I did the same thing back when I was running an all Microsoft setup. Banning connections from APNIC and other foreign addresses took a major load off the SMTP server at the time. Now with Imail doing its job right, I've been slowly un-blocking those select Class-A's one by one. Normally if I find us getting a massive amount of spam not coming from a public provider (like cable, dsl, or even dialup) I'll first try to contact the owner of the range. If they (like most) sit on their duffs and don't do anything, I just ban their portion of the IP range, be it a full class C, or a subnet thereof.
While we're on the topic, who's the worst when it comes to investgating and eliminating spammers in their networks? In my experience AT&T Worldnet has me wondering if there is even a human being in their IT department... We'd get THOUSANDS of spam from their users and I'd never get a response back. Sam -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Klinge Sent: Tuesday, December 30, 2003 1:29 PM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Blocking spam Wow.. We're blocking several class "A" spaces.. Hmmm.. Even at the border router.. But then again none of our corporations currently do business with china, japan, korea, malaysia, russia, taiwan, etc. One would think it would easier to white list a few class "C" spaces for them when the time comes. ~Rick > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Jason > Sent: Tuesday, December 30, 2003 12:15 PM > To: [EMAIL PROTECTED] > Subject: RE: [IMail Forum] Blocking spam > > > I would be angry also, but the question then becomes: Who > should I be angry with?. > > The theory here is that if you have a spammer hitting you > from a class C and the offending addresses span the class C > as this one did (.250, .9), then should I be mad at the mail > admins that are sick and tired of scanning provider subnets > for spammers, or should I be mad at the subscriber network > that does almost nothing to stop the epidemic of spam? > > You decide. > > > Jason > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Bud Durland > Sent: Tuesday, December 30, 2003 11:56 AM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] Blocking spam > > > Len Conrad wrote: > > > > >>> Dec 30 00:27:57 mx1 postfix/smtpd[48553]: ECF3C2A833: > reject: RCPT > >>> from mk250.one-2.net[207.218.67.250]: 554 Service unavailable; > >>> Client host [207.218.67.250] blocked using > bl.spamcop.net; Blocked - > > >>> see http://www.spamcop.net/bl.shtml?207.218.67.250; > >>> from=<[EMAIL PROTECTED]> to=<xxx> > >>> proto=SMTP helo=<mk250.one-2.net> > >> > >> > >> That's interesting, yes, but I'm not aware of any way that you can > >> take the IP of 207.218.67.9 (the IP the E-mail came from) and > >> automatically look up the IP 207.218.67.250 (which isn't the IP > >> address the E-mail came from). :) > > > > > > You have to know where and how to look. I searched the > maillog file > > for "207\.218\.67" and go three different IPs. > > > > I rarely search for a single IP, always the Class C, so I can block > > the entire Class C. > > > But you do that only after confirming the entire class C > belongs to the > same organization, right? > > We have a small subset of a class C (.240-.255) I'd be grumpy if my > e-mail got thrown away because a mail admin once upon a time > got spammed > > by a different sub-set of the same class C, and decided that everyone > there must be a bad guy.. > > -- ___________________________________________________________________ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
