One thing I check first when a suspicious link lands in my inbox is domain age. Phishing and scam sites are almost always registered days or weeks before the campaign starts, so if a domain claiming to be your bank or a big brand was registered last month, that’s a strong signal something’s off.
Reminded me of Daniel’s Postfix spam auto-block setup; he’s inspecting parked domains to auto-block spam senders, which is basically the same principle: domain metadata as a trust signal, not just content filtering. Smart approach.
I put together a small bash script that does a similar lookup from the terminal using the WhoisFreaks API:
It returns the registration date and registrar in a couple seconds, no browser or WHOIS website needed. Handy for quick triage before deciding whether to dig further or just block the domain outright.
Also relevant: the Google Domains migration thread; a lot of registrars show up in that discussion, and registrar reputation is actually part of what I check too. Some registrars are magnets for throwaway phishing domains, so knowing who’s hosting a suspicious domain adds another data point.
Curious what other quick checks people here run before clicking or investigating a suspicious link. Do you automate any of this, or do you do it manually per case?
Hi Furqan. That’s a nice script; I think I should probably switch to using yours!
My anti-spam protection has been so good, I hardly ever get any spam attempts anymore. I used to get 100-200 a day, but then the FBI shut down the botnets, and that went to about a dozen a day. It has trickled off and now I get a few a week.
I get lots of relay attempts, but I no longer receive many actual spam attempts targeting my personal addresses. I almost think it’s sad that the spammers gave up, but maybe all those 550s finally got to them.
Glad it’s useful, though honestly your setup sounds like it’s already doing the harder part. Catching parked domains from postfix logs and auto-updating blocked senders is a much tighter loop than what I’m doing, mine’s really just manual triage when something looks off, not a full pipeline like yours.
That drop from 100-200/day down to a few a week is a wild before/after. Good reminder that a lot of this stuff really is infrastructure-level (botnet takedowns, upstream blocklists) rather than anything we’re doing locally. Though I’d guess the volume that does get through now is probably more targeted/deliberate rather than spray-and-pray, which is almost a different problem to filter for.
Do you still keep the domain-parking check running even now that volume’s dropped, or has it mostly gone dormant since there’s less to catch?
Hi Furqan. Yes, the domain-parking cron job still runs every 5 minutes… it just doesn’t do much lately.
I’m thinking of undoing the parked-domain check and just letting all email in now that the quantity is so low. Especially since yesterday I accidentally marked a legitimate domain as spam, and they received a 550 as a result. I had bought some tickets to an escape room, and while the actual codes came through, some other email bounced. Not sure why.
Practically all of the emails my server sees now are relay checks, so I really should just disable the parked-domain check, and update my blocked_senders manually again. When I was getting dozens or hundreds of spams a day, the parked domain check was very useful, but now that the volume is so low the risk of human failure (my failure!) is higher.
