spam control

List overview All Threads
Download

newer

older

RE: [CentOS] Linux World Expo -...

root email question

Jerry Geis

25 Oct 2006 25 Oct '06

4:22 a.m.

Gents,

I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

Thanks

jerry --------------------------- dnl # dnl # dnsbl - DNS based Blackhole List/Black List/Rejection list dnl # See http://www.sendmail.org/m4/features.html#dnsbl dnl # FEATURE(`dnsbl', `bl.spamcop.net', `"Spam blocked see: http://spamcop.net/bl.shtml?%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `relays.ordb.org', `"Spam blocked see: http://ordb.org/lookup/?host=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `cbl.abuseat.org', `"Spam blocked see: http://cbl.abuseat.org/lookup.cgi?ip=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `sbl.spamhaus.org', `"Spam blocked see: http://spamhaus.org/query/bl?ip=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `list.dsbl.org', `"Spam blocked see: http://dsbl.org/listing?%22$&%7Bclient_addr%7D%27)dnl dnl #

Show replies by date

Jim Perrin

25 Oct 25 Oct

4:28 a.m.

On 10/24/06, Jerry Geis geisj@pagestation.com wrote:

...

Gents,

I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

spamassassin. It's even provided in the base distro.

-- During times of universal deceit, telling the truth becomes a revolutionary act. George Orwell

Mike Kercher

4:33 a.m.

centos-bounces@centos.org <> scribbled on Tuesday, October 24, 2006 9:22 PM:

...

Gents,

I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

Thanks

MailScanner

http://www.mailscanner.info

Mike

chrism＠imntv.com

4:44 a.m.

Jerry Geis wrote:

...

Gents,

I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

Running spamassassin + clamav and a few RBLs seemed to make a big dent in it for me, but a fair amount of crap still gets through. Frankly, I guess I'll never understand the mindset of the spammer. They go out of their way to circumvent spam controls for people who *obviously* don't want to receive those ads. It's like me telling my mum I don't like liver so she goes out of her way to sneak it into my diet knowing I'll gag on each bite. (no, my mum really knows I hate liver and doesn't do that...heh)

I wish the penalties for polluting the internet were half as potent as those for polluting the ocean. Perhaps then we'd see some improvement.

Cheers,

Aleksandar Milivojevic

5:24 a.m.

chrism@imntv.com wrote:

...

I wish the penalties for polluting the internet were half as potent as those for polluting the ocean. Perhaps then we'd see some improvement.

There's no way to block 100% of spam. There are tools and techniques to block some of it. There are some RFC drafts that might prevent spammers to use your domain as sender's address (but this is mostly thing of the future, if those drafts ever get widely deployed standards). And that's about it.

DamianS

2:22 p.m.

On Tue, 2006-10-24 at 22:24 -0500, Aleksandar Milivojevic wrote:

...

chrism@imntv.com wrote:

...
I wish the penalties for polluting the internet were half as potent as those for polluting the ocean. Perhaps then we'd see some improvement.

There's no way to block 100% of spam. There are tools and techniques to block some of it. There are some RFC drafts that might prevent spammers to use your domain as sender's address (but this is mostly thing of the future, if those drafts ever get widely deployed standards). And that's about it.

There is a way to block 99% of spam though. That solution is for ISPs to start charging money for each email sent!

William Warren

2:59 p.m.

nopers. that will only price legit users out of hte market and e-mail will be nearly 100% spam after that.

DamianS wrote:

...

On Tue, 2006-10-24 at 22:24 -0500, Aleksandar Milivojevic wrote:

...
chrism@imntv.com wrote:

...
I wish the penalties for polluting the internet were half as potent as those for polluting the ocean. Perhaps then we'd see some improvement.

There's no way to block 100% of spam. There are tools and techniques to block some of it. There are some RFC drafts that might prevent spammers to use your domain as sender's address (but this is mostly thing of the future, if those drafts ever get widely deployed standards). And that's about it.

There is a way to block 99% of spam though. That solution is for ISPs to start charging money for each email sent! _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

-- My "Foundation" verse: Isa 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou shalt condemn. This is the heritage of the servants of the LORD, and their righteousness is of me, saith the LORD. -- carpe ductum -- "Grab the tape" CDTT (Certified Duct Tape Technician) Linux user #322099 Machines: 206822 256638 276825 http://counter.li.org/

Aleksandar Milivojevic

4:59 p.m.

Quoting DamianS clovis@iinet.net.au:

...

There is a way to block 99% of spam though. That solution is for ISPs to start charging money for each email sent!

Not going to happen. The ISP that starts doing that will loose 99.999% of it's customers day after they start charging ;-)

Anyhow, static IP addresses are cheap. Even /24 block of IP addresses is something like $1200 one time fee (or somewhere around that number) plus some small yearly fee (however, you run a risk that some big ISPs filter out small blocks in BGP announcements (was it /19?), or at least Sprint used to do that). It's not that hard to bypass your ISP.

-- NOTICE: If you are not intended recipient, you are hereby notified that by reading this message you agreed not to disturb frogs during mating season. For more info, visit http://www.8-P.ca/

Bill Church

5:09 p.m.

Quoting DamianS clovis@iinet.net.au:

...

There is a way to block 99% of spam though. That solution is for ISPs to start charging money for each email sent!

Really? So you mean the spammers that own 10,000+ node botnets, comprised of grandparents and neglected school PC's will stop sending out SPAM because of the owners of the PC their using will get a bill? They don't care, they already take over someone else's PC to do their dirty work, they have no conscious.

To really stop it cold mail needs to be brought up to 2006 technology. So far everything to fix SPAM has been a band-aid. The current e-mail technology and system was created when the Internet was based on trust, this is obviously no longer the case and a suitable replacement needs to be created.

The other issue is lax administrators (e-mail, desktop, system, etc...). If people would stay on top of security holes, or provide adequate protection to their customers / users the spammers would have a hard time taking over their PCs to do their dirty work.

For now, the best bet is a well maintained reputation system or black list, grey listing on top of that, enforcing strict DNS ptr and a records (this will cause false positives, but if enough people take a stand lazy administrators will have to eventually fix their crap DNS), utilizing SPF and Sender Keys, and a good reactive filter. Also, another good method is limiting clients sending to invalid recipients, say if more than 3 invalid recipients are sent block further attempts from that client. I've not done this in SA or anything else, but an appliance I use allows me to do this, and it's quite effective.

AOL, as much as people hate them, has the best chace of fixing a lot of these problems as they enforce a lot of these things already (http://postmaster.aol.com/).

If you have the luxury of blocking IPs based on countries or regions, that helps as well but not everyone can do this.

-Bill

Mark Weaver

30 Oct 30 Oct

4:27 a.m.

Bill Church wrote:

...

If you have the luxury of blocking IPs based on countries or regions, that helps as well but not everyone can do this.

-Bill

That in a nutshell of but one layer of a multi-layer approach that I've been using for the past two years. At present I may get a grand total of 2 SPAMs per week; sometimes less than that, but that's the average.

layer #1: RBLs configured in the MTA - Sendmail layer #2: SpamAssassin (score set to 3 and known or trusted addresses white-listed layer #3: iptables rules and a technique known as geo-blocking.

The third layer, iptables and geo-blocking REALLY make a huge difference. It's taken about a year and some digging, but I've got a very good foundation ruleset that works extremely well. And personally I don't consider blocking on countries or regions is a luxury, but rather a necessity. Anyone can do it and should of they're running a mail server that is accepting direct SMTP connections.

Since my mail server is already behind a router the rule set is very simple, but extremely effective and very portable.

*see attached bash script.

