Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a list of common ip addresses used by domain squatters (the ip addresses of the sites they resolve the domains to)? I have a list of domains and I need to remove most squatted/parked domains from the list, I can do that in a perl script (that currently removes dead domains) but I need the IP addresses the squatted domains resolve to so I can remove them as well. I know there are spam/phishing/malware blacklists available, does anyone know of a squatter blacklist? I can't find one using Google.

EDIT: I am trying to remove dead domains from a list, I can already remove domains that don't resolve but I need to remove squatted domains as well so I need a list of ip addresses squatted domains resolve to so I can remove them.

share|improve this question
    
I'm not following this at all... What is it that you're doing? –  joeqwerty Oct 9 '10 at 13:51
    
I am trying to remove dead domains from a list, I can already remove domains that don't resolve but I need to remove squatted domains as well so I need a list of ip addresses squatted domains resolve to so I can remove them. –  user56629 Oct 9 '10 at 13:53
    
What list is this? –  joeqwerty Oct 9 '10 at 14:05
add comment

1 Answer 1

Remove any email addresses that contain the word spam in them.

It would be trivial to scan your existing list to find parking pages that were roughly the same.

Fetch the url at each of the domains, parse it with an sgml parser, remove the content and just keep the structure, md5 that representation, log it. Run through all of your domains. If you have a lot of domains that have the same md5, you can be reasonably sure they direct to the same place. This of course means that anyone using a domain for email and allowing a company like godaddy to leave their parking page up. While 90% of the parking pages at a particular domain squatter have differing content, the structure of the page is identical. Or, take just the first 500 bytes and analyze for similarity.

You could do the same test for mx servers. See which ones point to the same destination and use that to evaluate whether they are parked. Google's gmail MX may show up quite frequently depending on the list, so, you might want to manually check it.

Otherwise, mail to it and when a company reports it as spam, you have the IP address, timestamp, subscription request and confirmation date that you can send back as evidence that it is a double opt-in list - which is enough to keep you off most reputable blacklists.

Spamcop would be the exception as they tend to subscribe to anything and everything and believe that all email is spam. They do sign up for double-opt in lists and later report them as spam. Spamcop also strikes the email address and message id to hide the address they are using as a spam bucket and get irritated when you send them the date, ip address, email address, etc of the person that subscribed including the valid captcha response. Ironically, when you file your rebuttal along with the email address that subscribed and the information, it disappears from their site very quickly. Their theory is that if they don't tell you their bucket email address, the list becomes worthless to you.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.