A referring domain can be something like "bing.com" which would be a search engine referrer or also "someshadysite.biz" which would be a spammer site.
The Type of each can be used to specify which type of site it is, in order to better analyze incoming traffic to the site.
The Status of each domain can be used to specify whether or not we trust users registering from that domain.
How domains are matched
We are checking 2 domains:
- the referrer of the current session, if available;
- a reverse DNS lookup on the IP address the user when doing an action.
For example if the HTTP Referer is www.abc.def.com and we have just def.com in the table marked as trusted, then www.abc.def.com is also trusted.
If in addition, we have abc.def.com in the table as suspect, then www.abc.def.com is suspect.
If in addition, we have www.abc.def.com in the table as blocked, then www.abc.def.com is blocked.
We use the most precise (longest) matching entry from the referring domains table.
Behavior according to the domain’s status
In order to maximize the antispam control, some actions are controlled according to the status of the referring domain of the user that is performing it.
Blocked status
Several actions will be blocked when a blocked domain is found in the current request domain (reverse DNS of the current request IP) or in the initial referer URL of the current session.
See Blocking actions from spammers.
antispam_block_by_domain()(domain of current IP) and antispam_block_by_initial_referer()(domain of referring URL) through the antispam_block_request() function.