Joe Quinn skrev den 2013-12-19 16:02:
We are noticing a lot of spam coming from domains that are less than
two months old. Is there a good way to detect this automatically?
We've thought about whois, but do not want to get blocked for looking
like we are harvesting information.
maybe make a rule that match any domain, then use uribl_skip_domains to
whitelist the ones that does not spam ?
spammers know there domain will be blacklisted if seen in spam, thats
why thay got new problems each day :=)
but if thay need to get whitelisted for not spamming thay would try to
keep there problem
uribl_skip_domains example.org example.net
uri ANY_DOMAIN /./
describe ANY_DOMAIN domain not skipped
score ANY_DOMAIN 0.1
then uri rule will not hit on example.org and example.net
untested, but i think its the way to solve it