-- Mark "If you have found a very wise man, then you've found a man that at one time was an idiot and lived long enough to learn from his own stupidity." ============================================== Powered by CentOS4 (RHEL4) #!/bin/sh # flush the rules iptables -F; ############################################################################### ######################### setting initial rules set ########################### ############################################################################### # # protecting the Samba ports from the outside world # #iptables -I INPUT -p udp -s 0/0 --dport 137:139 -j DROP; #iptables -I INPUT -p udp -s 0/0 --dport 137:139 -j LOG --log-prefix "Samba Connect ATTEMPT:"; #iptables -I INPUT -p tcp -s 0/0 --dport 137:139 -j DROP; #iptables -I INPUT -p tcp -s 0/0 --dport 137:139 -j LOG --log-prefix "Samba Connect ATTEMPT:"; ################### SPRINT NET - Treason Uncloaked ################## # 205.240.0.0/13 #iptables -A INPUT -s 205.240.0.0/13 -j LOG --log-level debug --log-prefix "TU_SPRINT-Reston-VA: "; #iptables -A INPUT -s 205.240.0.0/13 -j DROP; ##################################################################### ##################################################################### ##################################################################### # EXTRA IPTABLES RULES TO KEEP OUT THE MORONS # ##################################################################### ##################################################################### # 70.136.0.27 iptables -A INPUT -p tcp --dport 25 -s 70.136.0.27 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 70.136.0.27 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 149.143.201.219 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 149.143.201.219 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 157.45.146.216 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 157.45.146.216 -j DROP; # 12.202.204.83 iptables -A INPUT -p tcp --dport 25 -s 12.202.204.83 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 12.202.204.83 -j DROP; # 207.45.240.0/20 iptables -A INPUT -p tcp --dport 25 -s 207.45.240.0/20 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 207.45.240.0/20 -j DROP; # 68.73.184.7 iptables -A INPUT -p tcp --dport 25 -s 68.73.184.7 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 68.73.184.7 -j DROP; # 66.75.160.141 iptables -A INPUT -p tcp --dport 25 -s 66.75.160.141 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.75.160.141 -j DROP; # 209.196.77.104 iptables -A INPUT -p tcp --dport 25 -s 209.196.77.104 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 209.196.77.104 -j DROP; # 69.6.17.28 iptables -A INPUT -p tcp --dport 25 -s 69.6.17.28 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.6.17.28 -j DROP; # 67.172.124.91 iptables -A INPUT -p tcp --dport 25 -s 67.172.124.91 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 67.172.124.91 -j DROP; # 70.182.91.39 iptables -A INPUT -p tcp --dport 25 -s 70.182.91.39 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 70.182.91.39 -j DROP; # 32.97.182.141 iptables -A INPUT -p tcp --dport 25 -s 32.97.182.141 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 32.97.182.141 -j DROP; # 209.214.107.219 iptables -A INPUT -p tcp --dport 25 -s 209.214.107.219 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 209.214.107.219 -j DROP; # 69.40.188.64 iptables -A INPUT -p tcp --dport 25 -s 69.40.188.64 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.40.188.64 -j DROP; # 69.40.189.103 iptables -A INPUT -p tcp --dport 25 -s 69.40.189.103 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.40.189.103 -j DROP; # 207.254.0.0/17 iptables -A INPUT -p tcp --dport 25 -s 207.254.0.0/17 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 207.254.0.0/17 -j DROP; # 65.175.2.89 iptables -A INPUT -p tcp --dport 25 -s 65.175.0.0/18 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 65.175.0.0/18 -j DROP; # 63.218.48.173 iptables -A INPUT -p tcp --dport 25 -s 63.218.48.173 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 63.218.48.173 -j DROP; # 207.179.112.0/24 # Netname: ACDC # ACD Internet Services - Lansing, Michigan iptables -A INPUT -p tcp --dport 25 -s 207.179.112.0/24 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 207.179.112.0/24 -j DROP; # 68.236.0.0/14 iptables -A INPUT -p tcp --dport 25 -s 68.236.0.0/14 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 68.236.0.0/14 -j DROP; # 199.239.248.126 iptables -A INPUT -p tcp --dport 25 -s 199.239.248.126 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 199.239.248.126 -j DROP; # 66.69.39.254 iptables -A INPUT -p tcp --dport 25 -s 66.69.39.254 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.69.39.254 -j DROP; # 66.139.73.209 iptables -A INPUT -p tcp --dport 25 -s 66.139.73.209 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.139.73.209 -j DROP; # 67.173.134.50 iptables -A INPUT -p tcp --dport 25 -s 67.173.134.50 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 67.173.134.50 -j DROP; # 216.75.25.109 iptables -A INPUT -p tcp --dport 25 -s 216.75.25.109 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 216.75.25.109 -j DROP; # 216.74.216.242 iptables -A INPUT -p tcp --dport 25 -s 216.74.216.242 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 216.74.216.242 -j DROP; # 63.218.48.148 iptables -A INPUT -p tcp --dport 25 -s 63.218.48.148 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 63.218.48.148 -j DROP; # 209.126.136.193 iptables -A INPUT -p tcp --dport 25 -s 209.126.136.193 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 209.126.136.193 -j DROP; # 67.48.77.93 iptables -A INPUT -p tcp --dport 25 -s 67.48.77.93 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 67.48.77.93 -j DROP; # 66.35.244.41 iptables -A INPUT -p tcp --dport 25 -s 66.35.244.41 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.35.244.41 -j DROP; # 68.223.154.214 iptables -A INPUT -p tcp --dport 25 -s 68.223.154.214 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 68.223.154.214 -j DROP; # 68.119.34.148 iptables -A INPUT -p tcp --dport 25 -s 68.119.34.148 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 68.119.34.148 -j DROP; # 216.177.12.178 iptables -A INPUT -p tcp --dport 25 -s 216.177.12.178 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 216.177.12.178 -j DROP; # 71.107.92.239 iptables -A INPUT -p tcp --dport 25 -s 71.107.92.239 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 71.107.92.239 -j DROP; # 204.15.230.110 iptables -A INPUT -p tcp --dport 25 -s 204.15.230.110 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.230.110 -j DROP; # 69.30.231.208 iptables -A INPUT -p tcp --dport 25 -s 69.30.231.208 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.231.208 -j DROP; # 209.213.197.123 iptables -A INPUT -p tcp --dport 25 -s 209.213.197.123 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 209.213.197.123 -j DROP; # 204.15.230.122 iptables -A INPUT -p tcp --dport 25 -s 204.15.230.122 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.230.122 -j DROP; # 69.30.225.165 iptables -A INPUT -p tcp --dport 25 -s 69.30.225.165 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.225.165 -j DROP; # 72.29.24.188 iptables -A INPUT -p tcp --dport 25 -s 72.29.24.188 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 72.29.24.188 -j DROP; # 69.30.201.134 iptables -A INPUT -p tcp --dport 25 -s 69.30.201.134 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.201.134 -j DROP; # 69.30.200.203 iptables -A INPUT -p tcp --dport 25 -s 69.30.200.203 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.200.203 -j DROP; # 204.15.227.243 iptables -A INPUT -p tcp --dport 25 -s 204.15.227.243 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.227.243 -j DROP; # 204.15.227.242 iptables -A INPUT -p tcp --dport 25 -s 204.15.227.242 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.227.242 -j DROP; # 69.30.200.209 iptables -A INPUT -p tcp --dport 25 -s 69.30.200.209 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.200.209 -j DROP; # 72.29.19.215 iptables -A INPUT -p tcp --dport 25 -s 72.29.19.215 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 72.29.19.215 -j DROP; # 69.30.201.153 iptables -A INPUT -p tcp --dport 25 -s 69.30.201.153 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.201.153 -j DROP; # 69.30.242.6 iptables -A INPUT -p tcp --dport 25 -s 69.30.242.6 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.242.6 -j DROP; # 209.51.159.194 iptables -A INPUT -p tcp --dport 25 -s 209.51.159.194 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 209.51.159.194 -j DROP; # 64.129.66.34 iptables -A INPUT -p tcp --dport 25 -s 64.129.66.34 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 64.129.66.34 -j DROP; # 66.220.26.149 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.149 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.149 -j DROP; # 66.220.26.139 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.139 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.139 -j DROP; # 66.220.26.146 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.146 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.146 -j DROP; # 216.86.157.205 iptables -A INPUT -p tcp --dport 25 -s 216.86.157.205 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 216.86.157.205 -j DROP; # 69.30.242.61 iptables -A INPUT -p tcp --dport 25 -s 69.30.242.61 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.242.61 -j DROP; # 66.220.26.142 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.142 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.142 -j DROP; #66.220.26.150 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.150 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.150 -j DROP; #66.220.26.147 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.147 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.147 -j DROP; #66.220.11.88 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.88 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.88 -j DROP; #69.30.242.14 iptables -A INPUT -p tcp --dport 25 -s 69.30.242.14 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.242.14 -j DROP; #204.15.230.111 iptables -A INPUT -p tcp --dport 25 -s 204.15.230.111 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.230.111 -j DROP; #66.220.26.148 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.148 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.148 -j DROP; #64.129.66.52 iptables -A INPUT -p tcp --dport 25 -s 64.129.66.52 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 64.129.66.52 -j DROP; #66.220.26.144 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.144 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.144 -j DROP; #72.29.1.58 iptables -A INPUT -p tcp --dport 25 -s 72.29.1.58 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 72.29.1.58 -j DROP; #64.192.203.6 iptables -A INPUT -p tcp --dport 25 -s 64.192.203.6 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 64.192.203.6 -j DROP; #69.30.242.23 iptables -A INPUT -p tcp --dport 25 -s 69.30.242.23 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.242.23 -j DROP; #69.30.215.154 iptables -A INPUT -p tcp --dport 25 -s 69.30.215.154 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.215.154 -j DROP; #66.220.26.156 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.156 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.156 -j DROP; #66.220.11.77 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.77 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.77 -j DROP; #66.220.11.91 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.91 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.91 -j DROP; #204.15.227.232 iptables -A INPUT -p tcp --dport 25 -s 204.15.227.232 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.227.232 -j DROP; #204.15.227.235 iptables -A INPUT -p tcp --dport 25 -s 204.15.227.235 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.227.235 -j DROP; #66.220.11.70 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.70 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.70 -j DROP; #204.15.227.245 iptables -A INPUT -p tcp --dport 25 -s 204.15.227.245 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.227.245 -j DROP; #66.220.26.136 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.136 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.136 -j DROP; #66.220.11.93 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.93 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.93 -j DROP; #66.220.26.140 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.140 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.140 -j DROP; #205.245.135.69 iptables -A INPUT -p tcp --dport 25 -s 205.245.135.69 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 205.245.135.69 -j DROP; #69.57.176.118 iptables -A INPUT -p tcp --dport 25 -s 69.57.176.118 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.57.176.118 -j DROP; #84.95.76.8 iptables -A INPUT -p tcp --dport 25 -s 84.95.76.8 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 84.95.76.8 -j DROP; #83.54.89.6 iptables -A INPUT -p tcp --dport 25 -s 83.54.89.6 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 83.54.89.6 -j DROP; #69.30.242.19 iptables -A INPUT -p tcp --dport 25 -s 69.30.242.19 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.242.19 -j DROP; #69.30.215.89 iptables -A INPUT -p tcp --dport 25 -s 69.30.215.89 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.215.89 -j DROP; #66.220.26.157 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.157 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.157 -j DROP; #66.220.26.154 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.154 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.154 -j DROP; #66.220.26.152 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.152 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.152 -j DROP; #66.220.26.151 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.151 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.151 -j DROP; #66.220.26.135 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.135 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.135 -j DROP; #66.220.11.90 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.90 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.90 -j DROP; #66.220.11.84 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.84 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.84 -j DROP; #66.220.11.76 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.76 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.76 -j DROP; #66.220.11.69 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.69 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.69 -j DROP; #64.129.66.43 iptables -A INPUT -p tcp --dport 25 -s 64.129.66.43 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 64.129.66.43 -j DROP; #208.97.210.94 iptables -A INPUT -p tcp --dport 25 -s 208.97.210.94 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 208.97.210.94 -j DROP; #205.245.135.92 iptables -A INPUT -p tcp --dport 25 -s 205.245.135.92 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 205.245.135.92 -j DROP; #204.15.230.93 iptables -A INPUT -p tcp --dport 25 -s 204.15.230.93 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.230.93 -j DROP; #69.30.242.12 iptables -A INPUT -p tcp --dport 25 -s 69.30.242.12 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.242.12 -j DROP; #66.220.11.87 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.87 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.87 -j DROP; #66.220.11.68 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.68 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.68 -j DROP; #66.220.11.89 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.89 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.89 -j DROP; #72.29.1.50 iptables -A INPUT -p tcp --dport 25 -s 72.29.1.50 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 72.29.1.50 -j DROP; #66.220.11.80 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.80 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.80 -j DROP; #69.30.242.59 iptables -A INPUT -p tcp --dport 25 -s 69.30.242.59 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.242.59 -j DROP; #66.220.26.137 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.137 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.137 -j DROP; #66.220.11.82 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.82 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.82 -j DROP; #64.129.66.37 iptables -A INPUT -p tcp --dport 25 -s 64.129.66.37 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 64.129.66.37 -j DROP; #72.29.19.158 iptables -A INPUT -p tcp --dport 25 -s 72.29.19.158 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 72.29.19.158 -j DROP; #205.245.135.131 iptables -A INPUT -p tcp --dport 25 -s 205.245.135.131 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 205.245.135.131 -j DROP; #69.30.242.26 iptables -A INPUT -p tcp --dport 25 -s 69.30.242.26 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.242.26 -j DROP; #204.15.227.234 iptables -A INPUT -p tcp --dport 25 -s 204.15.227.234 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.227.234 -j DROP; #205.245.135.99 iptables -A INPUT -p tcp --dport 25 -s 205.245.135.99 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 205.245.135.99 -j DROP; #208.97.210.74 iptables -A INPUT -p tcp --dport 25 -s 208.97.210.74 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 208.97.210.74 -j DROP; #204.15.230.88 iptables -A INPUT -p tcp --dport 25 -s 204.15.230.88 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.230.88 -j DROP; #69.30.242.62 iptables -A INPUT -p tcp --dport 25 -s 69.30.242.62 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.242.62 -j DROP; #66.220.11.79 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.79 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.79 -j DROP; #66.220.11.78 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.78 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.78 -j DROP; #204.15.227.238 iptables -A INPUT -p tcp --dport 25 -s 204.15.227.238 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.227.238 -j DROP; #66.220.26.133 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.133 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.133 -j DROP; #66.220.11.94 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.94 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.94 -j DROP; #204.15.230.96 iptables -A INPUT -p tcp --dport 25 -s 204.15.230.96 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.230.96 -j DROP; #12.191.232.78 iptables -A INPUT -p tcp --dport 25 -s 12.191.232.78 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 12.191.232.78 -j DROP; #64.129.66.54 iptables -A INPUT -p tcp --dport 25 -s 64.129.66.54 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 64.129.66.54 -j DROP; #69.30.225.170 iptables -A INPUT -p tcp --dport 25 -s 69.30.225.170 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.225.170 -j DROP; #69.30.242.38 iptables -A INPUT -p tcp --dport 25 -s 69.30.242.38 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.242.38 -j DROP; #205.245.135.152 iptables -A INPUT -p tcp --dport 25 -s 205.245.135.152 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 205.245.135.152 -j DROP; #12.191.232.67 iptables -A INPUT -p tcp --dport 25 -s 12.191.232.67 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 12.191.232.67 -j DROP; #208.97.210.79 iptables -A INPUT -p tcp --dport 25 -s 208.97.210.79 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 208.97.210.79 -j DROP; #204.15.227.244 iptables -A INPUT -p tcp --dport 25 -s 204.15.227.244 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.227.244 -j DROP; #66.220.11.83 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.83 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.83 -j DROP; #64.129.66.35 iptables -A INPUT -p tcp --dport 25 -s 64.129.66.35 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 64.129.66.35 -j DROP; #69.30.242.56 iptables -A INPUT -p tcp --dport 25 -s 69.30.242.56 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.242.56 -j DROP; #204.15.230.112 iptables -A INPUT -p tcp --dport 25 -s 204.15.230.112 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 204.15.230.112 -j DROP; #66.220.11.85 iptables -A INPUT -p tcp --dport 25 -s 66.220.11.85 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.11.85 -j DROP; #66.220.26.132 iptables -A INPUT -p tcp --dport 25 -s 66.220.26.132 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.220.26.132 -j DROP; #69.30.242.55 iptables -A INPUT -p tcp --dport 25 -s 69.30.242.55 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.30.242.55 -j DROP; #68.235.233.186 iptables -A INPUT -p tcp --dport 25 -s 68.235.233.186 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 68.235.233.186 -j DROP; # 69.255.21.62 iptables -A INPUT -p tcp --dport 25 -s 69.255.21.62 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 69.255.21.62 -j DROP; # 68.44.120.32 iptables -A INPUT -p tcp --dport 25 -s 68.44.120.32 -j LOG --log-level debug --log-prefix "as_US-MORON-comcast-pa: "; iptables -A INPUT -p tcp --dport 25 -s 68.44.120.32 -j DROP; # 71.36.23.208 iptables -A INPUT -p tcp --dport 25 -s 71.36.23.208 -j LOG --log-level debug --log-prefix "as_US-MORON-qwest-co: "; iptables -A INPUT -p tcp --dport 25 -s 71.36.23.208 -j DROP; # 72.161.73.206 iptables -A INPUT -p tcp --dport 25 -s 72.161.73.206 -j LOG --log-level debug --log-prefix "as_US-MORON-centtel-la: "; iptables -A INPUT -p tcp --dport 25 -s 72.161.73.206 -j DROP; # 64.127.125.134 iptables -A INPUT -p tcp --dport 25 -s 64.127.125.134 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 64.127.125.134 -j DROP; # 64.175.175.165 iptables -A INPUT -p tcp --dport 25 -s 64.175.175.165 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 64.175.175.165 -j DROP; # 66.235.218.125 iptables -A INPUT -p tcp --dport 25 -s 66.235.218.125 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 66.235.218.125 -j DROP; # 207.217.125.16 iptables -A INPUT -p tcp --dport 25 -s 207.217.125.16 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 207.217.125.16 -j DROP; # 72.20.4.146 iptables -A INPUT -p tcp --dport 25 -s 72.20.4.146 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -s 72.20.4.146 -j DROP; ############################################################################# ########################## US Netblocks That Spew SPAM ###################### # Netname: CARI-4 # California Regional Internet, Inc. 8929A COMPLEX DRIVE SAN DIEGO CA 92123 US iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 216.75.0.0-216.75.31.255 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 216.75.0.0-216.75.31.255 -j DROP; # Netname: EchoLabs 2465 Centerville Road Number J17-209 Herndon VA 20171 # 216.52.118.192-216.52.118.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 216.52.118.192-216.52.118.255 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 216.52.118.192-216.52.118.255 -j DROP; # 158.59.0.0-158.59.255.255 # Netname: ARL-COUNTY # Arlington County Government ACG-9 2100 Clarendon Blvd., Suite 612 Arlington VA, US iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 158.59.0.0-158.59.255.255 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 158.59.0.0-158.59.255.255 -j DROP; # Netname: 66.51.192.0-66.51.223.255 CIDR: 66.51.192.0/19 DSLEXTREME-NWK-1 # DSL Extreme DSLE 20847 Sherman Way 5b. Org Address: Suite 300 Winnetka CA 91306 US iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 66.51.192.0-66.51.223.255 -j LOG --log-level debug --log-prefix "as_DSLEXTREME-NWK-1-us: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 66.51.192.0-66.51.223.255 -j DROP; # 65.184.0.0-65.191.255.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 65.184.0.0-65.191.255.255 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 65.184.0.0-65.191.255.255 -j DROP; # 205.152.0.0-205.152.255.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 205.152.0.0-205.152.255.255 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 205.152.0.0-205.152.255.255 -j DROP; # 129.107.0.0-129.107.255.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 129.107.0.0-129.107.255.255 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 129.107.0.0-129.107.255.255 -j DROP; # 72.176.0.0-72.186.95.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 72.176.0.0-72.186.95.255 -j LOG --log-level debug --log-prefix "as_US-MORON: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 72.176.0.0-72.186.95.255 -j DROP; # 68.208.0.0-68.223.255.255 BELLSNET-BLK15 # BellSouth.net Inc. 575 Morosgo Drive Atlanta GA #iptables -A INPUT -m iprange --src-range 68.208.0.0-68.223.255.255 -j LOG --log-level debug --log-prefix "as_BELLSNET-BLK15-us: "; #iptables -A INPUT -m iprange --src-range 68.208.0.0-68.223.255.255 -j DROP; # Netname: SRVN # MailGravity 244 Fifth Ave. Suite L209 New York NY 10001 US iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 216.22.33.0-216.22.33.255 -j LOG --log-level debug --log-prefix "as_US-MORON-SRVN: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 216.22.33.0-216.22.33.255 -j DROP; # 130.94.6.192-130.94.6.223 # Verio Data Centers - San Francisco iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 130.94.6.192-130.94.6.223 -j LOG --log-level debug --log-prefix "as_US-MORON-VERIO: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 130.94.6.192-130.94.6.223 -j DROP; # 209.213.192.0-209.213.223.255 # YIPES-BLK1 # Yipes Communications, Inc. YIPS 114 Sansome Street San Francisco CA iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 209.213.192.0-209.213.223.255 -j LOG --log-level debug --log-prefix "as_YIPES-BLK1-us: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 209.213.192.0-209.213.223.255 -j DROP; ##################################################################################### ############################## UUNET TECHNOLOGIES ################################### ##################################################################################### iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 199.170.0.0-199.173.255.255 -j LOG --log-level debug --log-prefix "as_UUNET: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 199.170.0.0-199.173.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 63.64.0.0-63.127.255.255 -j LOG --log-level debug --log-prefix "as_UUNET: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 63.64.0.0-63.127.255.255 -j DROP; ##################################################################################### ##################################################################################### # 69.44.0.0 - 69.45.255.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 69.44.0.0-69.45.255.255 -j LOG --log-level debug --log-prefix "as_DULLES: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 69.44.0.0-69.45.255.255 -j DROP; # 69.44.152.0 - 69.44.159.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 69.44.152.0-69.44.159.255 -j LOG --log-level debug --log-prefix "as_SERVERBEACH: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 69.44.152.0-69.44.159.255 -j DROP; ####################################################################################### ##################### THE ROAD RUNNER NETWORK IN THE US ############################### ####################################################################################### iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 65.32.0.0-65.34.15.255 -j LOG --log-level debug --log-prefix "as_RoadRunner: " iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 65.32.0.0-65.34.15.255 -j DROP; #iptables -A INPUT -m iprange --src-range -j LOG --log-level debug --log-prefix "as_RoadRunner: " #iptables -A INPUT -m iprange --src-range -j DROP; ############################### canada ############################# # Netname: UNIVER-122 # University of Manitoba - Winnipeg, MB - CA iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 130.179.0.0-130.179.255.255 -j LOG --log-level debug --log-prefix "asshole_UNIVER-122-ca: " iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 130.179.0.0-130.179.255.255 -j DROP; # Netname: SHAWC-1 # Shaw Communications Inc. - Calgary, AB #iptables -A INPUT -m iprange --src-range 64.59.128.0-64.59.191.255 -j LOG --log-level debug --log-prefix "as_SHAWC-1-ca: " #iptables -A INPUT -m iprange --src-range 64.59.128.0-64.59.191.255 -j DROP; ######################################################################################## ################################ THE ASSHOLE SECTION: ################################## ################# IF YOU'VE MADE IT HERE YOU MUST BE AN ASSHOLE ######################## ####################### WITH FAR TOO MUCH TIME ON YOUR HANDS ########################### ######################################################################################## iptables -A INPUT -s 216.179.125.69 -j LOG --log-prefix "asshole: "; iptables -A INPUT -s 216.179.125.69 -j DROP; iptables -A INPUT -s 216.17.51.201 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 216.17.51.201 -j DROP; iptables -A INPUT -s 69.152.151.222 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 69.152.151.222 -j DROP; iptables -A INPUT -s 66.151.128.13 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 66.151.128.13 -j DROP; iptables -A INPUT -s 209.77.56.46 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 209.77.56.46 -j DROP; iptables -A INPUT -s 24.218.44.187 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 24.218.44.187 -j DROP; iptables -A INPUT -s 206.228.93.25 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 206.228.93.25 -j DROP; # 66.221.167.1 iptables -A INPUT -s 66.221.167.1 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 66.221.167.1 -j DROP; # 207.154.23.130 iptables -A INPUT -s 207.154.23.130 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 207.154.23.130 -j DROP; # Server Beach -- more compromised machine's than you can shake a stick at! # 64.34.160.0-64.34.191.255 iptables -A INPUT -m iprange --src-range 64.34.160.0-64.34.191.255 -j LOG --log-level debug --log-prefix "asshole_ServerBeach-US: " iptables -A INPUT -m iprange --src-range 64.34.160.0-64.34.191.255 -j DROP; # 216.22.0.0-216.22.63.255: 216.22.56.5 iptables -A INPUT -m iprange --src-range 216.22.0.0-216.22.63.255 -j LOG --log-level debug --log-prefix "asshole_ServerBeach-US: " iptables -A INPUT -m iprange --src-range 216.22.0.0-216.22.63.255 -j DROP; # 66.221.0.0-66.221.255.255: 66.221.227.98 iptables -A INPUT -m iprange --src-range 66.221.0.0-66.221.255.255 -j LOG --log-level debug --log-prefix "asshole_ServerBeach-US: " iptables -A INPUT -m iprange --src-range 66.221.0.0-66.221.255.255 -j DROP; # 66.101.58.150 iptables -A INPUT -s 66.101.58.150 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 66.101.58.150 -j DROP; # 4.253.15.151 iptables -A INPUT -s 4.253.15.151 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 4.253.15.151 -j DROP; # 63.135.230.220 iptables -A INPUT -s 63.135.230.220 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 63.135.230.220 -j DROP; # 72.22.74.89 iptables -A INPUT -s 63.135.230.220 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 63.135.230.220 -j DROP; # 209.11.243.131 iptables -A INPUT -s 209.11.243.131 -j LOG --log-level debug --log-prefix "asshole: "; iptables -A INPUT -s 209.11.243.131 -j DROP; ######################################################################################## ########################## REAL BAD ASSHOLES| BREACH ATTEMPTS ########################## ############################ ALL ACCESS BLOCKED COMPLETELY ############################# ######################################################################################## # Netname: NETBLK-THEPLANET-BLK-13 # ThePlanet.com Internet Services, Inc. TPCM 1333 North Stemmons Freeway Suite 110 Dallas TX 75207 US #iptables -A INPUT -m iprange --src-range 70.84.0.0-70.87.255.255 -j LOG --log-level debug --log-prefix "asshole_BREACH-ATTEMPTS-US: " #iptables -A INPUT -m iprange --src-range 70.84.0.0-70.87.255.255 -j DROP; iptables -A INPUT -p udp --dport 10000:65000 -m iprange --src-range 70.84.0.0-70.87.255.255 -j LOG --log-level debug --log-prefix "asshole_BREACH-ATTEMPTS-US: " iptables -A INPUT -p udp --dport 10000:65000 -m iprange --src-range 70.84.0.0-70.87.255.255 -j DROP; iptables -A INPUT -p tcp --dport 80:65000 -m iprange --src-range 70.84.0.0-70.87.255.255 -j LOG --log-level debug --log-prefix "asshole_BREACH-ATTEMPTS-US: " iptables -A INPUT -p tcp --dport 80:65000 -m iprange --src-range 70.84.0.0-70.87.255.255 -j DROP; iptables -A INPUT -p tcp --dport 20:23 -m iprange --src-range 70.84.0.0-70.87.255.255 -j LOG --log-level debug --log-prefix "asshole_BREACH-ATTEMPTS-US: " iptables -A INPUT -p tcp --dport 20:23 -m iprange --src-range 70.84.0.0-70.87.255.255 -j DROP; ############################################################################### ##################### SPECIAL US ASSHOLE SPAMMER NETWORKS ##################### ############################################################################### # Netname: BTN-CIDR5 # Beyond The Network America, Inc. BNA-42 Reston Executive Center 12100 Sunset Hills Road, Suite 300 Reston, VA 20190 US iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 63.216.0.0-63.223.255.255 -j LOG --log-level debug --log-prefix "asshole_networks-US: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 63.216.0.0-63.223.255.255 -j DROP; # Netname: WESTHOST-NOC # WestHost, Inc. WESTHO 164 N Spring Creek Pkwy Providence UT 84332 US iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 69.36.160.0-69.36.191.255 -j LOG --log-level debug --log-prefix "asshole_networks-US: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 69.36.160.0-69.36.191.255 -j DROP; # Netname: # California Regional Intranet, Inc. CALI 8929A COMPLEX DRIVE SAN DIEGO CA 92123 US iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 209.126.128.0-209.126.255.255 -j LOG --log-level debug --log-prefix "asshole_networks-US: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 209.126.128.0-209.126.255.255 -j DROP; # Netname: 204.10.36.0-204.10.39.255 NDCH # Network Data Center Host, Inc. 24843 Del Prado 205 Dana Point CA 92629 US iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 204.10.36.0-204.10.39.255 -j LOG --log-level debug --log-prefix "asshole_networks-US: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 204.10.36.0-204.10.39.255 -j DROP; #iptables -A INPUT -m iprange --src-range -j LOG --log-level debug --log-prefix "asshole_networks-US: "; #iptables -A INPUT -m iprange --src-range -j DROP; # Netname: INJU-MAINSTREAM # Feinstein, Eric +1-813-855-7793 efeinstein@ij.net, United States iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 209.216.65.0-209.216.65.31 -j LOG --log-level debug --log-prefix "asshole_networks-US: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 209.216.65.0-209.216.65.31 -j DROP; ############################################################################### ############################################################################### ##################################################################### ########################### RIPE NETWORK ########################### ##################################################################### # Netname: RIPE all blocks assigned to APNIC # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.0.0.0-80.