3

I have a spambot that likes to spam my websites. I mailed to abuse@isp, but he ignored me.

Attacks always come from the same ip, and i used IISIP to add the spammer IP to all of my websites.

I am wondering, since i am using a linux box with shorewall as a firewall... maybe is better to filter at that level?

Which one has better performance with a list that might grow and become huge? IIS giving a 403 page to the spammers, or shorewall dropping the connections?

1
  • Ignoring mails that come to abuse@isp is plain rude. People send mail to abuse@ as last resort, because they need help, not because they want to screw up somebody's weekend. If that wouldn't affect my business, I'd go mad and block the whole ISP at the firewall level.
    – Anonymous
    Jan 26, 2010 at 17:16

3 Answers 3

13

If you are getting a lot of traffic from these spambots, then you are best to drop them at the firewall. Dropping at IIS means putting extra load on your web server (even if it is just serving 403 pages) and if it gets heavy then it could affect the performance for real users of your sites.

I'm not intimately familiar with Shorewall but I would also expect it is probably more efficient at this filtering than IIS will be.

1
  • Agreed with dropping them at the firewall. If the IP is hosting a spambot, there is a good chance they are being controlled in a large botnet and are compromised machines. You don't want them touching your hosts at all. Right now it is just spam but it could grow to include exploits or DDOS attacks. Jan 26, 2010 at 14:22
5

Shorewall dropping is the best I guess. If you can get the IP addresses of these spammers you can dynamically block them with the command "shorewall drop/reject ipaddress'. You may even write a script which can do this in real time.

5

I agree with Sam. It's best to stop them at the perimiter of your network (at the firewall). Think of it like your office building or your home. Do you want to let the rogue into your office and hope that you've got everything inside secured and hope that you haven't forgotten or missed something or would you rather stop them at the door so that they can't get in at all?

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .