Re: [Bug 5777] include 'util_rb_2tld googlepages.com' in default config

[Jeff Chan <je...@surbl.org>]

Quoting Yet Another Ninja <sa...@alexb.ch>:

> so the googlepages subdomain used in one spam run, for max 15 minutes
> is cached differently than blahasdasdasd.info created by some obscure
> script and hosted on some domaincontrol.com NS and also used for one
> spam run which lasts for 15 min?$
>
> seems you haven't noticed that the dedicated domain usage has decreased.
> for spammy its way more efficient to use googlepages and redirect to a
> static site which lasts longer and will probably go unnoticed than
> having to setup vhosts every 30 minutes.

Until google figures out how to automate shutting down the accounts,  
then it's back to domains.  Exact same thing happened with  
Yahoo/Geocities.  Feeding google the spammed sites is a more effective  
way to fight this.

>> 2.  Caching of potentially many millions of different subdomains may be
>> ineffective.  There's little reason to re-use the same subdomain in each new
>> spam when it's trivial to set up another subdomain site.  Making   
>> caching less
>> effective is another possible attack against the nameservers.
>
> exactly, so if its .info or a googlepages, the result is the same.

The effect on caching is the same.  However, the number of subdomains  
versus domains isn't the same.  The numbers potentially aren't even  
close (4 orders of magnitude or more different; that's thousands of  
times more).

Jeff C.