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.0.0.0-80.255.255.255 -j DROP; ############################ Denmark ############################### # 80.164.64.0-80.164.127.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.164.64.0-80.164.127.255 -j LOG --log-level debug --log-prefix "RIPE-DK: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.164.64.0-80.164.127.255 -j DROP; ############################ Estonia ############################### # 84.50.1.0-84.50.1.255 EE-ESTPAK iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.50.1.0-84.50.1.255 -j LOG --log-level debug --log-prefix "RIPE-EE: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.50.1.0-84.50.1.255 -j DROP; ############################# Israel ############################### # 80.178.0.0-80.178.11.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.178.0.0-80.178.11.255 -j LOG --log-level debug --log-prefix "RIPE-il: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.178.0.0-80.178.11.255 -j DROP; # 85.250.128.0-85.250.255.255 BB-PT iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.250.128.0-85.250.255.255 -j LOG --log-level debug --log-prefix "RIPE-il: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.250.128.0-85.250.255.255 -j DROP; # 80.200.144.0-80.200.159.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.200.144.0-80.200.159.255 -j LOG --log-level debug --log-prefix "RIPE-be: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.200.144.0-80.200.159.255 -j DROP; # # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.0.0.0-81.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.0.0.0-81.255.255.255 -j DROP; # 81.154.0.0-81.157.255.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.154.0.0-81.157.255.255 -j LOG --log-level debug --log-prefix "RIPE-gb: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.154.0.0-81.157.255.255 -j DROP; # # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.0.0.0-82.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.0.0.0-82.255.255.255 -j DROP; # 82.114.184.0-82.114.191.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.114.184.0-82.114.191.255 -j LOG --log-level debug --log-prefix "RIPE-ye: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.114.184.0-82.114.191.255 -j DROP; # 82.192.44.0-82.192.44.127 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.192.44.0-82.192.44.127 -j LOG --log-level debug --log-prefix "TELEMACH-NET-sl: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.192.44.0-82.192.44.127 -j DROP; # # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.0.0.0-83.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.0.0.0-83.255.255.255 -j DROP; # # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.0.0.0-84.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.0.0.0-84.255.255.255 -j DROP; # 83.247.76.0-83.247.79.255 SOLCON INFRA-AW Solcon Dsl Versatel NL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.247.76.0-83.247.79.255 -j LOG --log-level debug --log-prefix "RIPE-SOLCON-nl: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.247.76.0-83.247.79.255 -j DROP; # 84.94.12.0-84.94.23.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.94.12.0-84.94.23.255 -j LOG --log-level debug --log-prefix "RIPE-il: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.94.12.0-84.94.23.255 -j DROP; # 147.236.0.0-147.236.255.255 ISRAEL-LCL-NET iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 147.236.0.0-147.236.255.255 -j LOG --log-level debug --log-prefix "RIPE-il: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 147.236.0.0-147.236.255.255 -j DROP; # 88.154.85.0-88.154.169.255 ADSL-CUSTOMER-CONNECTION iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.154.85.0-88.154.169.255 -j LOG --log-level debug --log-prefix "RIPE-il: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.154.85.0-88.154.169.255 -j DROP; # 88.154.170.0-88.154.255.255 ADSL-CUSTOMER-CONNECTION iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.154.170.0-88.154.255.255 -j LOG --log-level debug --log-prefix "RIPE-il: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.154.170.0-88.154.255.255 -j DROP; # 88.155.170.0-88.155.255.255 ADSL-CUSTOMER-CONNECTION iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.155.170.0-88.155.255.255 -j LOG --log-level debug --log-prefix "RIPE-il: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.155.170.0-88.155.255.255 -j DROP; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.0.0.0-85.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.0.0.0-85.255.255.255 -j DROP; # 85.91.128.0-85.91.140.255 DATABG Data BG Infrastructure BG iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.91.128.0-85.91.140.255 -j LOG --log-level debug --log-prefix "RIPE-bg: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.91.128.0-85.91.140.255 -j DROP; # 85.101.0.0-85.101.127.255 TurkTelekom Turk Telekom ADSL-200K_2 tr iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.101.0.0-85.101.127.255 -j LOG --log-level debug --log-prefix "RIPE-tk: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.101.0.0-85.101.127.255 -j DROP; # 85.135.160.0-85.135.175.255 SLOVANET-ADSL-FLAT ISP Slovanet ADSL pool SK iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.135.160.0-85.135.175.255 -j LOG --log-level debug --log-prefix "RIPE-sk: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.135.160.0-85.135.175.255 -j DROP; # # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.0.0.0-86.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.0.0.0-86.255.255.255 -j DROP; # # 87.118.64.0-87.118.127.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 87.118.64.0-87.118.127.255 -j LOG --log-level debug --log-prefix "RIPE: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 87.118.64.0-87.118.127.255 -j DROP; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 87.0.0.0-87.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 87.0.0.0-87.255.255.255 -j DROP; # # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.0.0.0-88.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.0.0.0-88.255.255.255 -j DROP; # 88.233.0.0-88.233.255.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.233.0.0-88.233.255.255 -j LOG --log-level debug --log-prefix "RIPE-tr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.233.0.0-88.233.255.255 -j DROP; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 89.0.0.0-89.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 89.0.0.0-89.255.255.255 -j DROP; # # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 90.0.0.0-90.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 90.0.0.0-90.255.255.255 -j DROP; # # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 91.0.0.0-91.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 91.0.0.0-91.255.255.255 -j DROP; # 81.19.32.0-81.19.35.255 CDT-CZ-NET iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.19.32.0-81.19.35.255 -j LOG --log-level debug --log-prefix "RIPE-cz: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.19.32.0-81.19.35.255 -j DROP; # 82.100.50.0-82.100.51.255 GRAPESC-NET iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.100.50.0-82.100.51.255 -j LOG --log-level debug --log-prefix "RIPE-cz: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.100.50.0-82.100.51.255 -j DROP; # 85.70.171.0-85.70.171.255 NEXTEL-XDSL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.70.171.0-85.70.171.255 -j LOG --log-level debug --log-prefix "RIPE-cz: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.70.171.0-85.70.171.255 -j DROP; # 193.165.6.0-193.165.6.255 # SKYNET-ADSL SkyNet aDSL customers CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 193.165.6.0-193.165.6.255 -j LOG --log-level debug --log-prefix "RIPE-cz: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 193.165.6.0-193.165.6.255 -j DROP; # 194.108.48.160-194.108.48.255 ERKOR-CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.108.48.160-194.108.48.255 -j LOG --log-level debug --log-prefix "RIPE-cz: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.108.48.160-194.108.48.255 -j DROP; # 194.212.0.0-194.212.255.255 CZ-GTS-19951214 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.212.0.0-194.212.255.255 -j LOG --log-level debug --log-prefix "RIPE-cz: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.212.0.0-194.212.255.255 -j DROP; # 217.168.208.0-217.168.215.255 TRIONET-CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.168.208.0-217.168.215.255 -j LOG --log-level debug --log-prefix "RIPE-cz: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.168.208.0-217.168.215.255 -j DROP; # 212.38.69.0-212.38.69.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.38.69.0-212.38.69.255 -j LOG --log-level debug --log-prefix "RIPE-gb: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.38.69.0-212.38.69.255 -j DROP; # 217.17.249.0-217.17.249.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.17.249.0-217.17.249.255 -j LOG --log-level debug --log-prefix "RIPE-bh: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.17.249.0-217.17.249.255 -j DROP; # ------------------------------------------------------------------------------------------------------- # ------------------------------------------------ Russia ----------------------------------------------- # ------------------------------------------------------------------------------------------------------- iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.67.0.0-194.67.255.255 -j LOG --log-level debug --log-prefix "RIPE-Russia: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.67.0.0-194.67.255.255 -j DROP; # 194.108.48.128-194.108.48.159 ERKOR-CZ ERKOR, spol. s r. o. Hradec Kralove Ostrava area CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.108.48.128-194.108.48.159 -j LOG --log-level debug --log-prefix "RIPE-ERKOR-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.108.48.128-194.108.48.159 -j DROP; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.0.0.0-212.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; # iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.0.0.0-212.255.255.255 -j DROP; #____________________________________________________________________ # Place all the miscreant spammer networks here. We're blocking them # by netblock and country. # If the packets are coming from China, Russia, Taiwan, Japan, Korea # or any other Asian country we don't want'em. Just drop da shit! ##################################################################### ############################## ASIA ################################# ##################################################################### ##################################################################### ########################### APNIC NETWORK ########################### ##################################################################### # Netname: APNIC all blocks assigned to APNIC iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 58.0.0.0-58.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 58.0.0.0-58.255.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 59.0.0.0-59.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 59.0.0.0-59.255.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 60.0.0.0-60.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 60.0.0.0-60.255.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 61.0.0.0-61.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 61.0.0.0-61.255.255.255 -j DROP; # 124.80.64.0-124.80.79.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 124.80.64.0-124.80.79.255 -j LOG --log-level debug --log-prefix "APNIC-kr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 124.80.64.0-124.80.79.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 124.96.0.0-124.103.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 124.96.0.0-124.103.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 125.0.0.0-125.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 125.0.0.0-125.255.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 140.109.0.0-140.138.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 140.109.0.0-140.138.255.255 -j DROP; # 202.114.32.0-202.114.47.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 202.114.32.0-202.114.47.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 202.114.32.0-202.114.47.255 -j DROP; # 203.82.192.0-203.82.207.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 203.82.192.0-203.82.207.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 203.82.192.0-203.82.207.255 -j DROP; #iptables -A INPUT -p tcp --dport 25 -p tcp --dport 20:25 -m iprange --src-range 202.0.0.0-203.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; #iptables -A INPUT -p tcp --dport 25 -p tcp --dport 20:25 -m iprange --src-range 202.0.0.0-203.255.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 210.0.0.0-211.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 210.0.0.0-211.255.255.255 -j DROP; #iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.0.0.0-218.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; #iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.0.0.0-218.255.255.255 -j DROP; # 218.87.0.0-218.87.255.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.87.0.0-218.87.255.255 -j LOG --log-level debug --log-prefix "APNIC-ch: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.87.0.0-218.87.255.255 -j DROP; # 218.150.153.0-218.150.153.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.150.153.0-218.150.153.255 -j LOG --log-level debug --log-prefix "APNIC-kr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.150.153.0-218.150.153.255 -j DROP; # 218.160.0.0-218.175.255.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.160.0.0-218.175.255.255 -j LOG --log-level debug --log-prefix "APNIC_HINET-tw: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.160.0.0-218.175.255.255 -j DROP; # 218.184.0.0/18 iptables -A INPUT -p tcp --dport 25 -s 218.184.0.0/18 -j LOG --log-level debug --log-prefix "APNIC_ETWEBS-NET-tw: "; iptables -A INPUT -p tcp --dport 25 -s 218.184.0.0/18 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 219.0.0.0-219.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 219.0.0.0-219.255.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 220.0.0.0-220.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 220.0.0.0-220.255.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 221.0.0.0-221.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 221.0.0.0-221.255.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 222.0.0.0-222.255.255.255 -j LOG --log-level debug --log-prefix "APNIC: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 222.0.0.0-222.255.255.255 -j DROP; ############################### CHINA ############################### ############### Asia Pacific [China] Class C networks ############### ############################## HONG KONG ############################# ############################### taiwan ################################ ############################## KOREA ################################# ######################################################################### ########################### ASIA WEST ################################# ######################################################################### ############################# Turkey ############################# # 82.151.156.0-82.151.159.255 DORUK-SD-NET DorukNet SD Block TR iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.151.156.0-82.151.159.255 -j LOG --log-level debug --log-prefix "as_DORUK-SD-NET-tr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.151.156.0-82.151.159.255 -j DROP; # Netname: TurkTelekom # TurkTelekom - ADSL-ALC-Acibadem-Dynamic Pool iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.97.72.0-85.97.87.255 -j LOG --log-level debug --log-prefix "as_TurkTelekom-tr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.97.72.0-85.97.87.255 -j DROP; # 85.107.0.0-85.107.127.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.107.0.0-85.107.127.255 -j LOG --log-level debug --log-prefix "as_TurkTelekom-tr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.107.0.0-85.107.127.255 -j DROP; # 88.229.0.0-88.229.127.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.229.0.0-88.229.127.255 -j LOG --log-level debug --log-prefix "as_TurkTelekom-tr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.229.0.0-88.229.127.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.96.112.0-85.96.113.255 -j LOG --log-level debug --log-prefix "as_TurkTelekom-tr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.96.112.0-85.96.113.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.104.128.0-85.104.255.255 -j LOG --log-level debug --log-prefix "as_TurkTelekom-tr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.104.128.0-85.104.255.255 -j DROP; # 88.241.128.0-88.241.255.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.241.128.0-88.241.255.255 -j LOG --log-level debug --log-prefix "as_TurkTelekom-tr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.241.128.0-88.241.255.255 -j DROP; ######################################################################### ########################## ASIA PACIFIC ################################# ######################################################################### ############################## tailand ############################ ############################ australia ################################## # ---------------------------------------------------------------------- # the following rule could be troublesome for some folks on the OT list # that are actually in Australia. Not sure if anyone on the list on the # this network. # ----------------------------------------------------------------------- # Netname: TELSTRAINTERNET40-AU # Canberra, Au. iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 60.224.0.0-60.231.255.255 -j LOG --log-level debug --log-prefix "as_Canberra-au: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 60.224.0.0-60.231.255.255 -j DROP; # Netname: TELSTRAINTERNET29-AU # Canberra, Au. iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 144.136.0.0-144.136.255.255 -j LOG --log-level debug --log-prefix "as_Canberra-au: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 144.136.0.0-144.136.255.255 -j DROP; # 202.6.248.0-202.6.251.255 SPIDERWEB # SPIDERWEB, INTERNET SERVICE PROVIDER, COOLOOLA, AUSTRALIA AU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 202.6.248.0-202.6.251.255 -j LOG --log-level debug --log-prefix "as_SPIDERWEB-au: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 202.6.248.0-202.6.251.255 -j DROP; ############################# Sinapore ################################## ############################### Malaysia ################################ ####################### Philines ###################### ######################## Japan ######################## ########################### india ##################### # 124.124.0.0-124.125.255.255 RelianceInfocomm Reliance Infocomm Limited, Dhirubai Ambani Knowledge City, Thane Belapur Road, KoparKhairne,Navi Mumbai - 400710 , INDIA. IN iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 124.124.0.0-124.125.255.255 -j LOG --log-level debug --log-prefix "as_ReliInfocomm-in: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 124.124.0.0-124.125.255.255 -j DROP; # 218.176.0.0-218.183.255.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.176.0.0-218.183.255.255 -j LOG --log-level debug --log-prefix "as_BBTECH-jp: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.176.0.0-218.183.255.255 -j DROP; ####################### Pakistan ###################### ######################################################################### ############################### AFRICA ################################## ######################################################################### ############################# Palastine ############################# # 82.205.0.0-82.205.127.255 ORG-PCL3-RIPE PS-PALNET-20031105 Palnet Communications Ltd. PS iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.205.0.0-82.205.127.255 -j LOG --log-level debug --log-prefix "as_ORG-PCL3-RIPE-ps: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.205.0.0-82.205.127.255 -j DROP; ############################### Libya ############################### # 82.205.232.0-82.205.232.255 ALRIYADHA Assignment for Al Riyadha Internet Libya ly iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.205.232.0-82.205.232.255 -j LOG --log-level debug --log-prefix "as_ALRIYADHA-ly: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.205.232.0-82.205.232.255 -j DROP; ############################ south africa ############################### # Netname: TELKOMNET-B4 # Telkom SA Limited - Pretoria ZA (South Africa) iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 165.146.0.0-165.146.255.255 -j LOG --log-level debug --log-prefix "as_TELKOMNET-B4-za: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 165.146.0.0-165.146.255.255 -j DROP; # 89.4.0.0-89.4.63.255 # Netname: NESMA ADMIN RIPE # National Engineering Services and Marketing Company Ltd. NESMA - Internet Services P.O. Box 300940, Riyadh 11372 - KSA iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 89.4.0.0-89.4.63.255 -j LOG --log-level debug --log-prefix "as_NESMA-sa: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 89.4.0.0-89.4.63.255 -j DROP; #################### africa proper ###################################### # Netname: 196.206.0.0-196.206.255.255 ORG-AFNC1-RIPE AFRINIC-NET-TRANSFERRED-20050223 # IAM ADSL subscriber - Rabat and north morocoo MA (Morocco) iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 196.206.0.0-196.206.255.255 -j LOG --log-level debug --log-prefix "as_ORG-AFNC1-RIPE-ma: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 196.206.0.0-196.206.255.255 -j DROP; # Netname: AFRINIC-NET-TRANSFERRED-20050223 # ORG-AFNC1-RIPE # 82.151.64.0-82.151.95.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.151.64.0-82.151.95.255 -j LOG --log-level debug --log-prefix "as_AFRINIC-NET-af: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.151.64.0-82.151.95.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 196.201.64.0-196.201.95.255 -j LOG --log-level debug --log-prefix "as_AFRINIC-NET-af: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 196.201.64.0-196.201.95.255 -j DROP; # Netname: Bloom-Business-Bereau # Lagos, Nigeria iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.194.157.160-217.194.157.167 -j LOG --log-level debug --log-prefix "as_lagos_ng: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.194.157.160-217.194.157.167 -j DROP; ######################################################################### ######################### SOUTH AMERICA & MEXICO ####################### ######################################################################### ##################### mexico ###################### # Netname: Reasignacion UniNet # Mexico iptables -A INPUT -p tcp --dport 25 -s 200.67.239.0/24 -j LOG --log-level debug --log-prefix "as_UniNet_mx: "; iptables -A INPUT -p tcp --dport 25 -s 200.67.239.0/24 -j DROP; #200.57.198/24 # AVANTEL MX-AVAN4-LACNIC INSURGENTES ESQ. FRAY SERVANDO CULIACAN, SL 80000 MX iptables -A INPUT -p tcp --dport 25 -s 200.57.198.0/24 -j LOG --log-level debug --log-prefix "as_AVANTEL_mx: "; iptables -A INPUT -p tcp --dport 25 -s 200.57.198.0/24 -j DROP; # Netname: MX-REUN-LACNIC # Reasignacion UniNet - Periferico Sur, Mexico iptables -A INPUT -p tcp --dport 25 -s 201.128.226.0/24 -j LOG --log-level debug --log-prefix "as_MX-REUN-LACNIC_mx: "; iptables -A INPUT -p tcp --dport 25 -s 201.128.226.0/24 -j DROP; # 201.152.0.0/14 iptables -A INPUT -p tcp --dport 25 -s 201.152.0.0/14 -j LOG --log-level debug --log-prefix "as_MX-USCV4-LACNIC_mx: "; iptables -A INPUT -p tcp --dport 25 -s 201.152.0.0/14 -j DROP; # 189.128.0.0/11 iptables -A INPUT -p tcp --dport 25 -s 189.128.0.0/11 -j LOG --log-level debug --log-prefix "as_MX-USCV4-LACNIC_mx: "; iptables -A INPUT -p tcp --dport 25 -s 189.128.0.0/11 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 148.228.0.0/16 -j LOG --log-level debug --log-prefix "ssh-block_MX-REUN-LACNIC_mx: "; iptables -A INPUT -p tcp --dport 25 -s 148.228.0.0/16 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.25.176.0/20 -j LOG --log-level debug --log-prefix "ssh-block_MX-REUN-LACNIC_mx: "; iptables -A INPUT -p tcp --dport 25 -s 200.25.176.0/20 -j DROP; # Netname: MX-TNSC1-LACNIC # Luis Rodolfo Nevarez Garcia - Pio Pico, 2101, 22000 - Tijuana - BC MX iptables -A INPUT -p tcp --dport 25 -s 200.79.128.0/19 -j LOG --log-level debug --log-prefix "as_MX-TNSC1-LACNIC_mx: "; iptables -A INPUT -p tcp --dport 25 -s 200.79.128.0/19 -j DROP; ################### argentina ##################### # Netname: AR-BSAB-LACNIC 200.112.128.0-200.112.159.255 # Broadbandtech S. A. Fernando G. Escobar Olga Cossenttini, 731, Piso 3 C1107VBA - Buenos Aires - AR iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 200.112.128.0-200.112.159.255 -j LOG --log-level debug --log-prefix "as_AR-BSAB-LACNIC-ar: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 200.112.128.0-200.112.159.255 -j DROP; # 190.49.0.0/16 iptables -A INPUT -p tcp --dport 25 -s 190.49.0.0/16 -j LOG --log-level debug --log-prefix "as_LACNIC_ar: "; iptables -A INPUT -p tcp --dport 25 -s 190.49.0.0/16 -j DROP; # 190.48.0.0/16 iptables -A INPUT -p tcp --dport 25 -s 190.48.0.0/16 -j LOG --log-level debug --log-prefix "as_LACNIC_ar: "; iptables -A INPUT -p tcp --dport 25 -s 190.48.0.0/16 -j DROP; # Netname: AR-CASA10-LACNIC 24.232.0.00-24.232.255.255 # CABLEVISION S.A. - Munro - BA, Argentina iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 24.232.0.00-24.232.255.255 -j LOG --log-level debug --log-prefix "as_AR-BSAB-LACNIC-ar: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 24.232.0.00-24.232.255.255 -j DROP; # 201.235.0.0-201.235.127.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 201.235.0.0-201.235.127.255 -j LOG --log-level debug --log-prefix "as_AR-BSAB-LACNIC-ar: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 201.235.0.0-201.235.127.255 -j DROP; # 200.42.0.0-200.42.127.255 Prima S.A. AR-PRSA-LACNIC # Miguel Fernandez La Rioja, 301, C1214ADG - Buenos Aires - AR iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 200.42.0.0-200.42.127.255 -j LOG --log-level debug --log-prefix "as_AR-PRSA-LACNIC-ar: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 200.42.0.0-200.42.127.255 -j DROP; # Netname: AR-MTSR-LACNIC 200.59.128.0-200.59.159.255 # METRORED TELECOMUNICACIONES S.R.L. - Buenos Aires, Argentina iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 200.59.128.0-200.59.159.255 -j LOG --log-level debug --log-prefix "as_AR-MTSR-LACNIC-ar: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 200.59.128.0-200.59.159.255 -j DROP; # Netname: AR-PRSA-LACNIC 200.122.0.0-200.122.31.255 # Prima S.A. Miguel Fernandez - La Rioja, 301, C1214ADG - Buenos Aires - AR iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 200.122.0.0-200.122.31.255 -j LOG --log-level debug --log-prefix "as_AR-PRSA-LACNIC-ar: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 200.122.0.0-200.122.31.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 200.122.32.0-200.122.63.255 -j LOG --log-level debug --log-prefix "as_AR-PRSA-LACNIC-ar: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 200.122.32.0-200.122.63.255 -j DROP; # Netname: AR-SISA7-LACNIC # UOL Sinectis S.A. Florida, 537, Piso 6 C1005AAK - BuenosAires - AR iptables -A INPUT -p tcp --dport 25 -s 200.59.112.0/20 -j LOG --log-level debug --log-prefix "as_AR-SISA7-LACNIC-ar: "; iptables -A INPUT -p tcp --dport 25 -s 200.59.112.0/20 -j DROP; # Netname: AR-TEAR7-LACNIC # Telefonica de Argentina Ferreira Teixeira AV. ING. HUERGO - OBS. JUDICIALES, 723, 1065 - Buenos Aires - CF AR iptables -A INPUT -p tcp --dport 25 -s 201.254.0.0/16 -j LOG --log-level debug --log-prefix "as_AR-TEAR7-LACNIC-ar: "; iptables -A INPUT -p tcp --dport 25 -s 201.254.0.0/16 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 201.255.128.0/17 -j LOG --log-level debug --log-prefix "as_AR-TEAR7-LACNIC-ar: "; iptables -A INPUT -p tcp --dport 25 -s 201.255.128.0/17 -j DROP; #################### Columbia ##################### # Netname: CO-ETBE-LACNIC # Coordinacion de Redes Internet Calle 22 F, 39, 16 9999 - Bogota - Cu CO iptables -A INPUT -p tcp --dport 25 -s 201.245.0.0/16 -j LOG --log-level debug --log-prefix "as_CO-ETBE-LACNIC-co: "; iptables -A INPUT -p tcp --dport 25 -s 201.245.0.0/16 -j DROP; # 200.6.176.0/20 iptables -A INPUT -p tcp --dport 25 -s 200.6.176.0/20 -j LOG --log-level debug --log-prefix "as_CO-COSA20-LACNIC-co: "; iptables -A INPUT -p tcp --dport 25 -s 200.6.176.0/20 -j DROP; # 200.6.78.0/24 iptables -A INPUT -p tcp --dport 25 -s 200.6.78.0/24 -j LOG --log-level debug --log-prefix "as_CL-SOSA-LACNIC-co: "; iptables -A INPUT -p tcp --dport 25 -s 200.6.78.0/24 -j DROP; # 201.228.0.0/17 iptables -A INPUT -p tcp --dport 25 -s 201.228.0.0/17 -j LOG --log-level debug --log-prefix "as_CO-CTSE-LACNIC-co: "; iptables -A INPUT -p tcp --dport 25 -s 201.228.0.0/17 -j DROP; # 201.244.0.0/16 iptables -A INPUT -p tcp --dport 25 -s 201.244.0.0/16 -j LOG --log-level debug --log-prefix "as_CO-ETBE-LACNIC-co: "; iptables -A INPUT -p tcp --dport 25 -s 201.244.0.0/16 -j DROP; # 201.232.0.0/17 iptables -A INPUT -p tcp --dport 25 -s 201.232.0.0/17 -j LOG --log-level debug --log-prefix "as_CO-ETBE-LACNIC-co: "; iptables -A INPUT -p tcp --dport 25 -s 201.232.0.0/17 -j DROP; # Netname: CO-TCSD-LACNIC # Network Security Team Carrera 11A No. 94-76, 0, 0 0 - Bogotá - DC CO iptables -A INPUT -p tcp --dport 25 -s 200.118.32.0/19 -j LOG --log-level debug --log-prefix "as_CO-TCSD-LACNIC-co: "; iptables -A INPUT -p tcp --dport 25 -s 200.118.32.0/19 -j DROP; ####################### Dominican Republic ##################### # 66.98.0.0-66.98.95.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 66.98.0.0-66.98.95.255 -j LOG --log-level debug --log-prefix "as_LACNIC-do: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 66.98.0.0-66.98.95.255 -j DROP; #################### peru ######################### # 201.230.233.0/25 PE-PETD7-LACNIC # Telefonica del Peru Av. San Felipe 1144 Surquillo, 1144, Edi A 34 - Lima - PE iptables -A INPUT -p tcp --dport 25 -s 201.230.233.0/25 -j LOG --log-level debug --log-prefix "as_PE-PETD7-LACNIC-pe: "; iptables -A INPUT -p tcp --dport 25 -s 201.230.233.0/25 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 200.121.20.0-200.121.24.127 -j LOG --log-level debug --log-prefix "as_PE-PETD7-LACNIC-pe: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 200.121.20.0-200.121.24.127 -j DROP; # Netname: PE-TDPERX12-LACNIC - PE-PETD16-LACNIC # TELEFONICA DEL PERU - Lima, Peru iptables -A INPUT -p tcp --dport 25 -s 201.230.120.0/25 -j LOG --log-level debug --log-prefix "as_PE-TDPERX12-pe: "; iptables -A INPUT -p tcp --dport 25 -s 201.230.120.0/25 -j DROP; # Netname: 201.230.11.0/25 PE-PETD14-LACNIC # TELEFONICA DEL PERU SAN FELIPE, 1144, SURQUILLO 34 - LIMA - PE iptables -A INPUT -p tcp --dport 25 -s 201.230.11.0/25 -j LOG --log-level debug --log-prefix "as_PE-PETD14-LACNIC-pe: "; iptables -A INPUT -p tcp --dport 25 -s 201.230.11.0/25 -j DROP; ###################### chile ###################### # 190.46.0.0/15 iptables -A INPUT -p tcp --dport 25 -s 190.46.0.0/15 -j LOG --log-level debug --log-prefix "anti-spam-chile: "; iptables -A INPUT -p tcp --dport 25 -s 190.46.0.0/15 -j DROP; # Netname: # Chile iptables -A INPUT -p tcp --dport 25 -s 200.72.0.0/17 -j LOG --log-level debug --log-prefix "anti-spam-chile: "; iptables -A INPUT -p tcp --dport 25 -s 200.72.0.0/17 -j DROP; # Netname: CL-TSSA-LACNIC # Telefonica del Sur S.A. - Valdivia - CL iptables -A INPUT -p tcp --dport 25 -s 216.155.64.0/19 -j LOG --log-level debug --log-prefix "anti-spam-chile: "; iptables -A INPUT -p tcp --dport 25 -s 216.155.64.0/19 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 201.220.112.0/20 -j LOG --log-level debug --log-prefix "anti-spam-chile: "; iptables -A INPUT -p tcp --dport 25 -s 201.220.112.0/20 -j DROP; #iptables -A INPUT -p tcp --dport 25 -s -j LOG --log-level debug --log-prefix "anti-spam-chile: "; #iptables -A INPUT -p tcp --dport 25 -s -j DROP; # Netname: CL-TNCS-LACNIC # Terra Networks Chile S.A. CL-TNCS-LACNIC Avda. Vitacura, 2736, Piso 2 1 - Santiago - RM, CL iptables -A INPUT -p tcp --dport 25 -s 200.28.0.0/16 -j LOG --log-level debug --log-prefix "as_CL-TNCS-LACNIC-cl: "; iptables -A INPUT -p tcp --dport 25 -s 200.28.0.0/16 -j DROP; # 200.114.0.0/20 iptables -A INPUT -p tcp --dport 25 -s 200.114.0.0/20 -j LOG --log-level debug --log-prefix "as_CL-TCBU-LACNIC-co: "; iptables -A INPUT -p tcp --dport 25 -s 200.114.0.0/20 -j DROP; ################### BRAZIL ######################## # 143.106.0.0/16 iptables -A INPUT -p tcp --dport 25 -s 143.106.0.0/16 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 143.106.0.0/16 -j DROP; # Netname: # 200.103/16 iptables -A INPUT -p tcp --dport 25 -s 200.103.0.0/16 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.103.0.0/16 -j DROP; # Netname: AS4230 # NET Serviços de Comunicação S.A. - Lauro Fernando Costa Barbosa - Rua Verbo Divino, 1356, 04719-002 - São Paulo - SP BR iptables -A INPUT -p tcp --dport 25 -s 200.217.0.0/16 -j LOG --log-level debug --log-prefix "as_AS4230-br: "; iptables -A INPUT -p tcp --dport 25 -s 200.217.0.0/16 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.179.192.0/18 -j LOG --log-level debug --log-prefix "as_AS4230-br: "; iptables -A INPUT -p tcp --dport 25 -s 200.179.192.0/18 -j DROP; # Netname: AS4230 # NET Serviços de Comunicação S.A. - Lauro Fernando Costa Barbosa - Rua Verbo Divino, 1356, 04719-002 - São Paulo - SP BR iptables -A INPUT -p tcp --dport 25 -s 200.179.192.0/18 -j LOG --log-level debug --log-prefix "as_AS4230-br: "; iptables -A INPUT -p tcp --dport 25 -s 200.179.192.0/18 -j DROP; # Netname: AS7738 # Telemar Norte Leste S.A. 002.558.134/0001-58 Rua Humberto de Campos, 425, 7 andar 22430-190 - Rio de Janeiro - RJ, BR iptables -A INPUT -p tcp --dport 25 -s 201.4.0.0/16 -j LOG --log-level debug --log-prefix "as_AS7738-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.4.0.0/16 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 201.5.0.0/16 -j LOG --log-level debug --log-prefix "as_AS7738-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.5.0.0/16 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 201.8.0.0/16 -j LOG --log-level debug --log-prefix "as_AS7738-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.8.0.0/16 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 201.9.0.0/16 -j LOG --log-level debug --log-prefix "as_AS7738-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.9.0.0/16 -j DROP; # 201.50.0.0/15 iptables -A INPUT -p tcp --dport 25 -s 201.50.0.0/15 -j LOG --log-level debug --log-prefix "as_AS7738-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.50.0.0/15 -j DROP; # 201.32.0.0/16 iptables -A INPUT -p tcp --dport 25 -s 201.32.0.0/16 -j LOG --log-level debug --log-prefix "as_AS7738-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.32.0.0/16 -j DROP; # 201.34.0.0/16 # Netname: AS8167 Brasil Telecom S/A - Filial Distrito Federal 076.535.764/0326-90 Brasil Telecom S. A. - CNRS iptables -A INPUT -p tcp --dport 25 -s 201.34.0.0/16 -j LOG --log-level debug --log-prefix "as_AS8167-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.34.0.0/16 -j DROP; # 201.36.0.0/16 # AS17379 Intelig Telecomunica�es Ltda. 002.421.421/0001-11 # Engenharia de Redes Intelig Praia de Botafogo, 370, 2o. andar 22250-900 - Rio de Janeiro - RJ iptables -A INPUT -p tcp --dport 25 -s 201.36.0.0/16 -j LOG --log-level debug --log-prefix "as_AS17379-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.36.0.0/16 -j DROP; # Netname: AS27699 TELECOMUNICACOES DE SAO PAULO S.A. # TELESP Rua Martiniano de Carvalho, 851, 01321-001 - Sao Paulo - SP, BR iptables -A INPUT -p tcp --dport 25 -s 201.0.0.0/16 -j LOG --log-level debug --log-prefix "as_AS27699v-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.0.0.0/16 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 201.42.0.0-201.43.255.255 -j LOG --log-level debug --log-prefix "as_AR-PRSA-LACNIC-ar: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 201.42.0.0-201.43.255.255 -j DROP; # 201.68.0.0/15 iptables -A INPUT -p tcp --dport 25 -s 201.68.0.0/15 -j LOG --log-level debug --log-prefix "as_AS27699-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.68.0.0/15 -j DROP; # 201.78.0.0/15 iptables -A INPUT -p tcp --dport 25 -s 201.78.0.0/15 -j LOG --log-level debug --log-prefix "as_AS7738-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.78.0.0/15 -j DROP; # Netname: AS27699 # TELECOMUNICACOES DE SAO PAULO S.A. - TELESP - Sao Paulo - SP, Brazil iptables -A INPUT -p tcp --dport 25 -s 201.207.0.0/16 -j LOG --log-level debug --log-prefix "as_AS27699v-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.207.0.0/16 -j DROP; # Netname: AS28573 # NET Serviços de Comunicação S.A. 000.065.376/0002-65 Lauro Fernando Costa Barbosa Rua Verbo Divino, 1356, 04719-002 - São Paulo - SP iptables -A INPUT -p tcp --dport 25 -s 201.6.0.0/16 -j LOG --log-level debug --log-prefix "as_AS28573-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.6.0.0/16 -j DROP; # 201.66.0.0/15 AS8167 iptables -A INPUT -p tcp --dport 25 -s 201.66.0.0/15 -j LOG --log-level debug --log-prefix "as_AS81673-br: "; iptables -A INPUT -p tcp --dport 25 -s 201.66.0.0/15 -j DROP; # Netmame: AS8167 # Brasil Telecom S/A - iptables -A INPUT -p tcp --dport 25 -s 200.199.192.0/18 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.192.0/18 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.193.