[xp84]

Honestly, these days, with domains in general being nearly free compared to the profit potential of a single successful spammer grift, I’m not sure I even see the point of blacklisting domains at all. 25 years ago maybe a spammer would be devastated that he had to “start all over and buy a new domain and build up its reputation.” Now, spammers launch and abandon what, a million new domains a day? Google or anyone spitefully holding onto hard feelings about what a domain “did” years ago is pointless because the spammers will move on anyway. They wouldn’t reuse abcqwertuiop26abc dot xyz anyway because it’s safer to make up a new gibberish domain anyway. Only people who acquire domains legitimately are hurt by this.

I would want to experiment judging them based on what they’ve been seen to do in the past month.

[lazide]

The only reason they go to those new domains is because of the blacklist.

If you remove the blacklist, they’d just stop doing that and it would be even easier for them.

[xp84]

I'm imagining/advocating for blacklisting them for say, 12 months, and re-evaluating them at that point. This imposes the identical cost on the spammer as now (each "detection" costs them a year's domain registration) while allowing a reputation "reset" for innocent people who acquire haunted domains.

Yes, the spammers can sit on their domains once blacklisted, renew them, and redeploy their spam on them 12 months later, but they'd have nothing to gain from the reuse, since the names of their domains are just nonsense anyway.

[lazide]

Fair point.

I’m guessing that would complicate blacklist maintenance quite a bit, which is why we aren’t seeing it work that way.

Most of these blacklists (at least initially) were emergency type measures - ‘block these spammers’, then move on with life.

Blacklist maintainers would need to maintain date first seen/date last seen info, and purge/re-add correctly.

Technically, seems like an ‘append only’ type thing is what they’ve been doing for the most part.

As this evolves and the idea that these do need some kind of expiration or we end up with more maintenance headaches becomes more widely known, maybe eh?

Or if there is some kind of legal rules around it.