Tag Info

Hot answers tagged

41

Here is my list and why I use them: zen.spamhaus.org - Comprehensive RBL, catches a ton of spam sources, updated regularly. They have a long history and decent reputation in the spam filtering community. I have heard some negative things about them from time to time, but those are generally without real merit. Downside is that if your volume of traffic ...


17

MxToolbox has a web-based blacklist check tool that's a good starting point. The Domain Name System Blacklists (DNSBL) and Anti-Abuse Multi-RBL Check are other great free resources for this purpose. DNSstuff also has a subscription based service called RBLalerts that will monitor 130+ blacklists for an IP address you specify and notify you if it has been ...


16

No, there is no "global" list; every company maintains their own classifications. So you will have to contact each one individually.


13

I'd suggest grabbing a sinmple firewall config tool, scuch a Firestarter, and going from there. Here are some basics for you, though. #Flush existing rules iptables -F # Set up default DROP rule for eth0 iptables -P INPUT DROP # Allow existing connections to continue iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT # Accept ...


13

try using iptables and building multi-level tree to decrease number of lookups. iptables -N rules_0_0_0_0_2 iptables -N rules_64_0_0_0_2 iptables -N rules_128_0_0_0_2 iptables -N rules_192_0_0_0_2 iptables -N rules_0_0_0_0_4 iptables -N rules_16_0_0_0_4 iptables -A INPUT -p tcp --dport 80 -s 0.0.0.0/2 -j rules_0_0_0_0_2 iptables -A INPUT -p tcp --dport 80 ...


12

Is this becoming a real problem for your users? I'd recommend a full-on mail filtering service at this point. Bayesian isn't really that hot anymore. Reputation, RBL, header/intent-analysis and other factors seem to help more. Consider a cloud filtering service to combine multiple approaches (and collective volume) to provide better protection (I use ...


10

When we found ourselves categorized incorrectly in several blacklists a few months ago, we had to contact each one individually to appeal. Some useful addresses: https://www.trustedsource.org/ (McAfee) suggest@websense.com (Websense) http://www.fortiguard.com/webfiltering/webfiltering.html (FortiGuard) http://domain.opendns.com (OpenDNS)


10

you can deny access by BrowserMatch and Deny from SetEnvIf Example: SetEnvIfNoCase User-Agent "^Wget" bad_bot SetEnvIfNoCase User-Agent "^EmailSiphon" bad_bot SetEnvIfNoCase User-Agent "^EmailWolf" bad_bot <Directory "/var/www"> Order Allow,Deny Allow from all Deny from env=bad_bot </Directory> To permanenly block them ...


9

You could try using moblock (google it - can't add links yet, new user). Disable all downloaded blocklists, and use only a local blocklist that you generate. You may need to add NFQUEUE (netlink queue) support to your kernel, but it may already be there by default. The general setup is: for all SYN packets on the ports you want to filter, use netfilter's ...


9

If you go to mxtoolbox.com and put in your IP, you can get a blacklist report. Your IP is on two of them: UCEPROTECTL2 UCEPROTECTL3 Click the details next to the BL in question and it will tell you why you are on there and how to remove your self. EDIT: I see that you already know that you are on the UCE Protect... Most mail admins use clearing house ...


8

iptables -I INPUT -s <allowed_ip> -j ACCEPT #(repeat this line as needed) iptables -P INPUT DROP This will turn your system into a non-existent system for non-allowed computers.


8

'zen.spamhaus.org' is pretty good. I recommend it.


8

This is exactly what ipset is for. From its website http://ipset.netfilter.org/: If you want to store multiple IP addresses or port numbers and match against the collection by iptables at one swoop; dynamically update iptables rules against IP addresses or ports without performance penalty; express complex IP address and ports based rulesets with one ...


7

The easiest approach would be to time limit the blacklisting. The first time an IP is put into the DB, set the timeout for 3 days or something. On subequent submissions from that IP: The second time junk comes from an IP set the timeout for 2 weeks. The third time junk comes from that same IP set the timeout for Permanent (0) Or something similar to that, ...


7

I used to trust RBLs directly. Then I wen't to scoring with policyd-weight which is much safer (but not your question). I would only trust these RBLs for direct blocking: zen.spamhaus.org (I think it includes the CBL of Abuseat) ix.dnsbl.manitu.net (iX magazine) dnsrbl.swinog.ch (Swiss network operators group) IMPORTANT: never ever trust anything ...