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.193.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.194.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.194.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.196.0/23 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.196.0/23 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.198.0/23 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.198.0/23 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.200.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.200.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.201.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.201.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.202.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.202.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.203.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.203.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.205.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.205.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.206.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.206.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.210.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.210.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.220.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.220.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.224.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.224.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.225.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.225.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.226.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.226.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.227.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.227.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.228.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.228.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.229.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.229.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.230.0/23 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.230.0/23 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.232.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.232.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.237.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.237.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.238.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.238.0/24 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.199.239.0/24 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.199.239.0/24 -j DROP; # 200.96/16 iptables -A INPUT -p tcp --dport 25 -s 200.96.0.0/16 -j LOG --log-level debug --log-prefix "anti-spam-brazil: "; iptables -A INPUT -p tcp --dport 25 -s 200.96.0.0/16 -j DROP; ########################## chili ######################### iptables -A INPUT -p tcp --dport 25 -s 200.0.0.0/21 -j LOG --log-level debug --log-prefix "as_LACNIC-cl: "; iptables -A INPUT -p tcp --dport 25 -s 200.0.0.0/21 -j DROP; # Netname: CL-TEEM-LACNIC # Rodrigo Chacon Providencia, 119, Piso 8 00 - Santiago - CL #iptables -A INPUT -p tcp --dport 25 -s 200.113.96.0/19 -j LOG --log-level debug --log-prefix "as_CL-TEEM-LACNIC-cl: "; #iptables -A INPUT -p tcp --dport 25 -s 200.113.96.0/19 -j DROP; # 200.90.192.0/20 #iptables -A INPUT -p tcp --dport 25 -s 200.90.192.0/20 -j LOG --log-level debug --log-prefix "as_CL-TEEM-LACNIC-cl: "; #iptables -A INPUT -p tcp --dport 25 -s 200.90.192.0/20 -j DROP; #iptables -A INPUT -p tcp --dport 25 -s 200.91.0.0/19 -j LOG --log-level debug --log-prefix "as_CL-TEEM-LACNIC-cl: "; #iptables -A INPUT -p tcp --dport 25 -s 200.91.0.0/19 -j DROP; #iptables -A INPUT -p tcp --dport 25 -s 200.92.0.0/17 -j LOG --log-level debug --log-prefix "as_CL-TEEM-LACNIC-cl: "; #iptables -A INPUT -p tcp --dport 25 -s 200.92.0.0/17 -j DROP; #iptables -A INPUT -p tcp --dport 25 -s 200.93.0.0/18 -j LOG --log-level debug --log-prefix "as_CL-TEEM-LACNIC-cl: "; #iptables -A INPUT -p tcp --dport 25 -s 200.93.0.0/18 -j DROP; #iptables -A INPUT -p tcp --dport 25 -s 200.94.0.0/17 -j LOG --log-level debug --log-prefix "as_CL-TEEM-LACNIC-cl: "; #iptables -A INPUT -p tcp --dport 25 -s 200.94.0.0/17 -j DROP; #iptables -A INPUT -p tcp --dport 25 -s 200.95.0.0/24 -j LOG --log-level debug --log-prefix "as_CL-TEEM-LACNIC-cl: "; #iptables -A INPUT -p tcp --dport 25 -s 200.95.0.0/24 -j DROP; ################### uruguay ####################### # Netname: UY-ANTA-LACNIC # ANTELDATA ANTEL URUGUAY iptables -A INPUT -p tcp --dport 25 -s 200.125.16.0/20 -j LOG --log-level debug --log-prefix "as_UY-ANTA-LACNIC-uy: "; iptables -A INPUT -p tcp --dport 25 -s 200.125.16.0/20 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 200.40.0.0/17 -j LOG --log-level debug --log-prefix "ssh_UY-ANTA-LACNIC-uy: "; iptables -A INPUT -p tcp --dport 25 -s 200.40.0.0/17 -j DROP; ########################################################################## ############################# CARRIBEAN ################################## ########################################################################## ############################### trinidad ################################# # Netname: TT-TSOT1 # Telecommunication Services of Trinidad and Tobago Ronald Mohammed 1 Edward Street, 1, 00000 - Port of Spain - TT iptables -A INPUT -p tcp --dport 25 -s 201.238.64.0/18 -j LOG --log-level debug --log-prefix "as_TT-TSOT1-tt: "; iptables -A INPUT -p tcp --dport 25 -s 201.238.64.0/18 -j DROP; ########################################################################## ################################ EUROPE ################################## ########################################################################## ####################### austria ######################## # Netname: 83.218.160.0-83.218.191.255 AT-MYNET-20040317 # PROVIDER Local Registry myNet Internet Solutions AT iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.218.160.0-83.218.191.255 -j LOG --log-level debug --log-prefix "as_AT-MYNET-20040317-at: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.218.160.0-83.218.191.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.218.160.0-83.218.191.255 -j LOG --log-level debug --log-prefix "as_AT-MYNET-20040317-at: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.218.160.0-83.218.191.255 -j DROP; # 80.121.44.0-80.121.127.255 TA-HIGHWAY-SPEED # Highway Customers Telekom Austria Aktiengesellschaft AT iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.121.44.0-80.121.127.255 -j LOG --log-level debug --log-prefix "as_TA-HIGHWAY-SPEED-at: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.121.44.0-80.121.127.255 -j DROP; ######################### belgium ####################### # Netname: TVCABLENET # ELECTRABEL Belgian Cable Modem ISP # Please report abuse to abuse@tvcablenet.be# BE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.201.64.0-85.201.95.255 -j LOG --log-level debug --log-prefix "as_TVCABLENET-be: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.201.64.0-85.201.95.255 -j DROP; # Netname: BE-BRUTELE-20050318 # Brutele SC BE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.27.0.0-85.27.127.255 -j LOG --log-level debug --log-prefix "as_BRUTELE-20050318-be: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.27.0.0-85.27.127.255 -j DROP; ###################### bulgaria ######################### # Netname: SETSERVICE-BG # 62.204.128.0-62.204.129.255 SETSERVICE-BG Set Service Ltd. BG iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.204.128.0-62.204.129.255 -j LOG --log-level debug --log-prefix "as_SETSERVICE-BG-bg "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.204.128.0-62.204.129.255 -j DROP; ####################### croatia ######################### # 83.131.48.0-83.131.63.255 T-HT # T-Com Croatia Internet network Croatian Telecom Inc., Zagreb, Croatia HR iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.131.48.0-83.131.63.255 -j LOG --log-level debug --log-prefix "as_T-HT-hr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.131.48.0-83.131.63.255 -j DROP; #################### Czech Republic ##################### # Netname: NOVERA # IPv4 block for Novera JSC CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.59.208.0-86.59.211.255 -j LOG --log-level debug --log-prefix "as_NOVERA-cz: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.59.208.0-86.59.211.255 -j DROP; # Netname: OTHOR # Prague 4, Czech Republic Durychova, 27 Othor JSC CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.59.0.0-87.255.255.255 -j LOG --log-level debug --log-prefix "as_OTHOR-cz: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.59.0.0-87.255.255.255 -j DROP; #iptables -A INPUT -p tcp --dport 25 -m iprange --src-range -j LOG --log-level debug --log-prefix "as_-cz: "; #iptables -A INPUT -p tcp --dport 25 -m iprange --src-range -j DROP; ######################### england ####################### # Netname: OPAL-DSL # Opal Telecom DSL Network - Manchester United Kingdom iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.13.128.0-84.13.159.255 -j LOG --log-level debug --log-prefix "as_OPAL-DSL-uk: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.13.128.0-84.13.159.255 -j DROP; # Netname: UK-EENET-HASTINGS # Exponential-e Ltd - London, England iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.244.130.0-83.244.130.255 -j LOG --log-level debug --log-prefix "as_UK-HASTINGS-uk: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.244.130.0-83.244.130.255 -j DROP; # Netname: PH-NETWORK-VASERV # Maidenhead, UK iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.234.133.0-85.234.133.255 -j LOG --log-level debug --log-prefix "ssh-blk_uk: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.234.133.0-85.234.133.255 -j DROP; # Netname: 82.41.0.0-82.41.255.255 TELEWEST-HSD_1-EDINBURGH # Telewest HSD Platform GB iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.41.0.0-82.41.255.255 -j LOG --log-level debug --log-prefix "as_HSD_1-EDINBURGH-uk: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.41.0.0-82.41.255.255 -j DROP; # Netname: 82.35.0.0-82.35.255.255 TELEWEST-HSD_1-HARRINGEY # Telewest HSD Platform GB iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.35.0.0-82.35.255.255 -j LOG --log-level debug --log-prefix "as_HSD_1-HARRINGEY-uk: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.35.0.0-82.35.255.255 -j DROP; # Netname: UK2-NET # UK2.NET - UK's biggest host GB iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.170.64.0-83.170.79.255 -j LOG --log-level debug --log-prefix "ssh-UK2-NET_uk: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.170.64.0-83.170.79.255 -j DROP; # Netname: 88.104.0.0-88.107.255.255 DSL-TISCALI-UK # Tiscali UK Ltd Milton Keynes Dynamic DSL GB iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.104.0.0-88.107.255.255 -j LOG --log-level debug --log-prefix "ssh-DSL-TISCALI-UK_gb: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.104.0.0-88.107.255.255 -j DROP; ######################## france ######################### # Netname: FR-PROXAD-ADSL # Proxad / Free SAS Dynamic pool (IP/ADSL) NCC#2005090519 FR iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.248.0.0-82.255.255.255 -j LOG --log-level debug --log-prefix "as_FR-PROXAD-ADSL-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.248.0.0-82.255.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.243.84.0-82.243.87.255 -j LOG --log-level debug --log-prefix "as_FR-PROXAD-ADSL-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.243.84.0-82.243.87.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.64.115.0-82.64.255.255 -j LOG --log-level debug --log-prefix "as_FR-PROXAD-ADSL-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.64.115.0-82.64.255.255 -j DROP; # Netname: MAIL-ESSENTIALS-WANADOO Projet Mail Essentials FR # 193.252.22.0-193.252.22.31 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 193.252.22.0-193.252.22.31 -j LOG --log-level debug --log-prefix "as_WANNADO-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 193.252.22.0-193.252.22.31 -j DROP; # Netname: T-ONLINEFRANCE # Servers at InterXion - Paris, France iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.158.104.0-194.158.107.255 -j LOG --log-level debug --log-prefix "as_T-ONLINEFRANCE-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.158.104.0-194.158.107.255 -j DROP; # 195.132.0.0-195.132.255.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 195.132.0.0-195.132.255.255 -j LOG --log-level debug --log-prefix "as_FR-CYBERCABLE-960620-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 195.132.0.0-195.132.255.255 -j DROP; # Netname: N9UF-DYN-DSL # Boulogne Billancourt, France iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.97.0.0-84.103.231.255 -j LOG --log-level debug --log-prefix "intruder_N9UF-DYN-DSL-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.97.0.0-84.103.231.255 -j DROP; # Netname: IP2000-ADSL-BAS # BSMAR253 Marseille Bloc 2 - WANADOO FRANCE 48 rue Camille Desmoulins, FR iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.8.191.0-80.8.191.255 -j LOG --log-level debug --log-prefix "intr-ftp_IP2000-ADSL-BAS-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.8.191.0-80.8.191.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.120.58.0-82.120.58.255 -j LOG --log-level debug --log-prefix "intr-ftp_IP2000-ADSL-BAS-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.120.58.0-82.120.58.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.123.157.0-82.123.157.255 -j LOG --log-level debug --log-prefix "intr-ftp_IP2000-ADSL-BAS-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.123.157.0-82.123.157.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.205.221.0-83.205.221.255 -j LOG --log-level debug --log-prefix "intr-ftp_IP2000-ADSL-BAS-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.205.221.0-83.205.221.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.195.180.0-86.195.180.255 -j LOG --log-level debug --log-prefix "as_IP2000-ADSL-BAS-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.195.180.0-86.195.180.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.115.115.0-83.115.115.255 -j LOG --log-level debug --log-prefix "as_IP2000-ADSL-BAS-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.115.115.0-83.115.115.255 -j DROP; # Netname: TIF-200401 # Telecom Italia France Broadband Pools FR iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.152.0.0-83.155.255.255 -j LOG --log-level debug --log-prefix "asshole_TIF-200401-fr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.152.0.0-83.155.255.255 -j DROP; ######################### germany ###################### # 62.104.104.0-62.104.127.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.104.0.0-62.104.255.255 -j LOG --log-level debug --log-prefix "as_STRATO-POOL-NET-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.104.0.0-62.104.255.255 -j DROP; # Netname: GMX-NET # D-80992 Muenchen Germany iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.165.64.0-213.165.66.127 -j LOG --log-level debug --log-prefix "as_GMX-NET-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.165.64.0-213.165.66.127 -j DROP; # 217.224.0.0-217.237.161.47 DTAG-DIAL15 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.224.0.0-217.237.161.47 -j LOG --log-level debug --log-prefix "as_DTAG-DIAL15-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.224.0.0-217.237.161.47 -j DROP; # Netname: ARCOR-DSL-NET12 # ARCOR AG - Germany iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.82.169.0-82.83.255.255 -j LOG --log-level debug --log-prefix "as_ARCOR-DSL-NET12-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.82.169.0-82.83.255.255 -j DROP; # Netname: 84.57.113.0-84.61.96.255 ARCOR-DSL-NET13 # ARCOR AG Alfred-Herrhausen-Allee 1 D-65760 Eschborn DE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.57.113.0-84.61.96.255 -j LOG --log-level debug --log-prefix "as_ARCOR-DSL-NET13-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.57.113.0-84.61.96.255 -j DROP; # Netname: ARCOR-DSL-NET14 # ARCOR AG - Germany iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.61.97.0-84.63.127.255 -j LOG --log-level debug --log-prefix "intruder_ARCOR-DSL-NET12-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.61.97.0-84.63.127.255 -j DROP; # Netname: DTAG-DIAL16 # Nuernberg, Germany iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.128.0.0-80.146.159.255 -j LOG --log-level debug --log-prefix "intruder_DTAG-DIAL16-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.128.0.0-80.146.159.255 -j DROP; # Netname: DTAG-DIAL17 # Deutsche Telekom AG - Nuernberg Germany iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.246.0.0-217.255.255.255 -j LOG --log-level debug --log-prefix "as_DTAG-DIAL17-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.246.0.0-217.255.255.255 -j DROP; # Netname: DTAG-DIAL20 # Deutsche Telekom AG - Nuernberg Germany iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.136.0.0-84.191.255.255 -j LOG --log-level debug --log-prefix "as_DTAG-DIAL20-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.136.0.0-84.191.255.255 -j DROP; # Netname: 80.184.0.0-80.184.255.255 FREENET-POOL-NET # freenet Cityline GmbH Millstaetterstrasse 13 40549 Duesseldorf Germany DE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.184.0.0-80.184.255.255 -j LOG --log-level debug --log-prefix "as_FREENET-POOL-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.184.0.0-80.184.255.255 -j DROP; # Netname: 85.176.0.0-85.182.127.255 HANSENET-ADSL # ALICE DSL HanseNet Telekommunikation GmbH ADSL Pool Customers DE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.176.0.0-85.182.127.255 -j LOG --log-level debug --log-prefix "as_HANSENET-ADSL-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.176.0.0-85.182.127.255 -j DROP; # 85.216.0.0-85.216.113.255 KABELBW-03 Kabel Baden-Wuerttemberg GmbH & Co. KG DE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.216.0.0-85.216.113.255 -j LOG --log-level debug --log-prefix "as_KABELBW-03-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.216.0.0-85.216.113.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.39.128.0-213.39.166.255 -j LOG --log-level debug --log-prefix "as_HANSENET-ADSL-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.39.128.0-213.39.166.255 -j DROP; # Netname: 195.158.162.0-195.158.165.255 HOME-DYNAMIC-NET # QSC AG Dynamic IP Addresses DE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 195.158.162.0-195.158.165.255 -j LOG --log-level debug --log-prefix "as_HOME-DYNAMIC-NET-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 195.158.162.0-195.158.165.255 -j DROP; # Netname: KABEL-DEUTSCHLAND-CUSTOMER-SERVICES-7 # Kabel Deutschland Breitband Customer 7 DE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.134.0.0-88.134.63.255 -j LOG --log-level debug --log-prefix "as_KABEL-DEUTSCHLAND-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.134.0.0-88.134.63.255 -j DROP; # Netname: LYCOS-VDS-1 # Guetersloh, Germany iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.244.0.0-84.244.39.255 -j LOG --log-level debug --log-prefix "ssh-blk_LYCOS-VDS-1: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.244.0.0-84.244.39.255 -j DROP; # Netname: 85.8.118.0-85.8.122.255 OSNATEL-DSL-39 # osnatel-subnet for ADSL dial-up DE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.8.118.0-85.8.122.255 -j LOG --log-level debug --log-prefix "as_OSNATEL-DSL-39-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.8.118.0-85.8.122.255 -j DROP; # Netname: VT-DYNAMICPOOL # Versatel Deutschland Dynamic Pool DE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 87.122.0.0-87.122.63.255 -j LOG --log-level debug --log-prefix "intr_VT-DYNAMICPOOL-de: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 87.122.0.0-87.122.63.255 -j DROP; ####################### Ireland ######################## # Netname: 159.134.0.0-159.134.255.255 TELE-IRELAND # eircom Group plc Corporate network and public ISP infrastructure Dublin, Ireland IE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 159.134.0.0-159.134.255.255 -j LOG --log-level debug --log-prefix "as_TELE-IRELAND-ie: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 159.134.0.0-159.134.255.255 -j DROP; ######################### israel ####################### # Netname: 88.152.0.0-88.152.84.255 ADSL-CUSTOMER-CONNECTION SE-1 IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.152.0.0-88.152.84.255 -j LOG --log-level debug --log-prefix "as_ADSL-CUST-CONNECT-il: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.152.0.0-88.152.84.255 -j DROP; # 62.0.128.0-62.0.191.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.0.128.0-62.0.191.255 -j LOG --log-level debug --log-prefix "as_BB-HFA-il: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.0.128.0-62.0.191.255 -j DROP; # Netname: NV-BROADBAND-POPS # Netvision's BroadBand service - Omega Building MATAM industrial park Haifa 31905 Israel iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.132.0.0-217.132.127.255 -j LOG --log-level debug --log-prefix "as_NV-BROADBAND-POPS-il: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.132.0.0-217.132.127.255 -j DROP; # Netname: EURONET # IG Cables Costumers (Genie03) Internet Gold - LTD. Alexander Yanai 1 Petah-Tikva Israel iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.240.0-83.130.255.255 -j LOG --log-level debug --log-prefix "as_NV-BROADBAND-POPS-il: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.240.0-83.130.255.255 -j DROP; ######################### italy ######################## # Netname: PUGNO-ETTORE # Italy iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.210.167.176-212.210.167.183 -j LOG --log-level debug --log-prefix "as_PUGNO-ETTORE-it: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.210.167.176-212.210.167.183 -j DROP; # 151.37.0.0-151.37.255.255 IUNET-BNET37 # IUnet Via Lorenteggio 257 Milano, I-20100 IT iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 151.37.0.0-151.37.255.255 -j LOG --log-level debug --log-prefix "as_IUNET-BNET37-it: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 151.37.0.0-151.37.255.255 -j DROP; # Netname: TELECOM-ADSL-4 # Telecom Italia S.p.A. TIN EASY LITE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.50.0.0-82.51.255.255 -j LOG --log-level debug --log-prefix "anti-spam-it: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.50.0.0-82.51.255.255 -j DROP; # 82.52.0.0-82.55.255.255 TELECOM-ADSL-5 # Telecom Italia S.p.A. TIN EASY LITE IT iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.52.0.0-82.55.255.255 -j LOG --log-level debug --log-prefix "as_TELECOM-ADSL-5-it: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.52.0.0-82.55.255.255 -j DROP; # 212.216.172.0-212.216.177.255 TIN # Telecom Italia Net PROVIDER NOC Roma IT iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.216.172.0-212.216.177.255 -j LOG --log-level debug --log-prefix "as_TIN-it: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.216.172.0-212.216.177.255 -j DROP; # Netname: 84.222.0.0-84.223.255.255 TISCALINET # Tiscali SpA PROVIDER IT iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.222.0.0-84.223.255.255 -j LOG --log-level debug --log-prefix "as_TISCALINET-it: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.222.0.0-84.223.255.255 -j DROP; ###################### hungry ########################## # Netname: 81.182.228.0-81.182.229.255 DSL-POOL-114 # IPconnect ADSL clients (dynamic address pool) Hungarian Telecom contraced ISPs HU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.182.228.0-81.182.229.255 -j LOG --log-level debug --log-prefix "as_DSL-POOL-114-hu: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.182.228.0-81.182.229.255 -j DROP; # 85.66.120.0-85.66.120.255 HU-FIBERNET-040916 FiberNet Communication Co. Budapest HU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.66.120.0-85.66.120.255 -j LOG --log-level debug --log-prefix "as_HU-FIBERNET-040916-hu: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.66.120.0-85.66.120.255 -j DROP; ####################### lithuania ####################### # Netname: LIETUVOS-TELEKOMAS # Joint Stock Company Lietuvos Telekomas - Lithuanian Telecom IP NOC - Lithuania iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.206.72.0-85.206.107.255 -j LOG --log-level debug --log-prefix "as_LIETUVOS-lt: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.206.72.0-85.206.107.255 -j DROP; # 88.118.192.0-88.118.199.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.118.192.0-88.118.199.255 -j LOG --log-level debug --log-prefix "as_LIETUVOS-lt: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.118.192.0-88.118.199.255 -j DROP; # 88.118.217.0-88.118.222.255 LIETUVOS-TELEKOMAS iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.118.217.0-88.118.222.255 -j LOG --log-level debug --log-prefix "as_LIETUVOS-TELEKOMASS-lt: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.118.217.0-88.118.222.255 -j DROP; # 88.118.70.0-88.118.73.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.118.70.0-88.118.73.255 -j LOG --log-level debug --log-prefix "as_LIETUVOS-TELEKOMASS-lt: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.118.70.0-88.118.73.255 -j DROP; ###################### Moldavia ######################## # Netname: 83.218.192.0-83.218.223.255 MD-SUN-20040318 # JV "Sun Communications" S.R.L. MD iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.218.192.0-83.218.223.255 -j LOG --log-level debug --log-prefix "as_MD-SUN-20040318-md: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.218.192.0-83.218.223.255 -j DROP; #################### Netherlands ####################### # Netname: NL-VUURWERK # Vuurwerk Internet NL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.250.0.0-62.250.9.255 -j LOG --log-level debug --log-prefix "as_NL-VUURWERK-nl: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.250.0.0-62.250.9.255 -j DROP; # 82.151.32.0-82.151.63.255 ORG-KA13-RIPE NL-KABELTEX-20030903 Kabeltex PROVIDER Local Registry NL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.151.32.0-82.151.63.255 -j LOG --log-level debug --log-prefix "as_ORG-KA13-RIPE-nl: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.151.32.0-82.151.63.255 -j DROP; ####################### norway ######################### # Netname: TELE2-ADSL-DYNAMIC-BAPC1 # Tele2 Norge AS. Dynamic IP pool for BAP 0511 NO iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 193.217.252.0-193.217.252.255 -j LOG --log-level debug --log-prefix "as_TELE2-DYNAMIC-BAPC1-no: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 193.217.252.0-193.217.252.255 -j DROP; # 85.166.0.0-85.166.255.255 NO-TELENOR-DSL-3 Telenor Business Solutions AS NO iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.166.0.0-85.166.255.255 -j LOG --log-level debug --log-prefix "as_NO-TELENOR-DSL-3-no: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.166.0.0-85.166.255.255 -j DROP; ######################### poland ######################## # Netname: INTERIA-PL # INTERIA.PL os. Teatralne 9A 31-636 Krakow PL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.48.65.0-80.48.65.255 -j LOG --log-level debug --log-prefix "as_INTERIA-PL-pl: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.48.65.0-80.48.65.255 -j DROP; # 83.26.0.0-83.26.255.255 NEOSTRADA-ADSL Neostrada Plus Lodz PL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.26.0.0-83.26.255.255 -j LOG --log-level debug --log-prefix "as_NEOSTRADA-ADSL-pl: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.26.0.0-83.26.255.255 -j DROP; # Netname: NEOSTRADA-ADSL # Neostrada Plus - Krakow Poland iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.27.0.0-83.27.255.255 -j LOG --log-level debug --log-prefix "as_NEOSTRADA-pl: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.27.0.0-83.27.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.29.0.0-83.29.255.255 -j LOG --log-level debug --log-prefix "as_NEOSTRADA-pl: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.29.0.0-83.29.255.255 -j DROP; # Netname: NEOSTRADA # Neostrada Plus - Warszawa Poland iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.23.0.0-83.23.255.255 -j LOG --log-level debug --log-prefix "as_NEOSTRADA-pl: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.29.0.0-83.29.255.255 -j DROP; # PL-DIALOG # Dialog Internet Services Customer DSL Telefonia Dialog S.A. PL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.168.171.0-81.168.171.255 -j LOG --log-level debug --log-prefix "as_PL-DIALOG-pl: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.168.171.0-81.168.171.255 -j DROP; # Netname: WINIARSKICHORZW # CHORZOW, POLAND iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.55.226.48-80.55.226.51 -j LOG --log-level debug --log-prefix "as_CHORZOW-pl: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.55.226.48-80.55.226.51 -j DROP; # Netname: JOZEFKANET-PIEKARYSLASKIE # Jozefka.NET 41-943 Piekary Slaskie Perlowa 31 pl iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.17.150.128-213.17.150.159 -j LOG --log-level debug --log-prefix "ssh_PIEKARYSLASKIE-pl: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.17.150.128-213.17.150.159 -j DROP; ############################################## portugal ######################################### # 62.169.96.0-62.169.127.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.169.96.0-62.169.127.255 -j LOG --log-level debug --log-prefix "as_OPTIMUS-pt: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.169.96.0-62.169.127.255 -j DROP; # Netname: 81.84.20.0-81.84.21.255 TVCABO TVCABO-Portugal Cable Modem Network iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.84.20.0-81.84.21.255 -j LOG --log-level debug --log-prefix "as_TVCABO-Portugal-pt: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.84.20.0-81.84.21.255 -j DROP; # Netname: TELEPAC-DSL # Telepac - Comunicacoes Interactivas, SA Portugal iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.155.128.0-82.155.191.255 -j LOG --log-level debug --log-prefix "as_TELEPAC-DSL-pt: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.155.128.0-82.155.191.255 -j DROP; # Netname: TVCABO # TVCABO-Portugal Cable Modem Network PT iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.138.32.0-85.138.175.255 -j LOG --log-level debug --log-prefix "as_TVCABO-pt: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.138.32.0-85.138.175.255 -j DROP; # Netname: IP-NOVIS # NOVIS TELECOM, S.A. - Carnaxide, Portugal iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 87.196.0.0-87.196.127.255 -j LOG --log-level debug --log-prefix "as_IP-NOVIS-pt: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 87.196.0.0-87.196.127.255 -j DROP; # Netname: PT-TELEPAC-20050103 # PT.Com - Comunicacoes Interactivas, S.A. PT iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.240.0.0-85.247.255.255 -j LOG --log-level debug --log-prefix "as_PT-TELEPAC-20050103-pt: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.240.0.0-85.247.255.255 -j DROP; ###################### romania ########################## # Netname: RO-RDS-SV-RADAUTI-MBIT # Mbit Radauti Romania Data Systems NOC 71-75 Dr. Staicovici Bucharest / ROMANIA iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.77.10.0-82.77.10.255 -j LOG --log-level debug --log-prefix "as_RADAUTI-MBIT-ro: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.77.10.0-82.77.10.255 -j DROP; # Netname: ASTRALTC-NET # SC ASTRAL TELECOM SA str. Brincusi 147 Cluj-Napoca, 3400 Cluj, Romania RO iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.105.24.0-194.105.31.255 -j LOG --log-level debug --log-prefix "as_ASTRALTC-NET-ro: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.105.24.0-194.105.31.255 -j DROP; ######################### russia ######################### # Netname: # 213.33.254.0-213.33.254.255 SOVINTEL-BACKBONE-SpB-NET Interface networks - Spb. RU # 213.33.255.0-213.33.255.255 route: 213.33.240.0/20 # 82.179.234.0-82.179.234.255 INFOLINK-RU Infolink Technology Inc. RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.179.234.0-82.179.234.255 -j LOG --log-level debug --log-prefix "as_INFOLINK-RU-ru: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.179.234.0-82.179.234.255 -j DROP; # 84.54.237.0-84.54.238.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.54.237.0-84.54.238.255 -j LOG --log-level debug --log-prefix "as_RIPE-ru: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.54.237.0-84.54.238.255 -j DROP; # 89.110.0.0-89.110.31.255 iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 89.110.0.0-89.110.31.255 -j LOG --log-level debug --log-prefix "as_RU-SPBNIT-20060403-ru: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 89.110.0.0-89.110.31.