Use ipset, hardly causing any latency using 50k entries.
-----Original Message----- From: Benny Pedersen [mailto:m...@junc.eu] Sent: 03 March 2020 15:39 To: users@spamassassin.apache.org Subject: Re: Question on early detection for relay spam Riccardo Alfieri skrev den 2020-03-03 14:53: # abuse port 21 begin 51.178.0.0/16 as16276 #OVH, FR 80.82.77.0/24 as202425 #INT-NETWORK, SC 104.206.128.0/22 as62904 #EONIX-COMMUNICATIONS-ASBLOCK-62904, US # abuse port 21 end # all ips begin 51.178.78.154 80.82.77.240 104.206.128.54 # all ips end # abuse port 465 begin 51.178.0.0/16 as16276 #OVH, FR 111.118.212.0/22 as394695 #PUBLIC-DOMAIN-REGISTRY, US 164.132.0.0/16 as16276 #OVH, FR 180.96.0.0/11 as4134 #CHINANET-BACKBONE No.31,Jin-rong Street, CN 192.241.224.0/20 as14061 #DIGITALOCEAN-ASN, US # abuse port 465 end # all ips begin 51.178.78.152 111.118.215.98 164.132.183.196 180.114.159.48 192.241.226.237 # all ips end # abuse port 587 begin 45.133.99.0/24 as202984 #TEAM-HOST AS, RU 51.91.0.0/16 as16276 #OVH, FR 78.128.113.0/24 as209160 #MITI2000, BG 82.102.160.0/19 as12400 #PARTNER-AS, IL 192.241.192.0/19 as14061 #DIGITALOCEAN-ASN, US # abuse port 587 end # all ips begin 45.133.99.2 51.91.212.80 78.128.113.92 82.102.173.78 192.241.213.144 # all ips end # abuse port 993 begin 45.136.109.0/24 as49505 #SELECTEL, RU 109.252.0.0/16 as25513 #ASN-MGTS-USPD, RU 109.86.81.0/24 as13188 #TRIOLAN, UA 185.30.176.0/22 as60476 #MYCOM-AS, NL # abuse port 993 end # all ips begin 45.136.109.251 109.252.91.113 109.86.81.177 185.30.177.80 # all ips end i have no custommers there, but its need to try anyway logs is from yesterday only
