SpamAssassin Rule: WHOIS_DMNBYPROXY
Standard description: Contains URL registered to Domains by Proxy
Domain names are extracted from any URL found the body of the mail and looked up, via DNS, using bl.open-whois.org. This lists domains that have been registered through services that allow private, or anonymous, registrations.
If the lookup returns 127.0.0.15 this means it was registered using Domains by Proxy.
The default scores for this rule can be found in the online list of tests. This rule uses the URIDNSBL plugin.