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -s 213.33.240.0/20 -j LOG --log-level debug --log-prefix "ssh_SpB-NET-ru: "; iptables -A INPUT -p tcp --dport 25 -s 213.33.240.0/20 -j DROP; #iptables -A INPUT -p tcp --dport 25 -s -j LOG --log-level debug --log-prefix "ssh_SpB-NET-ru "; #iptables -A INPUT -p tcp --dport 25 -s s -j DROP; # Netname: 194.67.45.0-194.67.45.255 MAILRU-NET-3 # Mail.Ru Pushechnaya st., 2/6 103012, Moscow RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.67.45.0-194.67.45.255 -j LOG --log-level debug --log-prefix "as_MAILRU-NET-3-ru "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.67.45.0-194.67.45.255 -j DROP; # 194.67.57.0-194.67.57.255 MAILRU-NET2 Mail.ru Moscow, Russia RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.67.57.0-194.67.57.255 -j LOG --log-level debug --log-prefix "as_MAILRU-NET-3-ru "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.67.57.0-194.67.57.255 -j DROP; # 194.67.58.0-194.67.58.255 STNET58 Sovam Teleport Ufa, Russia RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.67.58.0-194.67.58.255 -j LOG --log-level debug --log-prefix "as_STNET58-ru "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.67.58.0-194.67.58.255 -j DROP; #iptables -A INPUT -p tcp --dport 25 -m iprange --src-range -j LOG --log-level debug --log-prefix "as_SpB-NET-ru "; #iptables -A INPUT -p tcp --dport 25 -m iprange --src-range -j DROP; ######################## spain ########################## # Netname: 80.36.0.0-80.39.255.255 RIMA iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.36.0.0-80.39.255.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.36.0.0-80.39.255.255 -j DROP; # 80.58.205.0-80.58.205.255 RIMA TELEFONICA DE ESPANA Provider Local Registry ES iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.58.205.0-80.58.205.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.58.205.0-80.58.205.255 -j DROP; # Netname: 81.202.0.0-81.202.255.255 ONO-SCOPES-1 # Cableuropa - ONO ONO net in whole Spain ES iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.202.0.0-81.202.255.255 -j LOG --log-level debug --log-prefix "as_ONO-SCOPES-1-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.202.0.0-81.202.255.255 -j DROP; # Netname: RIMA # TELEFONICA DE ESPANA - Spain iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.32.0.0-83.35.255.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.32.0.0-83.35.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.37.0.0-83.39.255.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.37.0.0-83.39.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.40.201.0-83.45.92.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.40.201.0-83.45.92.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.45.93.0-83.46.255.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.45.93.0-83.46.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.47.0.0-83.47.103.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.47.0.0-83.47.103.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.49.0.0-83.51.240.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.49.0.0-83.51.240.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.98.0.0-213.98.180.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.98.0.0-213.98.180.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.47.104.0-83.47.191.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.47.104.0-83.47.191.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.47.192.0-83.47.255.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.47.192.0-83.47.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.57.0.0-83.61.24.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.57.0.0-83.61.24.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.61.25.0-83.61.215.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.61.25.0-83.61.215.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.61.216.0-83.63.255.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.61.216.0-83.63.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.3.213.0-88.8.104.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.3.213.0-88.8.104.255 -j DROP; # Netname: BROADNET-ES-RNET # Roadnet S.L. C/ Sor Angela de la Cruz, 31, 1º D 28020 Madrid ES iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.171.252.0-213.171.252.63 -j LOG --log-level debug --log-prefix "as_BROADNET-ES-RNET-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.171.252.0-213.171.252.63 -j DROP; # Netname: ES-EUSKALTEL-20041022 # Euskaltel PROVIDER Local Registry ES iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.84.0.0-85.87.255.255 -j LOG --log-level debug --log-prefix "intr_ES-EUSKALTEL-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.84.0.0-85.87.255.255 -j DROP; # Netname: SIMBADNET # Retecal Sociedad Operadora de Telecomunicaciones Red de usuarios de cable ES iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.254.64.0-213.254.95.255 -j LOG --log-level debug --log-prefix "as_SIMBADNET-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.254.64.0-213.254.95.255 -j DROP; # Netname: 80.103.0.0-80.103.255.255 UNI2-NET # Uni2 IP Data Network ES iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.103.0.0-80.103.255.255 -j LOG --log-level debug --log-prefix "as_UNI2-NET-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.103.0.0-80.103.255.255 -j DROP; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.56.0.0-85.59.255.255 -j LOG --log-level debug --log-prefix "as_UNI2-NET-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.56.0.0-85.59.255.255 -j DROP; ####################### slovakia ######################## # Netname: ST-xDSL-DYNLNS1-NET # Slovenske telekomunikacie a.s. - Slovak republic - iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.47.0.0-84.47.31.255 -j LOG --log-level debug --log-prefix "as_RIMA-es: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.47.0.0-84.47.31.255 -j DROP; ############################ sweden ###################### # Netname: SE-SPRAY-DIALUP-NET # Spray Networks AB - Stockholm, Sweden iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.216.64.0-84.216.95.255 -j LOG --log-level debug --log-prefix "as_SE-SPRAY-se: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.216.64.0-84.216.95.255 -j DROP; ###################### Yugoslavia ######################## # Netname: Atribut-NET # PCS-SezamPro, Jugodata Bulevar Kralja Aleksandra 326 11050 Beograd Yugoslavia iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.200.200.0-212.200.201.255 -j LOG --log-level debug --log-prefix "as_Atribut-NET-cs: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.200.200.0-212.200.201.255 -j DROP; # 62.162.0.0-62.162.255.255 ORG-MTA1-RIPE MK-MPT-20000926 Provider Local Registry Macedonian Post & Telecommunications MK iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.162.0.0-62.162.255.255 -j LOG --log-level debug --log-prefix "as_ORG-MTA1-RIPE-mk: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.162.0.0-62.162.255.255 -j DROP; ######################### Ukraine ######################## # Netname: 83.218.224.0-83.218.227.0 INTERCOM-UA # ISP Intercom UA iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.218.224.0-83.218.227.0 -j LOG --log-level debug --log-prefix "as_INTERCOM-UA-ua: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.218.224.0-83.218.227.0 -j DROP; #_____________________________________________________________________ ############################################################################ ################## RULES ADDED BY read_log.pl PROGRAM ###################### ############################################################################ # 12.195.43.97 iptables -A INPUT -p tcp --dport 25 -s 12.195.43.97 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 12.195.43.97 -j DROP # 128.177.26.9 iptables -A INPUT -p tcp --dport 25 -s 128.177.26.9 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 128.177.26.9 -j DROP # 204.11.96.94 iptables -A INPUT -p tcp --dport 25 -s 204.11.96.94 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 204.11.96.94 -j DROP # 206.123.74.141 iptables -A INPUT -p tcp --dport 25 -s 206.123.74.141 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 206.123.74.141 -j DROP # 206.123.74.179 iptables -A INPUT -p tcp --dport 25 -s 206.123.74.179 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 206.123.74.179 -j DROP # 208.106.146.157 iptables -A INPUT -p tcp --dport 25 -s 208.106.146.157 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 208.106.146.157 -j DROP # 208.106.146.188 iptables -A INPUT -p tcp --dport 25 -s 208.106.146.188 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 208.106.146.188 -j DROP # 208.106.146.198 iptables -A INPUT -p tcp --dport 25 -s 208.106.146.198 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 208.106.146.198 -j DROP # 208.106.146.204 iptables -A INPUT -p tcp --dport 25 -s 208.106.146.204 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 208.106.146.204 -j DROP # 208.99.198.67 iptables -A INPUT -p tcp --dport 25 -s 208.99.198.67 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 208.99.198.67 -j DROP # 209.133.69.26 iptables -A INPUT -p tcp --dport 25 -s 209.133.69.26 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 209.133.69.26 -j DROP # 209.133.69.28 iptables -A INPUT -p tcp --dport 25 -s 209.133.69.28 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 209.133.69.28 -j DROP # 209.133.69.41 iptables -A INPUT -p tcp --dport 25 -s 209.133.69.41 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 209.133.69.41 -j DROP # 212.27.42.28 iptables -A INPUT -p tcp --dport 25 -s 212.27.42.28 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 212.27.42.28 -j DROP # 212.9.11.203 iptables -A INPUT -p tcp --dport 25 -s 212.9.11.203 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 212.9.11.203 -j DROP # 64.129.64.38 iptables -A INPUT -p tcp --dport 25 -s 64.129.64.38 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.64.38 -j DROP # 64.129.64.39 iptables -A INPUT -p tcp --dport 25 -s 64.129.64.39 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.64.39 -j DROP # 64.129.64.41 iptables -A INPUT -p tcp --dport 25 -s 64.129.64.41 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.64.41 -j DROP # 64.129.64.42 iptables -A INPUT -p tcp --dport 25 -s 64.129.64.42 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.64.42 -j DROP # 64.129.64.44 iptables -A INPUT -p tcp --dport 25 -s 64.129.64.44 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.64.44 -j DROP # 64.129.64.52 iptables -A INPUT -p tcp --dport 25 -s 64.129.64.52 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.64.52 -j DROP # 64.129.64.53 iptables -A INPUT -p tcp --dport 25 -s 64.129.64.53 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.64.53 -j DROP # 64.129.64.54 iptables -A INPUT -p tcp --dport 25 -s 64.129.64.54 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.64.54 -j DROP # 64.129.64.57 iptables -A INPUT -p tcp --dport 25 -s 64.129.64.57 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.64.57 -j DROP # 64.129.64.63 iptables -A INPUT -p tcp --dport 25 -s 64.129.64.63 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.64.63 -j DROP # 64.129.64.63 iptables -A INPUT -p tcp --dport 25 -s 64.129.64.63 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.64.63 -j DROP # 64.129.65.35 iptables -A INPUT -p tcp --dport 25 -s 64.129.65.35 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.65.35 -j DROP # 64.129.65.38 iptables -A INPUT -p tcp --dport 25 -s 64.129.65.38 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.65.38 -j DROP # 64.129.65.45 iptables -A INPUT -p tcp --dport 25 -s 64.129.65.45 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.65.45 -j DROP # 64.129.65.47 iptables -A INPUT -p tcp --dport 25 -s 64.129.65.47 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.65.47 -j DROP # 64.129.65.52 iptables -A INPUT -p tcp --dport 25 -s 64.129.65.52 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.65.52 -j DROP # 64.129.65.58 iptables -A INPUT -p tcp --dport 25 -s 64.129.65.58 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.65.58 -j DROP # 64.129.66.42 iptables -A INPUT -p tcp --dport 25 -s 64.129.66.42 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.66.42 -j DROP # 64.129.66.45 iptables -A INPUT -p tcp --dport 25 -s 64.129.66.45 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.66.45 -j DROP # 64.129.66.48 iptables -A INPUT -p tcp --dport 25 -s 64.129.66.48 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.66.48 -j DROP # 64.129.66.58 iptables -A INPUT -p tcp --dport 25 -s 64.129.66.58 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.66.58 -j DROP # 64.129.66.62 iptables -A INPUT -p tcp --dport 25 -s 64.129.66.62 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.66.62 -j DROP # 66.79.167.3 iptables -A INPUT -p tcp --dport 25 -s 66.79.167.3 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 66.79.167.3 -j DROP # 66.79.186.80 iptables -A INPUT -p tcp --dport 25 -s 66.79.186.80 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 66.79.186.80 -j DROP # 66.79.189.100 iptables -A INPUT -p tcp --dport 25 -s 66.79.189.100 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 66.79.189.100 -j DROP # 66.79.189.116 iptables -A INPUT -p tcp --dport 25 -s 66.79.189.116 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 66.79.189.116 -j DROP # 66.79.189.116 iptables -A INPUT -p tcp --dport 25 -s 66.79.189.116 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 66.79.189.116 -j DROP # 71.248.161.66 iptables -A INPUT -p tcp --dport 25 -s 71.248.161.66 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 71.248.161.66 -j DROP # 71.83.196.95 iptables -A INPUT -p tcp --dport 25 -s 71.83.196.95 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 71.83.196.95 -j DROP # 208.106.146.172 iptables -A INPUT -p tcp --dport 25 -s 208.106.146.172 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 208.106.146.172 -j DROP # 67.140.129.243 iptables -A INPUT -p tcp --dport 25 -s 67.140.129.243 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 67.140.129.243 -j DROP # 64.129.66.60 iptables -A INPUT -p tcp --dport 25 -s 64.129.66.60 -j LOG --log-level debug --log-prefix "asshole: " iptables -A INPUT -p tcp --dport 25 -s 64.129.66.60 -j DROP # 83.208.59.0-83.208.59.255 NEXTEL-XDSL CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.208.59.0-83.208.59.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.208.59.0-83.208.59.255 -j DROP; # 84.244.80.0-84.244.80.255 LLU-BLUETONE CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.244.80.0-84.244.80.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.244.80.0-84.244.80.255 -j DROP; # 84.108.0.0-84.108.255.255 CABLES-CONNECTION IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.108.0.0-84.108.255.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.108.0.0-84.108.255.255 -j DROP; # 88.153.170.0-88.153.255.255 ADSL-CUSTOMER-CONNECTION IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.153.170.0-88.153.255.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.153.170.0-88.153.255.255 -j DROP; # 88.154.0.0-88.154.84.255 ADSL-CUSTOMER-CONNECTION IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.154.0.0-88.154.84.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.154.0.0-88.154.84.255 -j DROP; # 85.250.0.0-85.250.127.255 BB-PT IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.250.0.0-85.250.127.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.250.0.0-85.250.127.255 -j DROP; # 88.155.0.0-88.155.84.255 ADSL-CUSTOMER-CONNECTION IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.155.0.0-88.155.84.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.155.0.0-88.155.84.255 -j DROP; # 62.245.112.0-62.245.119.255 UPC-BRNO-V CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.245.112.0-62.245.119.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.245.112.0-62.245.119.255 -j DROP; # 85.70.248.0-85.70.248.255 NEXTEL-XDSL CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.70.248.0-85.70.248.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.70.248.0-85.70.248.255 -j DROP; # 89.0.0.0-89.1.255.255 IL-BARAK-20060508 IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 89.0.0.0-89.1.255.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 89.0.0.0-89.1.255.255 -j DROP; # 83.130.76.0-83.130.91.255 EURONET IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.76.0-83.130.91.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.76.0-83.130.91.255 -j DROP; # 88.152.85.0-88.152.169.255 ADSL-CUSTOMER-CONNECTION IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.152.85.0-88.152.169.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.152.85.0-88.152.169.255 -j DROP; # 88.153.0.0-88.153.84.255 ADSL-CUSTOMER-CONNECTION IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.153.0.0-88.153.84.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.153.0.0-88.153.84.255 -j DROP; # 84.201.240.0-84.201.255.255 NEOLINK-NET RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.201.240.0-84.201.255.255 -j LOG --log-level debug --log-prefix "RIPE-RU: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.201.240.0-84.201.255.255 -j DROP; # 62.168.111.48-62.168.111.63 SK-NETIQ-KROM SK iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.168.111.48-62.168.111.63 -j LOG --log-level debug --log-prefix "RIPE-SK: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.168.111.48-62.168.111.63 -j DROP; # 84.42.192.0-84.42.199.255 UPC-BROADBAND-XXII CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.42.192.0-84.42.199.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.42.192.0-84.42.199.255 -j DROP; # 212.116.184.0-212.116.184.31 IL-MISH-EIN-GEDI-NET IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.116.184.0-212.116.184.31 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.116.184.0-212.116.184.31 -j DROP; # 88.101.245.0-88.101.245.255 NEXTEL-XDSL CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.101.245.0-88.101.245.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.101.245.0-88.101.245.255 -j DROP; # 80.178.131.0-80.178.142.255 GOLDENLINES-ADSL IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.178.131.0-80.178.142.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.178.131.0-80.178.142.255 -j DROP; # 194.212.175.64-194.212.175.95 ERKOR-CZ CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.212.175.64-194.212.175.95 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.212.175.64-194.212.175.95 -j DROP; # 217.132.128.0-217.132.255.255 BB-HFA IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.132.128.0-217.132.255.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.132.128.0-217.132.255.255 -j DROP; # 83.130.111.0-83.130.127.255 EURONET IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.111.0-83.130.127.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.111.0-83.130.127.255 -j DROP; # 62.0.95.0-62.0.127.255 BB-PT IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.0.95.0-62.0.127.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.0.95.0-62.0.127.255 -j DROP; # 62.140.244.16-62.140.244.31 FIORD-BIRULEVONET RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.140.244.16-62.140.244.31 -j LOG --log-level debug --log-prefix "RIPE-RU: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.140.244.16-62.140.244.31 -j DROP; # 84.25.0.0-84.25.255.255 ATHOME-LANDGRAAF-1 NL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.25.0.0-84.25.255.255 -j LOG --log-level debug --log-prefix "RIPE-NL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.25.0.0-84.25.255.255 -j DROP; # 86.3.128.0-86.3.143.255 NTL GB iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.3.128.0-86.3.143.255 -j LOG --log-level debug --log-prefix "RIPE-GB: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.3.128.0-86.3.143.255 -j DROP; # 213.192.60.0-213.192.60.255 ERKORNET CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.192.60.0-213.192.60.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 213.192.60.0-213.192.60.255 -j DROP; # 83.129.0.0-83.129.127.255 TISCALI-ADSL DE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.129.0.0-83.129.127.255 -j LOG --log-level debug --log-prefix "RIPE-DE: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.129.0.0-83.129.127.255 -j DROP; # 88.101.50.0-88.101.50.255 NEXTEL-XDSL CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.101.50.0-88.101.50.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.101.50.0-88.101.50.255 -j DROP; # 84.252.14.0-84.252.15.255 EVROCOM-NET BG iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.252.14.0-84.252.15.255 -j LOG --log-level debug --log-prefix "RIPE-BG: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.252.14.0-84.252.15.255 -j DROP; # 84.94.192.0-84.94.203.255 GOLDENLINES-CABLE IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.94.192.0-84.94.203.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.94.192.0-84.94.203.255 -j DROP; # 83.130.52.0-83.130.58.255 EURONET IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.52.0-83.130.58.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.52.0-83.130.58.255 -j DROP; # 62.219.246.56-62.219.246.63 MIVTZAR-LTD IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.219.246.56-62.219.246.63 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.219.246.56-62.219.246.63 -j DROP; # 81.90.160.0-81.90.164.255 CZ-TERMSNET CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.90.160.0-81.90.164.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.90.160.0-81.90.164.255 -j DROP; # 66.231.170.102 iptables -A INPUT -p tcp --dport 25 -s 66.231.170.102 -j LOG --log-level debug --log-prefix "as-US: "; iptables -A INPUT -p tcp --dport 25 -s 66.231.170.102 -j DROP; # 85.192.16.0-85.192.23.255 YAUZA-TELECOM RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.192.16.0-85.192.23.255 -j LOG --log-level debug --log-prefix "RIPE-RU: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.192.16.0-85.192.23.255 -j DROP; # 66.255.41.42 iptables -A INPUT -p tcp --dport 25 -s 66.255.41.42 -j LOG --log-level debug --log-prefix "as-US: "; iptables -A INPUT -p tcp --dport 25 -s 66.255.41.42 -j DROP; # 85.95.131.0-85.95.131.255 PTKOM-NET-001 RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.95.131.0-85.95.131.255 -j LOG --log-level debug --log-prefix "RIPE-RU: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.95.131.0-85.95.131.255 -j DROP; # 84.228.152.0-84.228.155.255 EURONET IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.228.152.0-84.228.155.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.228.152.0-84.228.155.255 -j DROP; # 195.225.128.0-195.225.131.255 PROVRU RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 195.225.128.0-195.225.131.255 -j LOG --log-level debug --log-prefix "RIPE-RU: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 195.225.128.0-195.225.131.255 -j DROP; # 85.48.0.0-85.55.255.255 UNI2-NET ES iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.48.0.0-85.55.255.255 -j LOG --log-level debug --log-prefix "RIPE-ES: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.48.0.0-85.55.255.255 -j DROP; # 83.208.83.0-83.208.83.255 NEXTEL-XDSL CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.208.83.0-83.208.83.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.208.83.0-83.208.83.255 -j DROP; # 84.94.60.0-84.94.71.255 GOLDENLINES-CABLE IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.94.60.0-84.94.71.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.94.60.0-84.94.71.255 -j DROP; # 83.130.16.0-83.130.36.255 EURONET IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.16.0-83.130.36.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.16.0-83.130.36.255 -j DROP; # 88.155.85.0-88.155.169.255 ADSL-CUSTOMER-CONNECTION IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.155.85.0-88.155.169.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.155.85.0-88.155.169.255 -j DROP; # 85.193.26.0-85.193.26.255 TASARYNET CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.193.26.0-85.193.26.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.193.26.0-85.193.26.255 -j DROP; # 195.47.9.0-195.47.9.255 RKKA CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 195.47.9.0-195.47.9.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 195.47.9.0-195.47.9.255 -j DROP; # 194.108.132.0-194.108.133.255 CTT-ADSL1-NET CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.108.132.0-194.108.133.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.108.132.0-194.108.133.255 -j DROP; # 66.225.159.217 iptables -A INPUT -p tcp --dport 25 -s 66.225.159.217 -j LOG --log-level debug --log-prefix "as-US: "; iptables -A INPUT -p tcp --dport 25 -s 66.225.159.217 -j DROP; # 83.130.92.0-83.130.110.255 EURONET IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.92.0-83.130.110.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.92.0-83.130.110.255 -j DROP; # 83.130.59.0-83.130.67.255 EURONET IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.59.0-83.130.67.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.59.0-83.130.67.255 -j DROP; # 84.229.0.0-84.229.63.255 EURONET IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.229.0.0-84.229.63.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.229.0.0-84.229.63.255 -j DROP; # 88.152.170.0-88.152.255.255 ADSL-CUSTOMER-CONNECTION IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.152.170.0-88.152.255.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.152.170.0-88.152.255.255 -j DROP; # 81.30.202.0-81.30.207.255 UBN RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.30.202.0-81.30.207.255 -j LOG --log-level debug --log-prefix "RIPE-RU: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.30.202.0-81.30.207.255 -j DROP; # 81.138.148.80-81.138.148.87 Mark-LANE-000000007254525 GB iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.138.148.80-81.138.148.87 -j LOG --log-level debug --log-prefix "RIPE-GB: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.138.148.80-81.138.148.87 -j DROP; # 12.173.239.196 iptables -A INPUT -p tcp --dport 25 -s 12.173.239.196 -j LOG --log-level debug --log-prefix "as-US: "; iptables -A INPUT -p tcp --dport 25 -s 12.173.239.196 -j DROP; # 207.173.181.177 iptables -A INPUT -p tcp --dport 25 -s 207.173.181.177 -j LOG --log-level debug --log-prefix "as-US: "; iptables -A INPUT -p tcp --dport 25 -s 207.173.181.177 -j DROP; # 64.81.94.114 iptables -A INPUT -p tcp --dport 25 -s 64.81.94.114 -j LOG --log-level debug --log-prefix "as-US: "; iptables -A INPUT -p tcp --dport 25 -s 64.81.94.114 -j DROP; # 88.146.128.0-88.146.255.255 CZ-SLOANE-20051222 CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.146.128.0-88.146.255.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.146.128.0-88.146.255.255 -j DROP; # 86.40.0.0-86.43.255.255 EIRCOM IE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.40.0.0-86.43.255.255 -j LOG --log-level debug --log-prefix "RIPE-IE: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.40.0.0-86.43.255.255 -j DROP; # 218.78.0.0-218.83.255.255 CHINANET-SH CN iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.78.0.0-218.83.255.255 -j LOG --log-level debug --log-prefix "RIPE-CN: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.78.0.0-218.83.255.255 -j DROP; # 80.188.32.0-80.188.32.255 NEXTEL-XDSL CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.188.32.0-80.188.32.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 80.188.32.0-80.188.32.255 -j DROP; # 81.245.4.0-81.245.5.255 BE-SKYNET-20011108 BE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.245.4.0-81.245.5.255 -j LOG --log-level debug --log-prefix "RIPE-BE: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 81.245.4.0-81.245.5.255 -j DROP; # 217.197.157.0-217.197.157.63 NWT-NET CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.197.157.0-217.197.157.63 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.197.157.0-217.197.157.63 -j DROP; # 195.204.237.0-195.204.237.255 NO-FRENA-BREIBAND NO iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 195.204.237.0-195.204.237.255 -j LOG --log-level debug --log-prefix "RIPE-NO: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 195.204.237.0-195.204.237.255 -j DROP; # 88.212.0.0-88.212.63.255 SK-ANTIK-20051208 SK iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.212.0.0-88.212.63.255 -j LOG --log-level debug --log-prefix "RIPE-SK: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.212.0.0-88.212.63.255 -j DROP; # 217.80.0.0-217.86.127.255 DTAG-DIAL14 DE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.80.0.0-217.86.127.255 -j LOG --log-level debug --log-prefix "RIPE-DE: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.80.0.0-217.86.127.255 -j DROP; # 62.204.252.0-62.204.253.255 TTNET-SDL2 cz iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.204.252.0-62.204.253.255 -j LOG --log-level debug --log-prefix "RIPE-cz: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.204.252.0-62.204.253.255 -j DROP; # 212.96.206.0-212.96.206.255 UGANSK RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.96.206.0-212.96.206.255 -j LOG --log-level debug --log-prefix "RIPE-RU: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.96.206.0-212.96.206.255 -j DROP; # 82.147.96.0-82.147.127.255 RU-NEXCOM-20030704 RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.147.96.0-82.147.127.255 -j LOG --log-level debug --log-prefix "RIPE-RU: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.147.96.0-82.147.127.255 -j DROP; # 62.168.245.0-62.168.245.127 PRUDOK ru iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.168.245.0-62.168.245.127 -j LOG --log-level debug --log-prefix "RIPE-ru: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 62.168.245.0-62.168.245.127 -j DROP; # 83.208.32.0-83.208.32.255 NEXTEL-XDSL CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.208.32.0-83.208.32.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.208.32.0-83.208.32.255 -j DROP; # 194.108.139.0-194.108.143.255 CTT-ADSL1-NET CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.108.139.0-194.108.143.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 194.108.139.0-194.108.143.255 -j DROP; # 83.130.152.0-83.130.175.255 EURONET IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.152.0-83.130.175.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.130.152.0-83.130.175.255 -j DROP; # 82.81.128.0-82.81.191.255 ADSL-CUSTOMER-CONNECTION IL iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.81.128.0-82.81.191.255 -j LOG --log-level debug --log-prefix "RIPE-IL: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 82.81.128.0-82.81.191.255 -j DROP; # 71.48.232.183 iptables -A INPUT -p tcp --dport 25 -s 71.48.232.183 -j LOG --log-level debug --log-prefix "as-US: "; iptables -A INPUT -p tcp --dport 25 -s 71.48.232.183 -j DROP; # 89.102.161.0-89.102.161.255 TESNETWORK CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 89.102.161.0-89.102.161.255 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 89.102.161.0-89.102.161.255 -j DROP; # 212.205.95.0-212.205.95.255 OTENET GR iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.205.95.0-212.205.95.255 -j LOG --log-level debug --log-prefix "RIPE-GR: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 212.205.95.0-212.205.95.255 -j DROP; # 84.244.95.64-84.244.95.127 MOPOS-CRA CZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.244.95.64-84.244.95.127 -j LOG --log-level debug --log-prefix "RIPE-CZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 84.244.95.64-84.244.95.127 -j DROP; # 86.34.0.0-86.34.255.255 ROMTELECOM RO iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.34.0.0-86.34.255.255 -j LOG --log-level debug --log-prefix "RIPE-RO: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 86.34.0.0-86.34.255.255 -j DROP; # 195.190.115.0-195.190.115.255 SOVINTEL RU iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 195.190.115.0-195.190.115.255 -j LOG --log-level debug --log-prefix "RIPE-RU: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 195.190.115.0-195.190.115.255 -j DROP; # 218.5.70.24-218.5.70.31 XIAMEN-CTECOR-LTD-FJ CN iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.5.70.24-218.5.70.31 -j LOG --log-level debug --log-prefix "RIPE-CN: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.5.70.24-218.5.70.31 -j DROP; # 124.48.0.0-124.63.255.255 XPEED KR iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 124.48.0.0-124.63.255.255 -j LOG --log-level debug --log-prefix "RIPE-KR: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 124.48.0.0-124.63.255.255 -j DROP; # 58.60.0.0-58.63.255.255 CHINANET-GD CN iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 58.60.0.0-58.63.255.255 -j LOG --log-level debug --log-prefix "RIPE-CN: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 58.60.0.0-58.63.255.255 -j DROP; # 85.75.0.0-85.75.255.255 OTENET GR iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.75.0.0-85.75.255.255 -j LOG --log-level debug --log-prefix "RIPE-GR: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 85.75.0.0-85.75.255.255 -j DROP; # 217.172.157.0-217.172.157.255 ITSYSTEMS-NET1 SK iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.172.157.0-217.172.157.255 -j LOG --log-level debug --log-prefix "RIPE-SK: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 217.172.157.0-217.172.157.255 -j DROP; # 88.151.176.48-88.151.179.7 SKYNET KZ iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.151.176.48-88.151.179.7 -j LOG --log-level debug --log-prefix "RIPE-KZ: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.151.176.48-88.151.179.7 -j DROP; # 89.144.192.0-89.144.223.255 MOBILKOM-MOBILEPOOLS3 AT iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 89.144.192.0-89.144.223.255 -j LOG --log-level debug --log-prefix "RIPE-AT: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 89.144.192.0-89.144.223.255 -j DROP; # 64.18.4.10 iptables -A INPUT -p tcp --dport 25 -s 64.18.4.10 -j LOG --log-level debug --log-prefix "as-US: "; iptables -A INPUT -p tcp --dport 25 -s 64.18.4.10 -j DROP; # 218.228.128.0-218.228.255.255 K-OPTICOM JP iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.228.128.0-218.228.255.255 -j LOG --log-level debug --log-prefix "RIPE-JP: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 218.228.128.0-218.228.255.255 -j DROP; # 200.69.160.0/21 K-OPTICOM EC iptables -A INPUT -p tcp --dport 25 -s 200.69.160.0/21 -j LOG --log-level debug --log-prefix "LACNIC-EC: "; iptables -A INPUT -p tcp --dport 25 -s 200.69.160.0/21 -j DROP; # 83.141.84.192-83.141.84.255 IBIS-PA-NET IE iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.141.84.192-83.141.84.255 -j LOG --log-level debug --log-prefix "RIPE-IE: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 83.141.84.192-83.141.84.255 -j DROP; # 63.211.182.52 iptables -A INPUT -p tcp --dport 25 -s 63.211.182.52 -j LOG --log-level debug --log-prefix "as-US: "; iptables -A INPUT -p tcp --dport 25 -s 63.211.182.52 -j DROP; # 60.208.0.0-60.217.255.255 CNCGROUP-SD CN iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 60.208.0.0-60.217.255.255 -j LOG --log-level debug --log-prefix "RIPE-CN: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 60.208.0.0-60.217.255.255 -j DROP; # 124.128.0.0-124.135.255.255 CNCGROUP-SD CN iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 124.128.0.0-124.135.255.255 -j LOG --log-level debug --log-prefix "RIPE-CN: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 124.128.0.0-124.135.255.255 -j DROP; # 88.242.64.0-88.242.255.255 TurkTelekom tr iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.242.64.0-88.242.255.255 -j LOG --log-level debug --log-prefix "RIPE-tr: "; iptables -A INPUT -p tcp --dport 25 -m iprange --src-range 88.242.64.0-88.242.255.255 -j DROP; # 201.253.26.0/23 AR iptables -A INPUT -p tcp --dport 25 -s 201.253.26.0/23 -j LOG --log-level debug --log-prefix "LACNIC-AR: "; iptables -A INPUT -p tcp --dport 25 -s 201.253.26.0/23 -j DROP;

