spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Dave Funk <dbf...@engineering.uiowa.edu>
Subject Re: .link TLD spammer haven?
Date Mon, 13 Oct 2014 19:53:04 GMT
On Mon, 13 Oct 2014, Philip Prindeville wrote:

> Every connection I’ve gotten from a hostname resolving to *.link or saying helo *.link
has been spam (I block the connections with MIMEDefang).
>
> Has anyone actually seen a legitimate email from a host in the .link TLD?
>
> I’ve seen (last week alone):
>
> bgo.blc-onlineconsumer140.link
> ratio.allgiftcardsonlinefriendly.link
> ratio.autodealersstarted.link
[snip..]

> Is it worth having that triggers on the relay’s hostname being *.link?
>
> Also, I noticed that every message we saw was missing a Received: header…
>
> -Philip

I'll second that and add a similar comment about ".link" URLs inside the
message. Last week I created a uri rule to fire on any ".link" hosted URL
and so far havn't seen a single FP.

-- 
Dave Funk                                  University of Iowa
<dbfunk (at) engineering.uiowa.edu>        College of Engineering
319/335-5751   FAX: 319/384-0549           1256 Seamans Center
Sys_admin/Postmaster/cell_admin            Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Mime
  • Unnamed multipart/mixed (inline, None, 0 bytes)
View raw message