get a feed of newly-registered domain names? Because the TLDs hate giving people access to the data and certainly won't provide a feed without a bunch of cash involved. Even worse, all the ccTLDs pretty much refus

Re: Trying out a new concept

2008-09-22 Thread SM
Hi Blaine, At 17:00 22-09-2008, Blaine Fleming wrote: Honestly, on my system I have less than 0.01% hits against a list of domains registered in the last five days so I've always considered the list a failure. However, several others are reporting excellent hit rates on it. I think it is beca

Re: Trying out a new concept

2008-09-22 Thread Blaine Fleming
John Hardin wrote: Why is it so flippin' difficult to get a feed of newly-registered domain names? Because the TLDs hate giving people access to the data and certainly won't provide a feed without a bunch of cash involved. Even worse, all the ccTLDs pretty much refuse to even talk to you abo

Re: Trying out a new concept

2008-09-22 Thread John Hardin
On Mon, 22 Sep 2008, Curtis LaMasters wrote: Daniel, I think your missing the point, or I'm completely lost but I believe the point of the list is to tag domains with a registration date of a week or less when sending mail to you (prevent spam from newly registered domains). Marc didn't say

Re: Trying out a new concept

2008-09-22 Thread Marc Perkel
McDonald, Dan wrote: On Mon, 2008-09-22 at 15:44 -0700, Marc Perkel wrote: Ken A wrote: Marc Perkel wrote: I don't know how this will work but I'm building the data now. For those of you who are familiar with Day old bread lists to detect new domains, as you know there's a la

Re: Trying out a new concept

2008-09-22 Thread McDonald, Dan
On Mon, 2008-09-22 at 18:17 -0500, Curtis LaMasters wrote: > Daniel, I think your missing the point, or I'm completely lost but I > believe the point of the list is to tag domains with a registration > date of a week or less when sending mail to you (prevent spam from > newly registered domains).

Re: Trying out a new concept

2008-09-22 Thread Curtis LaMasters
Daniel, I think your missing the point, or I'm completely lost but I believe the point of the list is to tag domains with a registration date of a week or less when sending mail to you (prevent spam from newly registered domains). I may be off but that's the way I understand DOB. Curtis LaMaster

Re: Trying out a new concept

2008-09-22 Thread McDonald, Dan
On Mon, 2008-09-22 at 15:44 -0700, Marc Perkel wrote: > > Ken A wrote: > > Marc Perkel wrote: > >> I don't know how this will work but I'm building the data now. For > >> those of you who are familiar with Day old bread lists to detect new > >> domains, as you know there's a lag time in the data

Re: Trying out a new concept

2008-09-22 Thread Marc Perkel
Ken A wrote: Marc Perkel wrote: I don't know how this will work but I'm building the data now. For those of you who are familiar with Day old bread lists to detect new domains, as you know there's a lag time in the data and they often don't have data from all the registries. So - here's a di

Re: Trying out a new concept

2008-09-22 Thread Ken A
Marc Perkel wrote: I don't know how this will work but I'm building the data now. For those of you who are familiar with Day old bread lists to detect new domains, as you know there's a lag time in the data and they often don't have data from all the registries. So - here's a different solution