Mark Weaver

4:42 a.m.

New subject: spam control (by the way)

Mark Weaver wrote:

...

Bill Church wrote:

...
If you have the luxury of blocking IPs based on countries or regions, that helps as well but not everyone can do this.

-Bill

That in a nutshell of but one layer of a multi-layer approach that I've been using for the past two years. At present I may get a grand total of 2 SPAMs per week; sometimes less than that, but that's the average.

layer #1: RBLs configured in the MTA - Sendmail layer #2: SpamAssassin (score set to 3 and known or trusted addresses white-listed layer #3: iptables rules and a technique known as geo-blocking.

The third layer, iptables and geo-blocking REALLY make a huge difference. It's taken about a year and some digging, but I've got a very good foundation ruleset that works extremely well. And personally I don't consider blocking on countries or regions is a luxury, but rather a necessity. Anyone can do it and should of they're running a mail server that is accepting direct SMTP connections.

Since my mail server is already behind a router the rule set is very simple, but extremely effective and very portable.

Thought I'd send this along as well. It's a small perl script that will make batch processing spammers IP addresses a little easier and faster. It isn't pretty or much past beta, but it gets the job done.

The script does a whois lookup on the IP address, grabs the IP range and writes a rule which gets put into the "chains" file. Once it's processed all the addresses it writes out the file afresh. At that point just run the chains file from where ever you've placed it. (at the moment is has trouble processing whois information when arin redirects to some of suib-whois server. And you have to watch when it does a whois lookup on a LACNIC address because they display their IP range information much differently than APNIC or RIPE so, some hand editing after the batch processing may need done. YMMV) Like I said... it's still beta.

to use the script simply place the spam IP addresses harvested from the spam email headers into a simple text file, one address per line. (edit the script and replace the current file name storing the IP addresses with what ever you've called your IP address file) Then run the script like so: perl proc_ip_list.pl [ENTER]

You'll see a listing of rules being printed out on the console screen, or a message letting you know that the address or address range already exists in the "chains" file. Once the program completes upload or copy the fresh copy of chains to it's place and run "chains" from the command line. ( I keep mine in the /bin directory )

EX: /bin/chains [ENTER]

It will flush Iptables and set the new rules in place.

Gavin Carr

4:54 a.m.

New subject: spam control (by the way)

On Sun, Oct 29, 2006 at 10:42:06PM -0500, Mark Weaver wrote:

...

Mark Weaver wrote:

...
Bill Church wrote:

...
If you have the luxury of blocking IPs based on countries or regions, that helps as well but not everyone can do this.

-Bill

That in a nutshell of but one layer of a multi-layer approach that I've been using for the past two years. At present I may get a grand total of 2 SPAMs per week; sometimes less than that, but that's the average.

layer #1: RBLs configured in the MTA - Sendmail layer #2: SpamAssassin (score set to 3 and known or trusted addresses white-listed layer #3: iptables rules and a technique known as geo-blocking.

The third layer, iptables and geo-blocking REALLY make a huge difference. It's taken about a year and some digging, but I've got a very good foundation ruleset that works extremely well. And personally I don't consider blocking on countries or regions is a luxury, but rather a necessity. Anyone can do it and should of they're running a mail server that is accepting direct SMTP connections.

Since my mail server is already behind a router the rule set is very simple, but extremely effective and very portable.

Thought I'd send this along as well. It's a small perl script that will make batch processing spammers IP addresses a little easier and faster. It isn't pretty or much past beta, but it gets the job done.

The script does a whois lookup on the IP address, grabs the IP range and writes a rule which gets put into the "chains" file. Once it's processed all the addresses it writes out the file afresh. At that point just run the chains file from where ever you've placed it. (at the moment is has trouble processing whois information when arin redirects to some of suib-whois server. And you have to watch when it does a whois lookup on a LACNIC address because they display their IP range information much differently than APNIC or RIPE so, some hand editing after the batch processing may need done. YMMV) Like I said... it's still beta.

There are also a bunch of CPAN perl modules that can be used for this e.g. Geo::IP, Geo::IP2Location, Geo::IPfree, etc.

Cheers, Gavin

-- Gavin Carr Open Fusion - Open Source Business Solutions [ Linux - Perl - Apache ] http://www.openfusion.com.au - Fashion is a variable, but style is a constant - Programming Perl

Mark Weaver

1:09 p.m.

New subject: spam control (by the way)

Gavin Carr wrote:

...

On Sun, Oct 29, 2006 at 10:42:06PM -0500, Mark Weaver wrote:

...
Mark Weaver wrote:

...
Bill Church wrote:

...
If you have the luxury of blocking IPs based on countries or regions, that helps as well but not everyone can do this.

-Bill

That in a nutshell of but one layer of a multi-layer approach that I've been using for the past two years. At present I may get a grand total of 2 SPAMs per week; sometimes less than that, but that's the average.

layer #1: RBLs configured in the MTA - Sendmail layer #2: SpamAssassin (score set to 3 and known or trusted addresses white-listed layer #3: iptables rules and a technique known as geo-blocking.

The third layer, iptables and geo-blocking REALLY make a huge difference. It's taken about a year and some digging, but I've got a very good foundation ruleset that works extremely well. And personally I don't consider blocking on countries or regions is a luxury, but rather a necessity. Anyone can do it and should of they're running a mail server that is accepting direct SMTP connections.

Since my mail server is already behind a router the rule set is very simple, but extremely effective and very portable.

Thought I'd send this along as well. It's a small perl script that will make batch processing spammers IP addresses a little easier and faster. It isn't pretty or much past beta, but it gets the job done.

The script does a whois lookup on the IP address, grabs the IP range and writes a rule which gets put into the "chains" file. Once it's processed all the addresses it writes out the file afresh. At that point just run the chains file from where ever you've placed it. (at the moment is has trouble processing whois information when arin redirects to some of suib-whois server. And you have to watch when it does a whois lookup on a LACNIC address because they display their IP range information much differently than APNIC or RIPE so, some hand editing after the batch processing may need done. YMMV) Like I said... it's still beta.

There are also a bunch of CPAN perl modules that can be used for this e.g. Geo::IP, Geo::IP2Location, Geo::IPfree, etc.

Cheers, Gavin

-- Gavin Carr

Hi Garvin,

Those are pretty cool... thanks for the heads up I was unaware of them, but they appear to be specifically for gathering geographical data which web master would use and have nothing to do with geo-blocking of spam.

Bill Church

3:05 p.m.

New subject: spam control (by the way)

Mark Weaver wrote:

...

Gavin Carr wrote:

...
There are also a bunch of CPAN perl modules that can be used for this e.g. Geo::IP, Geo::IP2Location, Geo::IPfree, etc.

Hi Garvin,

Those are pretty cool... thanks for the heads up I was unaware of them, but they appear to be specifically for gathering geographical data which web master would use and have nothing to do with geo-blocking of spam.

The idea is, the lookup is fairly well debugged and automated through those models, just need some glue to built iptables rules for, especially Geo::IPfree. I would imagine you could do something like this to block all IPs that aren't US or something to that effect:

getcountry.pl: #!/usr/bin/perl use Geo::IPfree; my $new_ip = $ARGV[0] ; print "$new_ip\r\n" ; my ($country,$country_name,$ip) = Geo::IPfree::LookUp($new_ip) ; print "$country_name\r\n" ; if ($country eq "US") { print "US IP!\r\n" ; } else { print "Not US IP!\r\n" ; }

You can just run something like "getcountry.pl 212.5.80.0" (Kaspersky Labs, Russia) which should tell you that it's not a US IP. You could add this as another layer or use it for additional scoring. Obviously you would want to check the variables and all that good security stuff, this is a just a proof of concept.

Mark Weaver

5:12 p.m.

New subject: spam control (by the way)

On Mon, October 30, 2006 9:05 am, Bill Church wrote:

...

Mark Weaver wrote:

...
Gavin Carr wrote:

...
There are also a bunch of CPAN perl modules that can be used for this e.g. Geo::IP, Geo::IP2Location, Geo::IPfree, etc.

Hi Garvin,

Those are pretty cool... thanks for the heads up I was unaware of them, but they appear to be specifically for gathering geographical data which web master would use and have nothing to do with geo-blocking of spam.

