On 03/27/2015 03:44 PM, Amir Caspi wrote:
> On Mar 27, 2015, at 3:34 PM, Richard Doyle <lists...@islandnetworks.com>
> wrote:
>
>> All of these were "From:" domains created today.
> Shouldn't they have been picked up by DOB? Or do I need to manually enable
> some DOB plugin in SA? (If so, please let me know how...) When I ran the
> third spample manually a few hours ago, I still didn't see any DOB hit.
>
> I see there is a URIBL_RHS_DOB... is there a SENDER_DOB rule as well? If
> not, it seems like it would be a good idea to implement one... do I need to
> file a bug for it?
>
> However, it would appear that all of the From: domains are the same as in the
> body URIs, which means URIBL_RHS_DOB should have popped... unless you mean
> that the subdomain (sub.domain.com) was DOB, but the main domain
> (www.domain.com and/or domain.com) were not DOB? Or am I missing something?
DOB misses many new domains. Whois often knows what's new, but using it
to detect spam doesn't scale.
>
> Thanks.
>
> --- Amir
>
>
