Re: Good source for IP addresses by country

[Peter Matulis]

--- Ken A <[EMAIL PROTECTED]> wrote:

> 
> 
> Jon D. Slater wrote:
> > I know this is a bit off topic, but does anyone know a good source
> that
> > breaks down IP addresses by country?
> > 
> >  
> > 
> > I’ve added a number of IP addresses to my hosts.deny file just from
> > ‘experience’.
> > 
> >  
> > 
> > My server never gets e-mail from countries outside of the US.  So,
> I’m
> > looking for an effective way to block by country.
> 
> header __RCVD_IN_NERDS 
> eval:check_rbl('nerds','zz.countries.nerd.dk.')
> describe __RCVD_IN_NERDS                Received from a spam country
> tflags __RCVD_IN_NERDS                  net
> 
> header RCVD_IN_NERDS_CN 
> eval:check_rbl_sub('nerds','127.0.0.156')
> describe RCVD_IN_NERDS_CN               Received from China
> tflags RCVD_IN_NERDS_CN                 net
> score RCVD_IN_NERDS_CN                  2.5

I tried this but my glue technology (amavisd-new) appears to spit
errors when I run it in SA debug mode:

[7771] info: config: SpamAssassin failed to parse line, no value
provided for "header", skipping: header __RCVD_IN_NERDS
[7771] info: config: failed to parse line, skipping:
eval:check_rbl('nerds','zz.countries.nerd.dk.')
[7771] info: config: SpamAssassin failed to parse line, no value
provided for "header", skipping: header RCVD_IN_NERDS_CN
[7771] info: config: failed to parse line, skipping:
eval:check_rbl_sub('nerds','127.0.0.156')
[7771] info: config: SpamAssassin failed to parse line, no value
provided for "header", skipping: header RCVD_IN_NERDS_KR
[7771] info: config: failed to parse line, skipping:
eval:check_rbl_sub('nerds','127.0.0.154')

What I did is add the following to local.cf:

header __RCVD_IN_NERDS
eval:check_rbl('nerds','zz.countries.nerd.dk.')
describe __RCVD_IN_NERDS                Received from a spam country
tflags __RCVD_IN_NERDS                  net

header RCVD_IN_NERDS_CN
eval:check_rbl_sub('nerds','127.0.0.156')
describe RCVD_IN_NERDS_CN               Received from China
tflags RCVD_IN_NERDS_CN                 net
score RCVD_IN_NERDS_CN                  2.0

header RCVD_IN_NERDS_KR
eval:check_rbl_sub('nerds','127.0.0.154')
describe RCVD_IN_NERDS_KR               Received from Rep. of Korea
tflags RCVD_IN_NERDS_KR                 net
score RCVD_IN_NERDS_KR                  2.0


Peter

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com