The idea is, the lookup is fairly well debugged and automated through those models, just need some glue to built iptables rules for, especially Geo::IPfree. I would imagine you could do something like this to block all IPs that aren't US or something to that effect:

getcountry.pl: #!/usr/bin/perl use Geo::IPfree; my $new_ip = $ARGV[0] ; print "$new_ip\r\n" ; my ($country,$country_name,$ip) = Geo::IPfree::LookUp($new_ip) ; print "$country_name\r\n" ; if ($country eq "US") { print "US IP!\r\n" ; } else { print "Not US IP!\r\n" ; }

You can just run something like "getcountry.pl 212.5.80.0" (Kaspersky Labs, Russia) which should tell you that it's not a US IP. You could add this as another layer or use it for additional scoring. Obviously you would want to check the variables and all that good security stuff, this is a just a proof of concept.

makes good sense! I will have to get busy and see about incorporating this into the existing program. sure would clean things up more and make it more managable.

many thanks,

-- Mark If you've found a wise man then you've found a man that was at one time an idiot and lived long enough to learn from his mistakes.

Bill Church

2:27 p.m.

Mark Weaver wrote:

...

Bill Church wrote:

...
If you have the luxury of blocking IPs based on countries or regions, that helps as well but not everyone can do this.

-Bill

... And personally I don't consider blocking on countries or regions is a luxury, but rather a necessity. Anyone can do it and should of they're running a mail server that is accepting direct SMTP connections.

I mean a luxury as in if you are so fortunate to only receive mail from a few regions or so. We have a fairly large customer who is an electronics manufacturer, their suppliers and customers are all over the globe, unfortunately we can't use this strategy for them.

We have a few financial customers, however, where their customers are only in the US. They block access to all of their resources geographically, this seems to work very well for them for spam and attacks.

Very nice work Mark. How do your logs look with all of those log statements?

-Bill

Mark Weaver

5:20 p.m.

On Mon, October 30, 2006 8:27 am, Bill Church wrote:

...

Mark Weaver wrote:

...
Bill Church wrote:

...
If you have the luxury of blocking IPs based on countries or regions, that helps as well but not everyone can do this.

-Bill

... And personally I don't consider blocking on countries or regions is a luxury, but rather a necessity. Anyone can do it and should of they're running a mail server that is accepting direct SMTP connections.

I mean a luxury as in if you are so fortunate to only receive mail from a few regions or so. We have a fairly large customer who is an electronics manufacturer, their suppliers and customers are all over the globe, unfortunately we can't use this strategy for them.

We have a few financial customers, however, where their customers are only in the US. They block access to all of their resources geographically, this seems to work very well for them for spam and attacks.

Very nice work Mark. How do your logs look with all of those log statements?

-Bill

Thanks!

the logs reflect the chatty nature of the rules, but all in all definitely not unmanageable.

as far as being able to receive messages from part of the globe of an already blocked area, if I remember correctly I've been known to fine tune this a bit to allow certain IP's in while blocking the rest of the netblock from an offending area. Australia springs to mind since when I first started compiling data for this most of the SPAM was originating from the Asia Pacific network. Since then, in the last 6 months traffic has shifted from there to the Ripe Network.

Unless I'm mistaken, if one sets a rule to block an IP range 216.0.0.0-215.255.255.255 we're effectively blocking a very large netblock. However, if there's a smaller segment within that netblock that you want to allow placing another rule directly after that should allow that secondary traffic in. Puts me in mind of setting the INPUT chain's default policy to DROP and then placing a rule to allow certain connections from certain sources to be Accepted.

-- Mark If you've found a wise man then you've found a man that was at one time an idiot and lived long enough to learn from his mistakes.

Collins Richey

31 Oct 31 Oct

1:55 a.m.

On 10/29/06, Mark Weaver mdw1982@mdw1982.com wrote:

[ really interesting approach snipped ]

I will squirrel this away for future use. The list of suppressed addresses is too voluminous to be perused in detail, but I can't help but wonder how many legitimate, non-spamming users fall into the supposedly moronic or a###ole categories.

...

Collins Richey If you fill your heart with regrets of yesterday and the worries of tomorrow, you have no today to be thankful for.

Mark Weaver

2:22 a.m.

Collins Richey wrote:

...

On 10/29/06, Mark Weaver mdw1982@mdw1982.com wrote:

[ really interesting approach snipped ]

I will squirrel this away for future use. The list of suppressed addresses is too voluminous to be perused in detail, but I can't help but wonder how many legitimate, non-spamming users fall into the supposedly moronic or a###ole categories.

none if any. Those addresses are there because the user at the other end was attempting some very dark and devious breakin against one of my servers. That's what earned them the dubious honor of a$$hole! :)

Barry Brimer

25 Oct 25 Oct

5:43 a.m.

...

...
I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

I recommend greylisting. Check out http://www.greylisting.org. I run gld with a postfix MTA.

Barry

R Lists06

6:45 a.m.

...

...
...
I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

I recommend greylisting. Check out http://www.greylisting.org. I run gld with a postfix MTA.

Barry

What RBL's, if any, do you use if we may ask?

- rh

-- Robert - Abba Communications Computer & Internet Services (509) 624-7159 - www.abbacomm.net

James Fidell

1:47 p.m.

R Lists06 wrote:

...

...
...
...
I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

I recommend greylisting. Check out http://www.greylisting.org. I run gld with a postfix MTA.

Barry

What RBL's, if any, do you use if we may ask?

I have found that greylisting based on the Spamhaus sbl-xbl list massively reduces spam. Setting that up on my backup MX resulted in all traffic through it stopping when my primary MX is up.

It's sorely tempting to set up a lowest-priority MX that either points to 127.0.0.1, or to a machine that has a daemon on port 25 just returning 4xx SMTP errors in response to every connection.

James

Barry Brimer

3:52 p.m.

...

I have found that greylisting based on the Spamhaus sbl-xbl list massively reduces spam. Setting that up on my backup MX resulted in all traffic through it stopping when my primary MX is up.

James,

Are you using greylisting or blacklisting with Spamhaus? My understanding of blacklisting is that blacklisting uses a DNS blacklist, such as Spamhaus. My understanding of greylisting is when your MTA sends back a temporary failure the first time in X number of days where it sees a new sender/receiver/mail server IP address triplicate. Please clarify.

Thanks, Barry

Bill Baird

4:26 p.m.

...

...
I have found that greylisting based on the Spamhaus sbl-xbl list massively reduces spam. Setting that up on my backup MX

resulted in

...
all traffic through it stopping when my primary MX is up.

James,

Are you using greylisting or blacklisting with Spamhaus? My understanding of blacklisting is that blacklisting uses a DNS blacklist, such as Spamhaus. My understanding of greylisting is when your MTA sends back a temporary failure the first time in X number of days where it sees a new sender/receiver/mail server IP address triplicate. Please clarify.

Thanks, Barry

I believe he means that he is only greylisting incoming email when the server is listed in spamhaus. All other mail comes through without being greylisted (resulting in normal delivery times)

--Bill

James Fidell

6 p.m.

Bill Baird wrote:

...

...
...
I have found that greylisting based on the Spamhaus sbl-xbl list massively reduces spam. Setting that up on my backup MX

resulted in

...
all traffic through it stopping when my primary MX is up.

James,

Are you using greylisting or blacklisting with Spamhaus? My understanding of blacklisting is that blacklisting uses a DNS blacklist, such as Spamhaus. My understanding of greylisting is when your MTA sends back a temporary failure the first time in X number of days where it sees a new sender/receiver/mail server IP address triplicate. Please clarify.

Thanks, Barry

I believe he means that he is only greylisting incoming email when the server is listed in spamhaus. All other mail comes through without being greylisted (resulting in normal delivery times)

Exactly so.

James

Barry Brimer

26 Oct 26 Oct

2:40 a.m.

...

...
I believe he means that he is only greylisting incoming email when the server is listed in spamhaus. All other mail comes through without being greylisted (resulting in normal delivery times)

Exactly so.

Would you mind explaining how are you implementing this?

Thanks, Barry

James Fidell

2:48 p.m.

Barry Brimer wrote:

...

...
...
I believe he means that he is only greylisting incoming email when the server is listed in spamhaus. All other mail comes through without being greylisted (resulting in normal delivery times)

Exactly so.

Would you mind explaining how are you implementing this?

First, I'm using exim. No particular reason for this other than I know how to use it and even after many years hacking sendmail, I still find it easier to work with exim :) Now if I just had the time to get exim to play nicely with vpopmail...

For the greylisting I'm using greylistd, which comes as an RPM for RHEL4 from ATrpms. The initial whitelist file is in the docs installed with the RPM. You probably need it installed so you don't get problems with Yahoo Groups and the like.

My config is a bit tortuous because of various things I'm doing with the server, but I started off from the details here:

http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050124/msg00214.h...

You can't just cut'n'paste that into the exim config, but it's a reasonable place to start. If you're in need of more clues, I can write up what I did in a couple of days time.

James

Rodrigo Barbosa

6:27 p.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Thu, Oct 26, 2006 at 01:48:14PM +0100, James Fidell wrote:

...

Now if I just had the time to get exim to play nicely with vpopmail...

Now, why would you want that ? I can think of no reason why one would want to use exim + vpopmail.

...

For the greylisting I'm using greylistd, which comes as an RPM for RHEL4 from ATrpms.

Again, why would you want to do that ? I have greylisting implemented using only ACLs on exim, and it works great.

Best Regards,

- -- Rodrigo Barbosa "Quid quid Latine dictum sit, altum viditur" "Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFQOHVpdyWzQ5b5ckRAhD4AJ9ZDQRFFDu3LV42xLhir3kD7C+KgACgnNnJ 55toFa4H6AE68vQyeS0QIuU= =/7y+ -----END PGP SIGNATURE-----

Feizhou

27 Oct 27 Oct

5:01 a.m.

...

Now, why would you want that ? I can think of no reason why one would want to use exim + vpopmail.

vpopmail has great user management tools? vpopmail is supported by other mail related software such as dovecot and spamassassin. vpopmail supports mysql tables which lends itself to integration with other software that are mysql capable.

Why would one NOT want to use (favourite mta) + vpopmail?

Rodrigo Barbosa

5:19 a.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Fri, Oct 27, 2006 at 11:01:32AM +0800, Feizhou wrote:

...

...
Now, why would you want that ? I can think of no reason why one would want to use exim + vpopmail.

vpopmail has great user management tools? vpopmail is supported by other mail related software such as dovecot and spamassassin. vpopmail supports mysql tables which lends itself to integration with other software that are mysql capable.

Why would one NOT want to use (favourite mta) + vpopmail?

You do know that exim can talk directly with MySQL, right ? And since you can specify the SQL Queries, the database can have any format, thus integrating with everything else ?

I even have exim sharing the same table with radius (and currier-imap) on one of my sites.

Having exim talking directly with spamassassin is also very good and easy, and speed things up quite a bit.

Using things like maildrop, vpopmail, amavis etc with exim is just a good way to slow things down. The direct connection between exim and everything else (spamassassin, antivirus etc) allows you to reject mails during delivery, without the need to accept it before passing to another agent.

- -- Rodrigo Barbosa "Quid quid Latine dictum sit, altum viditur" "Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFQXq9pdyWzQ5b5ckRApXNAJ4wJZYI7bzgxHNjvSjF1/kx9w6sCACfZdD8 KA0HGC1hX6PU5e1Cp+0O0vE= =cVMv -----END PGP SIGNATURE-----

Feizhou

6:24 a.m.

Rodrigo Barbosa wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Fri, Oct 27, 2006 at 11:01:32AM +0800, Feizhou wrote:

...
...
Now, why would you want that ? I can think of no reason why one would want to use exim + vpopmail.

vpopmail has great user management tools? vpopmail is supported by other mail related software such as dovecot and spamassassin. vpopmail supports mysql tables which lends itself to integration with other software that are mysql capable.

Why would one NOT want to use (favourite mta) + vpopmail?

You do know that exim can talk directly with MySQL, right ? And since you can specify the SQL Queries, the database can have any format, thus integrating with everything else ?

So does postfix. You are missing the point. vpopmail comes with all the tools necessary. With postfix or exim, one would have to build their own.

...

I even have exim sharing the same table with radius (and currier-imap) on one of my sites.

Ah, so you have courier-auth library too.

...

Having exim talking directly with spamassassin is also very good and easy, and speed things up quite a bit.

Sure. spamassassin milter + postfix milter :P

...

Using things like maildrop, vpopmail, amavis etc with exim is just a good way to slow things down. The direct connection between exim and everything else (spamassassin, antivirus etc) allows you to reject mails during delivery, without the need to accept it before passing to another agent.

??? postfix -> maildrop -> home dir/Maildir

Nothing in my system goes through vpopmail. vpopmail only creates the Maildirs and maintains the mysql tables.

Rodrigo Barbosa

6:15 p.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Fri, Oct 27, 2006 at 12:24:22PM +0800, Feizhou wrote:

...

...
...
vpopmail has great user management tools? vpopmail is supported by other mail related software such as dovecot and spamassassin. vpopmail supports mysql tables which lends itself to integration with other software that are mysql capable.

Why would one NOT want to use (favourite mta) + vpopmail?

You do know that exim can talk directly with MySQL, right ? And since you can specify the SQL Queries, the database can have any format, thus integrating with everything else ?

So does postfix. You are missing the point. vpopmail comes with all the tools necessary. With postfix or exim, one would have to build their own.

Humm ? I never had to build any tools.

...

...
I even have exim sharing the same table with radius (and currier-imap) on one of my sites.

Ah, so you have courier-auth library too.

For courier-imap itself, of course. As far as I know, there is no other way to make courier-imap work.

...

...
Having exim talking directly with spamassassin is also very good and easy, and speed things up quite a bit.

Sure. spamassassin milter + postfix milter :P

Are we talking about exim or postfix ?

...

...
Using things like maildrop, vpopmail, amavis etc with exim is just a good way to slow things down. The direct connection between exim and everything else (spamassassin, antivirus etc) allows you to reject mails during delivery, without the need to accept it before passing to another agent.

??? postfix -> maildrop -> home dir/Maildir

Nothing in my system goes through vpopmail. vpopmail only creates the Maildirs and maintains the mysql tables.

If you are using postfix, then it does make send to use vpopmail. I'm not saying otherwise.

My point is only regarding Exim.

The thing is, many people don't realize that, when configuring exim to use mysql, you write the SQL queries on the configuration file, so you can pretty much do anything you want, even get data from multiple tables. Also, you can put SQL lookups everywhere, even on the ACLs (most specially on the ACLs), giving you a very good degree of flexibility.

Also, keeping everything happening inside exim, you make things much faster. You don't have to keep forking new processes (which is costly for the OS), and memory allocation is much smarter.

As I said, I don't have anything against vpopmail or maildrop. I'm just against using those with Exim. If you are using something else (sendmail, postfix, zmailer, qmail, whatever), you are very welcome to them.

- -- Rodrigo Barbosa "Quid quid Latine dictum sit, altum viditur" "Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFQjC6pdyWzQ5b5ckRAo+nAJ9Q37p6GSG7uFzQcf7wFBoKhzbCeACfflrV 5apUjTf/QIfcXii1p4wOFG0= =3oxQ -----END PGP SIGNATURE-----

Feizhou

30 Oct 30 Oct

3:02 p.m.

Rodrigo Barbosa wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Fri, Oct 27, 2006 at 12:24:22PM +0800, Feizhou wrote:

...
...
...
vpopmail has great user management tools? vpopmail is supported by other mail related software such as dovecot and spamassassin. vpopmail supports mysql tables which lends itself to integration with other software that are mysql capable.

Why would one NOT want to use (favourite mta) + vpopmail?

You do know that exim can talk directly with MySQL, right ? And since you can specify the SQL Queries, the database can have any format, thus integrating with everything else ?

So does postfix. You are missing the point. vpopmail comes with all the tools necessary. With postfix or exim, one would have to build their own.

Humm ? I never had to build any tools.

Oh? So account management was all manual via the sql command line?

...

...
...
I even have exim sharing the same table with radius (and currier-imap) on one of my sites.

Ah, so you have courier-auth library too.

For courier-imap itself, of course. As far as I know, there is no other way to make courier-imap work.

Yeah :D.

...

...
...
Having exim talking directly with spamassassin is also very good and easy, and speed things up quite a bit.

Sure. spamassassin milter + postfix milter :P

Are we talking about exim or postfix ?

Both. You can get exim to talk directly to spamassassin and postfix 2.3.3's milter capability alows the same with spamassassin milter.

...

...
...
Using things like maildrop, vpopmail, amavis etc with exim is just a good way to slow things down. The direct connection between exim and everything else (spamassassin, antivirus etc) allows you to reject mails during delivery, without the need to accept it before passing to another agent.

??? postfix -> maildrop -> home dir/Maildir

Nothing in my system goes through vpopmail. vpopmail only creates the Maildirs and maintains the mysql tables.

If you are using postfix, then it does make send to use vpopmail. I'm not saying otherwise.

You do not have to use vpopmail with postfix. postfix can do just about the same with its own virtual mail backend that supports SQL.

...

My point is only regarding Exim.

The thing is, many people don't realize that, when configuring exim to use mysql, you write the SQL queries on the configuration file, so you can pretty much do anything you want, even get data from multiple tables. Also, you can put SQL lookups everywhere, even on the ACLs (most specially on the ACLs), giving you a very good degree of flexibility.

Also, keeping everything happening inside exim, you make things much faster. You don't have to keep forking new processes (which is costly for the OS), and memory allocation is much smarter.

As I said, I don't have anything against vpopmail or maildrop. I'm just against using those with Exim. If you are using something else (sendmail, postfix, zmailer, qmail, whatever), you are very welcome to them.

The things that you have listed can all be done with postfix too. You can have SQL lookups just about anywhere in postfix too. postfix has its own virtual mail LDA that supports SQL and postfix can make use of that database at the smtp level too. Back to vpopmail, direct use of vpopmail tables will probably only be possible with exim and postfix.

So then, does exim provide user account management tools? Or is your sql backend also the system account backend? If not, did you not have to build tools to handle user account management or creation of user filter recipes?

Rodrigo Barbosa

3:35 p.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Mon, Oct 30, 2006 at 10:02:30PM +0800, Feizhou wrote:

...

...
On Fri, Oct 27, 2006 at 12:24:22PM +0800, Feizhou wrote:

...
...
...
vpopmail has great user management tools? vpopmail is supported by other mail related software such as dovecot and spamassassin. vpopmail supports mysql tables which lends itself to integration with other software that are mysql capable.

Why would one NOT want to use (favourite mta) + vpopmail?

You do know that exim can talk directly with MySQL, right ? And since you can specify the SQL Queries, the database can have any format, thus integrating with everything else ?

So does postfix. You are missing the point. vpopmail comes with all the tools necessary. With postfix or exim, one would have to build their own.

Humm ? I never had to build any tools.

Oh? So account management was all manual via the sql command line?

Depends if you call 3-line scripts a "tool" or "sql command line".

...

...
...
...
Having exim talking directly with spamassassin is also very good and easy, and speed things up quite a bit.

Sure. spamassassin milter + postfix milter :P

Are we talking about exim or postfix ?

Both. You can get exim to talk directly to spamassassin and postfix 2.3.3's milter capability alows the same with spamassassin milter.

That is not exactly the same thing, since with "milter", you are adding one more layer.

...

...
...
...
Using things like maildrop, vpopmail, amavis etc with exim is just a good way to slow things down. The direct connection between exim and everything else (spamassassin, antivirus etc) allows you to reject mails during delivery, without the need to accept it before passing to another agent.

??? postfix -> maildrop -> home dir/Maildir

Nothing in my system goes through vpopmail. vpopmail only creates the Maildirs and maintains the mysql tables.

If you are using postfix, then it does make send to use vpopmail. I'm not saying otherwise.

You do not have to use vpopmail with postfix. postfix can do just about the same with its own virtual mail backend that supports SQL.

Yes, but the virtual mail backend of postfix is much less flexible, and so using vpopmail makes sense.

...

The things that you have listed can all be done with postfix too. You can have SQL lookups just about anywhere in postfix too. postfix has its own virtual mail LDA that supports SQL and postfix can make use of that database at the smtp level too. Back to vpopmail, direct use of vpopmail tables will probably only be possible with exim and postfix.

So then, does exim provide user account management tools? Or is your sql backend also the system account backend? If not, did you not have to build tools to handle user account management or creation of user filter recipes?

If you have anything that does user management based on sql, you can make exim use those tables. Even tho I haven't tried, it is very likely that you can even use the same tools you use for vpopmail. Or for anything else.

[]s

- -- Rodrigo Barbosa "Quid quid Latine dictum sit, altum viditur" "Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFRg3FpdyWzQ5b5ckRApdqAKCQ3kJ0ta5U/rIvsu1K5pzCQn8iuQCgmz4I OTdoCh8SQFgnr049e17w+9s= =evf/ -----END PGP SIGNATURE-----

Feizhou

31 Oct 31 Oct

12:51 a.m.

...

...
Oh? So account management was all manual via the sql command line?

Depends if you call 3-line scripts a "tool" or "sql command line".

:D. Okay, I guess I will put it down to vpopmail relieves us of the need to design our own tables and write our own user management scripts.

...

...
Both. You can get exim to talk directly to spamassassin and postfix 2.3.3's milter capability alows the same with spamassassin milter.

That is not exactly the same thing, since with "milter", you are adding one more layer.

exim loads in spamassassin?

...

Yes, but the virtual mail backend of postfix is much less flexible, and so using vpopmail makes sense.

Interesting comment...for the umpteenthed time I must take a look at exim :P

...

If you have anything that does user management based on sql, you can make exim use those tables. Even tho I haven't tried, it is very likely that you can even use the same tools you use for vpopmail. Or for anything else.

I am sure exim can use the vpopmail tables for some stuff at the least. Do you use the Centos base exim or compile your own?

Rodrigo Barbosa

4:36 a.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Tue, Oct 31, 2006 at 07:51:57AM +0800, Feizhou wrote:

...

...
...
Both. You can get exim to talk directly to spamassassin and postfix 2.3.3's milter capability alows the same with spamassassin milter.

That is not exactly the same thing, since with "milter", you are adding one more layer.

exim loads in spamassassin?

spamd_address = 127.0.0.1 783

Then you just add the spam rules on the mime ACL.

...

...
Yes, but the virtual mail backend of postfix is much less flexible, and so using vpopmail makes sense.

Interesting comment...for the umpteenthed time I must take a look at exim :P

The main point is that Exim ACLs really rock. You can do everything there, ranging from SPF, Greylisting, spamassassin and av, mixing them to your delight. I can easily say that I don't want to check for spam or greylist authenticated users, unless they come from a give network and are sending e-mail to domain X. You can use some very interesting variables on the acls for control, something like:

warn set acl_m2 = ${lookup mysql{GREYLIST_TEST}{$value}{0}}

and then I can test for it:

condition = ${if eq{$acl_m2}{0}{1}}

...

...
If you have anything that does user management based on sql, you can make exim use those tables. Even tho I haven't tried, it is very likely that you can even use the same tools you use for vpopmail. Or for anything else.

I am sure exim can use the vpopmail tables for some stuff at the least. Do you use the Centos base exim or compile your own?

I actually build my own (rpm), since centos stock one isn't compiled for mysql nor spf.

If you want to take a look at my rpm, contact me off-list and I'll give you the url for download.

Best regards,

- -- Rodrigo Barbosa "Quid quid Latine dictum sit, altum viditur" "Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFRsSypdyWzQ5b5ckRAl5GAJ9e7+N8WwiiR24g3R1WC135/GYBXgCcCizL TXBCrzdBAF93N2QyzOt6zCE= =TaHG -----END PGP SIGNATURE-----

Feizhou

4:51 a.m.

