Wow.. We're blocking several class "A" spaces.. Hmmm.. Even at the border router.. But then again none of our corporations currently do business with china, japan, korea, malaysia, russia, taiwan, etc. One would think it would easier to white list a few class "C" spaces for them when the time comes.
~Rick > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Jason > Sent: Tuesday, December 30, 2003 12:15 PM > To: [EMAIL PROTECTED] > Subject: RE: [IMail Forum] Blocking spam > > > I would be angry also, but the question then becomes: Who > should I be angry with?. > > The theory here is that if you have a spammer hitting you > from a class C and the offending addresses span the class C > as this one did (.250, .9), then should I be mad at the mail > admins that are sick and tired of scanning provider subnets > for spammers, or should I be mad at the subscriber network > that does almost nothing to stop the epidemic of spam? > > You decide. > > > Jason > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Bud Durland > Sent: Tuesday, December 30, 2003 11:56 AM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] Blocking spam > > > Len Conrad wrote: > > > > >>> Dec 30 00:27:57 mx1 postfix/smtpd[48553]: ECF3C2A833: > reject: RCPT > >>> from mk250.one-2.net[207.218.67.250]: 554 Service unavailable; > >>> Client host [207.218.67.250] blocked using > bl.spamcop.net; Blocked - > > >>> see http://www.spamcop.net/bl.shtml?207.218.67.250; > >>> from=<[EMAIL PROTECTED]> to=<xxx> > >>> proto=SMTP helo=<mk250.one-2.net> > >> > >> > >> That's interesting, yes, but I'm not aware of any way that you can > >> take the IP of 207.218.67.9 (the IP the E-mail came from) and > >> automatically look up the IP 207.218.67.250 (which isn't the IP > >> address the E-mail came from). :) > > > > > > You have to know where and how to look. I searched the > maillog file > > for "207\.218\.67" and go three different IPs. > > > > I rarely search for a single IP, always the Class C, so I can block > > the entire Class C. > > > But you do that only after confirming the entire class C > belongs to the > same organization, right? > > We have a small subset of a class C (.240-.255) I'd be grumpy if my > e-mail got thrown away because a mail admin once upon a time > got spammed > > by a different sub-set of the same class C, and decided that everyone > there must be a bad guy.. > > -- ___________________________________________________________________ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