7

I'm a DNS Ops guy who works closely with a group who is frequently subject to these attacks. Dealing with Snowshoe attacks is primarily a process problem, and as ewwhite points out it may beyond the scope of your company to solve in-house. I'd go as far as to say that unless you have a sizable operation and several commercial RBL feeds, you probably ...


6

There are multiple tools in this space; however, I urge caution using them as many have been found to have exploits that make them worse than not having them. You will also need to decide what service you are protecting. HTTP, SMTP, POP, etc. have different tools. For example, fail2ban: http://www.fail2ban.org/wiki/index.php/Main_Page Can be customized ...


5

You shouldn't be using DNSBL's directly. They cause too many false positives. The goal isn't necessarily to block spam, but to let all the good mail through. If you use a blacklist as an authority on what is spam, you'll have your bosses upset and nobody wants that. Instead, use a composite approach. Tools like Spam Assassin or the various anti spam ...


5

You could use restriction classes. See: http://www.postfix.net/postconf.5.html#smtpd_restriction_classes http://www.postfix.net/RESTRICTION_CLASS_README.html. For example: /etc/postfix/main.cf: smtpd_recipient_restrictions = check_recipient_access hash:/etc/postfix/protected_destinations ... smtpd_restriction_classes = ...


5

The problem is that the mail is sent via the pickup service (via sendmail inteface) and so it is an "outgoing" mail. For outgoing mail the smtpd_*_restrictions don't apply. These restrictions only apply for "incoming" mails that have been sent via SMTP. Edit There is even a solution provided by Victor Duchovni (Postfix maintainer): ...


5

I have not tested this myself, but when I heard your problem description I instantly thought "pf" (as from OpenBSD). pf has the concept of address tables which may just be what you're looking for. According to some very cursory research I did, it would seem that this has the potential to scale better than ipset. According to the PF FAQ's chapter on Runtime ...


5

I often handle support cases because of CBL listings. I have never seen a false positive. If the CBL thinks something behind your IP is infected they're most probably right. Remember that a CBL listing insn't necessarily caused by spam sent over your mailserver. Any type of bot connection using different protocols / ports from an infected laptop to a CBL ...


4

The goal of using a DNS blacklist should not be to stop all spam -- it should be to block a good percentage of the spam, say 1/2 to maybe 2/3 of it. You're mainly doing this to reduce load on your servers. The next step, the truly effective spam removal step, is a bayesian filtering engine. See Paul Grahams original article. They main benefit of bayesian ...


4

AFAIK Deny rules in Apache config and iptables have linear lookup time. Sort of. You can use chains in IPTables to break it up, i.e. a simplistic approach would be to have a chain for each A class block of addresses (e.g. 1.0.0.0/8, 2.0.0.0/8, etc.) and the rules for that block within the chain, reducing the look up time significantly (i.e. worst case ...


4

A great way to manage this would be with your internal DNS server. You can setup DNS BlackHoles. Which you can set to go to 127.0.0.1 or whatever IP address you want. This is a lot more manageable and scalable. You can read up a bit more about it here: http://www.malwaredomains.com/bhdns.html


4

I own Exchange 2003 server and have only been blacklisted once. You must be doing something wrong to get blacklisted so much. I've fixed it by doing following: Using mxtoolbox to check my current server settings to see if IP is not blocked, and if Exchange is configured correctly (denying any sort of open gate). Create SPF record in DNS. Put exchange ...


4

SORB provide this information on their website. I'm surprised you didn't look there first, so perhaps you meant to ask something a bit less obvious?


4

The techniques I use to identify spam have little to do with volume. They are bases more on how well the server complies with standards and best practices. 5,000 is a relatively small mailing list and shouldn't trigger spam classification. Getting your server correctly configured to use its FQDN and having PTR configured so you pass rDNS validation will ...


4

Try visiting their lookup and removal request page: http://dnsbl.invaluement.com/lookup/


4

This is Rob McEwen, CEO of invaluement. First, while ivmSIP/24 has been around for a few years, we're always making improvements/tweaks... and we've made a number of improvements to the removal request system in just the past few weeks, some of which directly impact the suggestions I'm about to provide. (I'll also address Dmitry's comment later this message) ...



Only top voted, non community-wiki answers of a minimum length are eligible