...

...
...
That is not exactly the same thing, since with "milter", you are adding one more layer.

exim loads in spamassassin?

spamd_address = 127.0.0.1 783

Then you just add the spam rules on the mime ACL.

:D. spamassassin-milter = spamd. The milter is a running process that loads in spamc and is multi-threaded. That should make it equal :)

...

...
...
Yes, but the virtual mail backend of postfix is much less flexible, and so using vpopmail makes sense.

Interesting comment...for the umpteenthed time I must take a look at exim :P

The main point is that Exim ACLs really rock. You can do everything there, ranging from SPF, Greylisting, spamassassin and av, mixing them to your delight. I can easily say that I don't want to check for spam or greylist authenticated users, unless they come from a give network and are sending e-mail to domain X. You can use some very interesting variables on the acls for control, something like:

warn set acl_m2 = ${lookup mysql{GREYLIST_TEST}{$value}{0}}

and then I can test for it:
      condition = ${if eq{$acl_m2}{0}{1}}

I like the if parts :). With postfix, I would have to chain stuff around to get this kind of behaviour.

Rodrigo Barbosa

5:25 a.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Tue, Oct 31, 2006 at 11:51:47AM +0800, Feizhou wrote:

...

...
...
...
That is not exactly the same thing, since with "milter", you are adding one more layer.

exim loads in spamassassin?

spamd_address = 127.0.0.1 783

Then you just add the spam rules on the mime ACL.

:D. spamassassin-milter = spamd. The milter is a running process that loads in spamc and is multi-threaded. That should make it equal :)

postfix -> milter -> spamd exim -> spamd

Not exactly equal :)

...

...
The main point is that Exim ACLs really rock. You can do everything there, ranging from SPF, Greylisting, spamassassin and av, mixing them to your delight. I can easily say that I don't want to check for spam or greylist authenticated users, unless they come from a give network and are sending e-mail to domain X. You can use some very interesting variables on the acls for control, something like:

warn set acl_m2 = ${lookup mysql{GREYLIST_TEST}{$value}{0}}

and then I can test for it:
     condition = ${if eq{$acl_m2}{0}{1}}
I like the if parts :). With postfix, I would have to chain stuff around to get this kind of behaviour.

Did I mention you can have several conditions for the same rule ? :)

[]s

- -- Rodrigo Barbosa "Quid quid Latine dictum sit, altum viditur" "Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFRtA8pdyWzQ5b5ckRAr8RAKCtRbaIgopwdpAAqO5/TDpMglS7EACfTr1w Rq4G3M5Pur1b6Z1f6GjWJmY= =cH0j -----END PGP SIGNATURE-----

Feizhou

6:14 a.m.

...

...
:D. spamassassin-milter = spamd. The milter is a running process that loads in spamc and is multi-threaded. That should make it equal :)

postfix -> milter -> spamd exim -> spamd

Not exactly equal :)

Ah yes...spamc is a client for spamd...I need more sleep

...

...
...
The main point is that Exim ACLs really rock. You can do everything there, ranging from SPF, Greylisting, spamassassin and av, mixing them to your delight. I can easily say that I don't want to check for spam or greylist authenticated users, unless they come from a give network and are sending e-mail to domain X. You can use some very interesting variables on the acls for control, something like:

warn set acl_m2 = ${lookup mysql{GREYLIST_TEST}{$value}{0}}

and then I can test for it:
     condition = ${if eq{$acl_m2}{0}{1}}
I like the if parts :). With postfix, I would have to chain stuff around to get this kind of behaviour.
Did I mention you can have several conditions for the same rule ? :)

Tricky but doable on postfix too on depending on what you are looking for.

Feizhou

27 Oct 27 Oct

4:58 a.m.

...

First, I'm using exim. No particular reason for this other than I know how to use it and even after many years hacking sendmail, I still find it easier to work with exim :) Now if I just had the time to get exim to play nicely with vpopmail...

easy. Use maildrop as your LDA. maildrop can be used as the glue between postfix and vpopmail. You can do the same for exim. But if you want to make use of the dot-qmail files...that is another story.

Aleksandar Milivojevic

25 Oct 25 Oct

4:52 p.m.

Quoting James Fidell james@cloud9.co.uk:

...

It's sorely tempting to set up a lowest-priority MX that either points to 127.0.0.1, or to a machine that has a daemon on port 25 just returning 4xx SMTP errors in response to every connection.

While it might be tempting, you'll end up loosing some legitimate email. You might also end up being automatically blacklisted by some sites. Some sites block domains that have 127.0.0.1 in MX list. Sometimes, MX lookup on domain part of sender's address in viruses and spam returns a name that when resolved points to 127.0.0.1. Intention is that if bounce is generated, it goes to the local account. Mail servers are way too often configured to include copy of original email in the bounce. Since bounce is generated locally it might bypass spam/virus checks. Sneeky, eh.

I've also seen MTA implementations that don't really care about priorities, they simply connect to the first MX that DNS query returned. It's broken all right, but that's how the things are.

Even with just the "standard" greylisting (no 127.0.0.1 or always return 4xx on lowest priority MX tricks), you'll get in trouble from time to time. I'm not talking about delivery delays (that can be longer than one hour in worst case).

The Symantec Antivirus for Mail Gateways (at least some versions of it) generates warning email back to the sender when it gets 4xx. Rather annoying to the senders that happen to work at places that have it deployed on the border.

Some mail servers (not sure if it's MTA itself or misconfiguration on the admin part though) treat 4xx same as 5xx. No retries, they bounce mail right away.

Some sites have server farms for outgoing mail. If you greylist only on sender/recipient pair, no big deal. If you greylist on sender/recipient/IP triplet, some emails will never pass greylisting since connection comes from different IP address every time. Most greylisting implementations that check the triplet come with whitelisting support and predefined lists of some well known big sites that have farms for outgoing email. But you can always hit some not on the list. I've got bit by that some time ago when I was experimenting with greylisting on my personal domain.

In short, while greylisting reduces spam significantly, be prepared that it's not trouble-free solution. Be prepared to implement workarounds for troublesome sites (boils down to some sort of whitelisting). Your users don't care that MTA on the sender's side is broken. They want to exchange emails, and the intial delay introduced by greylisting is already annoying enough for them (for some even more annoying than spam).

As more sites implement greylisting, spammers are more likely to start retrying addresses they got 4xx. I already see more and more spammers doing this. This makes gerylisting a "temporary solution" that works now. In future it will be less and less effective.

It's the same thing as with SPF/CallerID/DomainKey. Analysis shows that even today volume of spam that fails SPF/CallerID/DomainKey checks is about the same as volume of spam that pass those checks (actually, those checks are not designed to detect or block spam, they are designed to attempt to prevent others to use your domain name in faked email addresses). With domains being sold for around $10/year, I don't see much use of forcing spammers to use their own domain though (so we can blacklist them). The trouble with "allow unless explicitly denied" approach is that it doesn't really work. It's the truth you'll find in chapter one of any book on security. Spammers can easilly use fresh new domain for each single mass mailing. It will only bring the increased revenue to domain registrars (and we'll see number of entries in com/net/org zones on top-level DNS servers exploding).

Want to start new domain registrar business? Now might be a good time. If this SPF/CallerID/DomainKey thing becomes widespread, you'll get your share from spammers profits (as they will be forced to buy new domains at least on monthly basis, if not more often).

Spam is a multi-billion dollar business. Regardless of which side of the fence you sit.

-- NOTICE: If you are not intended recipient, you are hereby notified that by reading this message you agreed not to disturb frogs during mating season. For more info, visit http://www.8-P.ca/

James Fidell

6:10 p.m.

Aleksandar Milivojevic wrote:

...

In short, while greylisting reduces spam significantly, be prepared that it's not trouble-free solution. Be prepared to implement workarounds for troublesome sites (boils down to some sort of whitelisting). Your users don't care that MTA on the sender's side is broken. They want to exchange emails, and the intial delay introduced by greylisting is already annoying enough for them (for some even more annoying than spam).

Very true. One of the reasons I only greylist based on the sbl/xbl is to avoid some of the problems you list. I also use a whitelist of sites known to have problems with greylisting elsewhere in my spam filtering. It's never going to be a perfect solution though.

...

As more sites implement greylisting, spammers are more likely to start retrying addresses they got 4xx. I already see more and more spammers doing this. This makes gerylisting a "temporary solution" that works now. In future it will be less and less effective.

Quite so. It will still slow them down, but given the resources they have access to, probably not very much. Combining it with teergrubing may help, too, but things will just escalate :(

James

John Hinton

6:45 p.m.

James Fidell wrote:

...

Aleksandar Milivojevic wrote:

...
In short, while greylisting reduces spam significantly, be prepared that it's not trouble-free solution. Be prepared to implement workarounds for troublesome sites (boils down to some sort of whitelisting). Your users don't care that MTA on the sender's side is broken. They want to exchange emails, and the intial delay introduced by greylisting is already annoying enough for them (for some even more annoying than spam).

Very true. One of the reasons I only greylist based on the sbl/xbl is to avoid some of the problems you list. I also use a whitelist of sites known to have problems with greylisting elsewhere in my spam filtering. It's never going to be a perfect solution though.

...
As more sites implement greylisting, spammers are more likely to start retrying addresses they got 4xx. I already see more and more spammers doing this. This makes gerylisting a "temporary solution" that works now. In future it will be less and less effective.

Quite so. It will still slow them down, but given the resources they have access to, probably not very much. Combining it with teergrubing may help, too, but things will just escalate :(

James

Teergrubing/tarpitting is actually a technology I am most interested in. Maybe allow 0.1k/sec flow in. It's not one that alone, as in just my mailservers, would have a lot of effect... but if it were used by many systems, this could drastically reduce the flow of spam. It could be done at varying levels, such as only on SpamHaus sbl/xbl... and then perhaps on local rules created adding those new boxes/IP addresses which show up each day. To me, it also seems this has the potential of tying up the compromised computers to the point where the owner/user might realize that they must do something about 'this slow computer'.

I don't think my users would be too happy with greylisting, unless it was done only on blocklist, as they have come to enjoy the immediate delivery of email. Also, greylisting has the potential of hurting other ISPs, clogging their systems, just because they signed up a few 'stupid users' who got the latest virus/trojan. If you think back to some of the more successful viruses, mailservers everywhere suffered with many choking and going down. Adding to their mail queues isn't so nice.

I do believe that the bulk of spam is still coming from compromised systems... or for sure the bulk of the troublesome spam. We subscribe to SpamHaus and that's the only blocklist I really trust. Our business is primarily in the lodging industry and the internet is responsible for around 80% of their bookings. No false positives is of utmost importance.

Another way to fight spam is to keep up with those networks that seem to invite spammers. Someone mentioned AOL as doing a great job. I have to agree. Yes, I've had my moments of frustration, but.... we have cures. I also much commend Earthlink and as of lately, Comcast. Only about a year ago Comcast was the largest spammer in the world. They joined in with what many providers agreed to as 'good email practices' and since April of this year have moved out of the top ten.

Verizon!!!! Boycot Verizon... turn in your cell phone, dump your DSL, change your T1 provider... Verizon is now by far the largest spamming network in the world. During a recent conference call between one of my clients and a Verizon Wireless technician, I discovered that their stance is "We provide a connection to the internet period." And the bottom line is they don't care if their network is being abused, don't care if a spammer is landing their other clients on blacklists... and seem to simply be turning their heads... selling connections to absolutely anyone for any use/abuse. Hurt them in the billfold.... they'll put an end to it. They have known spammer issues which go back as far as February of 2002!

John Hinton

Barry Brimer

3:32 p.m.

...

...
...
...
I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

I recommend greylisting. Check out http://www.greylisting.org. I run gld with a postfix MTA.

Barry

What RBL's, if any, do you use if we may ask?

I currently use:

sbl-xbl.spamhaus.org dnsbl.ahbl.org list.dsbl.org dnsbl.sorbs.net bl.spamcop.net dnsbl.njabl.org spews.dnsbl.sorbs.net cbl.abuseat.org relays.ordb.org

Barry

Scott Silva

8:34 p.m.

chrism@imntv.com spake the following on 10/24/2006 7:44 PM:

...

Jerry Geis wrote:

...
Gents,

I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

Running spamassassin + clamav and a few RBLs seemed to make a big dent in it for me, but a fair amount of crap still gets through. Frankly, I guess I'll never understand the mindset of the spammer. They go out of their way to circumvent spam controls for people who *obviously* don't want to receive those ads. It's like me telling my mum I don't like liver so she goes out of her way to sneak it into my diet knowing I'll gag on each bite. (no, my mum really knows I hate liver and doesn't do that...heh)

I wish the penalties for polluting the internet were half as potent as those for polluting the ocean. Perhaps then we'd see some improvement.

Cheers,

But the penalties for polluting the ocean are usually much less than the money the company doing the polluting saves by dumping the stuff. I have heard stories of $25,000 to $50,000 a day in penalties, while that company would have to pay millions to dispose of the waste legally. You do the math.

Anytime an entity with "less than stellar morals" can find that the profit is greater than the penalty, they see it as a "cost to do business". Spammers send tens of thousands of ads for very little cost. If it costs them a dollar, and they make 5, they will continue to try. I think the only way to stop spam will be if no one ( and absolutely no one) buys their wares. Spam is so cheap, and with international law being the way it is, so very hard to prosecute. They probably can make a profit if they only get one in 10,000 response rate.

-- MailScanner is like deodorant... You hope everybody uses it, and you notice quickly if they don't!!!!

Paul Heinlein

6:30 a.m.

On Tue, 24 Oct 2006, Jerry Geis wrote:

...

Gents,

I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

CentOS provides spamassassin 3.0.6, but I've installed spamassassin 3.1.7 and spamass-milter from rpmforge. Running your spam scanner as a milter allows you to reject egregious during the SMTP transaction.

I haven't done as much tuning as I'd like, but my current setup includes

INPUT_MAIL_FILTER( `clamav-milter', `S=local:/var/clamav/clmilter.sock, F=T, T=S:3m;R:3m') INPUT_MAIL_FILTER( `spamassassin', `S=unix:/var/run/spamass.sock, F=, T=C:15m;S4m;R:4m;E:10m') define( `confMILTER_MACROS_CONNECT', `b, j, _, {daemon_name}, {if_name}, {if_addr}') FEATURE(`dnsbl', `sbl-xbl.spamhaus.org', `"554 Mail rejected - http://www.spamhaus.org/query/bl?ip=%22$&%7Bclient_addr%7D')

The percentage of messages rejected during SMTP transactions breaks down (for me) like this:

74% == spamhaus 21% == spamassassin 2% == unresolvable sender domain <1% == clamav

There's a range of spam (scores 5.0 - 10.0) that's accepted for delivery but marked as spam; people can procmail those as they see fit.

I think the spamhaus numbers get inflated because the sending servers are typically bots that are set to try delivery several times before giving up.

-- Paul Heinlein <> heinlein@madboa.com <> www.madboa.com

Rodrigo Barbosa

5:09 p.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Tue, Oct 24, 2006 at 10:22:26PM -0400, Jerry Geis wrote:

...

Gents,

I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

Thanks

jerry

dnl # dnl # dnsbl - DNS based Blackhole List/Black List/Rejection list dnl # See http://www.sendmail.org/m4/features.html#dnsbl dnl # FEATURE(`dnsbl', `bl.spamcop.net', `"Spam blocked see: http://spamcop.net/bl.shtml?%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `relays.ordb.org', `"Spam blocked see: http://ordb.org/lookup/?host=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `cbl.abuseat.org', `"Spam blocked see: http://cbl.abuseat.org/lookup.cgi?ip=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `sbl.spamhaus.org', `"Spam blocked see: http://spamhaus.org/query/bl?ip=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `list.dsbl.org', `"Spam blocked see: http://dsbl.org/listing?%22$&%7Bclient_addr%7D%27)dnl dnl #

There have been a lot of replies (some very good) on this subject already, but I feel I have to drop my 2 cents on this subject, since spam control is a good part of what I do.

It is fairly trivial to get to a point where you have a spam control system with 75% efficiency (with 1% to 2% false positives). Just implementing RBLs, greylisting and spamassassin will do that. SPF might also help a bit here.

Wish a bit more work, you can get to 85% efficiency, keeping the same level of false positives (rate limiting and various access control rules).

After that point, it starts to get ugly. We currently manage to have 96% efficiency (false positives around 0.001%), and thats a daily battle. Spam traps and new rules almost every day (5 days a week, at least).

For those interested, these are the RBLs I use: sbl-xbl.spamhaus.org relays.ordb.org dnsbl.njabl.org

Dropped spamcop some months ago.

[]s

- -- Rodrigo Barbosa "Quid quid Latine dictum sit, altum viditur" "Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFP34lpdyWzQ5b5ckRAgRhAJ9NFSojm5DdbqjnCmIHSgFkNOlpWwCgueH4 NrEicr/sHZG4kH7CHrSO8qQ= =3nva -----END PGP SIGNATURE-----

David Mackintosh

7:54 p.m.

Jerry Geis wrote:

...

Gents,

I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

Thanks

jerry

dnl # dnl # dnsbl - DNS based Blackhole List/Black List/Rejection list dnl # See http://www.sendmail.org/m4/features.html#dnsbl dnl # FEATURE(`dnsbl', `bl.spamcop.net', `"Spam blocked see: http://spamcop.net/bl.shtml?%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `relays.ordb.org', `"Spam blocked see: http://ordb.org/lookup/?host=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `cbl.abuseat.org', `"Spam blocked see: http://cbl.abuseat.org/lookup.cgi?ip=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `sbl.spamhaus.org', `"Spam blocked see: http://spamhaus.org/query/bl?ip=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `list.dsbl.org', `"Spam blocked see: http://dsbl.org/listing?%22$&%7Bclient_addr%7D%27)dnl dnl #

CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

This question is probably inappropriate for this list, but maybe someone can answer it.

Let's pretend I have a network behind a firewall. And let's pretend that the users behind that firewall are both beyond my control, and have a non-zero population of idiots. And further, let's pretend that these idiots have done something to land my firewall's internet IP on a blacklist.

So now lets pretend I have a different system on the internet, running sendmail, that I would like to use to relay mail out through, for myself and a few carefully selected non-idiot users. And lets further pretend that this server is a secondary MX for a whole bunch of domains and so gets pounded with spam.

OK, I set up this server so that it grants RELAY permission in /etc/mail/access to the IP address that is on the blacklist and everything works.

Now I see the above post and think that adding dnsbl features to this sendmail might be a good way of reducing inbound spam.

So my question is: if my system has granted RELAY permission to a system which is in a dnsbl used by the sendmail configuration, does the sendmail RELAY, or does it deny the connection attempt?

Thanks for wading through this completely hypothetical situation.

Scott Silva

10:50 p.m.

David Mackintosh spake the following on 10/25/2006 10:54 AM:

...

Jerry Geis wrote:

...
Gents,

I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

Thanks

jerry

dnl # dnl # dnsbl - DNS based Blackhole List/Black List/Rejection list dnl # See http://www.sendmail.org/m4/features.html#dnsbl dnl # FEATURE(`dnsbl', `bl.spamcop.net', `"Spam blocked see: http://spamcop.net/bl.shtml?%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `relays.ordb.org', `"Spam blocked see: http://ordb.org/lookup/?host=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `cbl.abuseat.org', `"Spam blocked see: http://cbl.abuseat.org/lookup.cgi?ip=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `sbl.spamhaus.org', `"Spam blocked see: http://spamhaus.org/query/bl?ip=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `list.dsbl.org', `"Spam blocked see: http://dsbl.org/listing?%22$&%7Bclient_addr%7D%27)dnl dnl #

CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

This question is probably inappropriate for this list, but maybe someone can answer it.

Let's pretend I have a network behind a firewall. And let's pretend that the users behind that firewall are both beyond my control, and have a non-zero population of idiots. And further, let's pretend that these idiots have done something to land my firewall's internet IP on a blacklist.

So now lets pretend I have a different system on the internet, running sendmail, that I would like to use to relay mail out through, for myself and a few carefully selected non-idiot users. And lets further pretend that this server is a secondary MX for a whole bunch of domains and so gets pounded with spam.

OK, I set up this server so that it grants RELAY permission in /etc/mail/access to the IP address that is on the blacklist and everything works.

Now I see the above post and think that adding dnsbl features to this sendmail might be a good way of reducing inbound spam.

So my question is: if my system has granted RELAY permission to a system which is in a dnsbl used by the sendmail configuration, does the sendmail RELAY, or does it deny the connection attempt?

Thanks for wading through this completely hypothetical situation.

:)

If you allow in the access file, it should override the dns blacklist. So if you allowed an address in the blacklist, it should let it through.

-- MailScanner is like deodorant... You hope everybody uses it, and you notice quickly if they don't!!!!

Mike Kercher

26 Oct 26 Oct

1:33 a.m.

centos-bounces@centos.org <> scribbled on Wednesday, October 25, 2006 3:51 PM:

...

David Mackintosh spake the following on 10/25/2006 10:54 AM:

...
Jerry Geis wrote:

...
Gents,

I have added the following to /etc/mail/sendmail.mc and rebuilt it trying to control spam. I still get about 25 spam messages a day. Is there something else that can help control spam?

Thanks

jerry

dnl # dnl # dnsbl - DNS based Blackhole List/Black

List/Rejection list dnl

...
...
# See http://www.sendmail.org/m4/features.html#dnsbl dnl # FEATURE(`dnsbl', `bl.spamcop.net', `"Spam blocked see: http://spamcop.net/bl.shtml?%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `relays.ordb.org', `"Spam blocked see: http://ordb.org/lookup/?host=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `cbl.abuseat.org', `"Spam blocked see: http://cbl.abuseat.org/lookup.cgi?ip=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `sbl.spamhaus.org', `"Spam blocked see: http://spamhaus.org/query/bl?ip=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `list.dsbl.org', `"Spam blocked see: http://dsbl.org/listing?%22$&%7Bclient_addr%7D%27)dnl dnl #

CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

This question is probably inappropriate for this list, but maybe someone can answer it.

Let's pretend I have a network behind a firewall. And let's pretend that the users behind that firewall are both beyond my control, and have a non-zero population of idiots. And further, let's

pretend that

...
these idiots have done something to land my firewall's

internet IP on

...
a blacklist.

So now lets pretend I have a different system on the

internet, running

...
sendmail, that I would like to use to relay mail out through, for myself and a few carefully selected non-idiot users. And

lets further

...
pretend that this server is a secondary MX for a whole bunch of domains and so gets pounded with spam.

OK, I set up this server so that it grants RELAY permission in /etc/mail/access to the IP address that is on the blacklist and everything works.

Now I see the above post and think that adding dnsbl

features to this

...
sendmail might be a good way of reducing inbound spam.

So my question is: if my system has granted RELAY permission to a system which is in a dnsbl used by the sendmail configuration, does the sendmail RELAY, or does it deny the connection attempt?

Thanks for wading through this completely hypothetical situation.

:)

If you allow in the access file, it should override the dns blacklist. So if you allowed an address in the blacklist, it should let it through.

I think this is true IF you have FEATURE(delay_checks) specified in your sendmail.mc (thus your cf)

Mike

6618

Age (days ago)

6624

Last active (days ago)

discuss@lists.centos.org

49 comments

21 participants

tags (0)

participants (21)

Aleksandar Milivojevic
Barry Brimer
Bill Baird
Bill Church
chrism＠imntv.com
Collins Richey
DamianS
David Mackintosh
Feizhou
Gavin Carr
James Fidell
Jerry Geis
Jim Perrin
John Hinton
Mark Weaver
Mike Kercher
Paul Heinlein
R Lists06
Rodrigo Barbosa
Scott Silva
William Warren