{"id":122,"date":"2006-12-07T22:21:48","date_gmt":"2006-12-08T06:21:48","guid":{"rendered":"http:\/\/outflux.net\/blog\/archives\/2006\/12\/07\/filtering-email-body-urls-with-whois\/"},"modified":"2006-12-07T22:21:48","modified_gmt":"2006-12-08T06:21:48","slug":"filtering-email-body-urls-with-whois","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2006\/12\/07\/filtering-email-body-urls-with-whois\/","title":{"rendered":"filtering email body URLs with whois"},"content":{"rendered":"

I use SURBL<\/a> filtering for my inbound email. It’s very handy except when my domain receives the leading edge of a new spam campaign. Whenever spam with a URL got through the filters, I’d go look it up<\/a> and discover that it was added to the block lists about 20 minutes after<\/em> I got the email. I’d think to myself, “dang, if only I had greylisted<\/a> that email”.<\/p>\n

Well, I got to thinking: all the URL-based spam campaigns have one thing in common: the domains they’re spamming have been recently registered. So now I greylist any email whose body contains a recently registered domain in a URL. It gets delayed just long enough that the SURBLs catch up, and when it is finally reattempted, it gets permanently rejected. Unfortunately, I have not found a common API for querying the registrars for a domain’s creation date, so I wrote an insane script<\/a> to make a best-effort guess:<\/p>\n

\n$ .\/whois-created kernel.org 2>\/dev\/null
\n‘kernel.org’ created on: 1997-03-07
\n$ .\/whois-created outflux.net 2>\/dev\/null
\n‘outflux.net’ created on: 2000-03-17
\n$ .\/whois-created hosteije.net 2>\/dev\/null
\n‘hosteije.net’ created on: 2006-12-01\n<\/p><\/blockquote>\n

Any URLs with kernel.org or outflux.net I’d let through, but I’d greylist anything mentioning hosteije.net (which is now listed<\/a> on the SURBLs).<\/p>\n

Most of my email filtering is based on some heavily modified MIMEDefang<\/a> code (which handles hooking to my script and doing the greylisting), but I’m figuring this sort of thing should live in some optional routine in SpamAssassin<\/a> so more people can benefit.<\/p>\n

© 2006, Kees Cook<\/a>. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License<\/a>.
\"CC<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"

I use SURBL filtering for my inbound email. It’s very handy except when my domain receives the leading edge of a new spam campaign. Whenever spam with a URL got through the filters, I’d go look it up and discover that it was added to the block lists about 20 minutes after I got the […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,14],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/122"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=122"}],"version-history":[{"count":0,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/122\/revisions"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}