On Sun, 4 Jan 2004, oj wrote:
> Hello,
>
> Recentry i have had problem with spam that consist of html and one image only.
> The image is fetched from different domains each time. The domains have one
> thing in common though. They are all registered by the same registry:
> Whois Server: whois.paycenter.com.cn
> Referral URL: http://www.paycenter.com.cn
> And they are an accreddited ICCAN registry. It seams like the spammers have
> got their own registry. Thus they can come up with new domains all the time at
> low cost. Is there any rules based on registry of domains urls?
>
> Maybe this is a bit far fetched, but i really want this spammer gone.
>
> regards, Ove Jansson
Yet another instance of globalization, spam-haus out-sourcing to China. ;(
I think that if you check the DNS "NS" records for all those spam-domains
registerd thru paycenter.com.cn, you'll find that they all have the
same DNS Naming-Server hosting. (at least all the ones that I've seen so
far do).
It would be much easier to do a NS record lookup within SA than do a
"whois" check. Probably take a custom "eval" rule, but should be do-able.
Dave
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
