Reputation based blocking
Reputation based blocking should be created, you have the data to do it.
Use investigate to look up hrldedington@rocketmail.com
That email has 82 domains, 7 marked as malware the remainder no classification
A quick look at the domain names, they look to be DGA.
I personally go in an block all of the domains from jokers like this, but what a hassle and so many that I don't know about to proactively block.
A simple algorithm could classify this as a reputation block category thereby proactively blocking future malware/botnet sites you know will go active down the road.
-
"That email has 82 domains"
How do you calculate this?
nslookup -type=mx rocketmail.com.
Server: home.prv
Address: 10.165.111.43
Non-authoritative answer:
rocketmail.com MX preference = 10, mail exchanger = mta6.am0.yahoodns.net
rocketmail.com MX preference = 10, mail exchanger = mta7.am0.yahoodns.net
rocketmail.com MX preference = 10, mail exchanger = mta5.am0.yahoodns.net
mta6.am0.yahoodns.net internet address = 66.196.118.35
mta6.am0.yahoodns.net internet address = 98.136.217.202
mta6.am0.yahoodns.net internet address = 98.138.112.34
mta6.am0.yahoodns.net internet address = 66.196.118.36
mta6.am0.yahoodns.net internet address = 98.138.112.35
mta6.am0.yahoodns.net internet address = 63.250.192.45
mta6.am0.yahoodns.net internet address = 98.138.112.37
mta6.am0.yahoodns.net internet address = 98.136.217.203
mta7.am0.yahoodns.net internet address = 98.136.217.203
mta7.am0.yahoodns.net internet address = 66.196.118.35
mta7.am0.yahoodns.net internet address = 63.250.192.46
mta7.am0.yahoodns.net internet address = 66.196.118.37
mta7.am0.yahoodns.net internet address = 98.138.112.37
mta7.am0.yahoodns.net internet address = 66.196.118.34
mta7.am0.yahoodns.net internet address = 98.138.112.35
mta7.am0.yahoodns.net internet address = 63.250.192.45
mta5.am0.yahoodns.net internet address = 98.136.217.202
mta5.am0.yahoodns.net internet address = 66.196.118.34
mta5.am0.yahoodns.net internet address = 98.136.217.203
mta5.am0.yahoodns.net internet address = 98.136.216.25
mta5.am0.yahoodns.net internet address = 66.196.118.37
mta5.am0.yahoodns.net internet address = 66.196.118.240
mta5.am0.yahoodns.net internet address = 98.138.112.32
mta5.am0.yahoodns.net internet address = 98.138.112.37This seems to be Yahoo's mail service.
-
You missed the line where I said use investigate with OpenDNS, see the domains registered with that email address.
-
True, my thought context was enterprise OpenDNS where you have investigate and personal accounts do not. This is a huge miss for OpenDNS to not incorporate reputation based blocking, much like email reputation based blocking has done for spam. Why would I allow my company to visit a site registered to an email with a significant number of domains categorized as malware or botnet, I wouldn't if I could stop it.
-
When you register a domain, you setup admin and technical contact email addresses. Because OpenDNS has registration data it pulls from registrars, using investigate you are able to look up an email address and see what domains are registered to that email. There are 82 domains where that email is used as the admin contact. You can get similar data from some free reverse domain lookup sites, but generally you need a paid account at whois.sc or enterprise OpenDNS to have access to that kind of intel.
Please sign in to leave a comment.
Comments
9 comments