RE: [gnso-ff-pdp-may08] I believe I've figured out a solution to the FF problem

["Greg Aaron" <gaaron@xxxxxxxxxxxx>]

Efforts appreciated.  But it would be helpful if you can confirm whether FF
is even involved in these domains. 


-----Original Message-----
From: owner-gnso-ff-pdp-may08@xxxxxxxxx
[mailto:owner-gnso-ff-pdp-may08@xxxxxxxxx] On Behalf Of Marc Perkel
Sent: Wednesday, September 17, 2008 8:18 AM
To: gnso-ff-pdp-may08@xxxxxxxxx
Subject: [gnso-ff-pdp-may08] I believe I've figured out a solution to the FF
problem


I'm managed indirectly to get a hold of (indirectly) the ZONE data for 
several TLDs. Actually what I'm getting is a list of new zones added and 
compiled in a way that the listings are domains under 5 days old. I'm 
using this list to hunt for links within bot net spam that point to 
these new domains. I'm now generating lists of domains that are 
definitely used for spam and probably pointing to FF used for fraud. But 
I don't yet have the information I need to detect FF.

Even with what little data I have this is working. And it would have 0 
impact on free speech. (Unless the free speech were being advertised 
using botnet spam). I'm going to write a detailed explanation of how to 
do it. This will be the link.

http://wiki.junkemailfilter.com/index.php/Fast_Flux

There's nothing there yet. But I'd appreciate it if this link could be 
included in the report and labeled as an opinion of one of the group 
members for further exploration.

Thoughts?