On 11/11/2014 12:23, Igor Chudov wrote:
> I am receiving a torrent of spam coming from dot-eu and dot-link
> domains.
>
> Those spams have perfectly correct mail settings, such as resolvable
> nameserver names, SPF, seem to all match.
>
> They also are all based on domains less than one day old.
urirhssub SEM_FRESH fresh.spameatingmonkey.net. A 2
body SEM_FRESH eval:check_uridnsbl('SEM_FRESH')
describe SEM_FRESH Contains a domain registered less than 5 days ago
tflags SEM_FRESH net
score SEM_FRESH 2.5
