Spam Filter ISP Forums : Report IP to SFDB https://www.logsat.com/spamfilter/forums/ Sat, 14 Mar 2026 16:24:14 +0000 Sun, 11 Nov 2007 15:29:41 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6283 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Report IP to SFDB : Oh and all the rules that you...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11136&title=report-ip-to-sfdb#11136 Author: atifghaffar
Subject: 6283
Posted: 11 November 2007 at 3:29pm

Oh and all the rules that you see above only help me to reduce 30% of the spammers. If I want 80% spammer block then this rule should do it.

iptables -A INPUT -m geoip --src-cc US -j DROP

Unfortunately I cannot use this rule.
]]> Sun, 11 Nov 2007 15:29:41 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11136&title=report-ip-to-sfdb#11136 <![CDATA[Report IP to SFDB : Roberto, The firewall rules were...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11135&title=report-ip-to-sfdb#11135 Author: atifghaffar
Subject: 6283
Posted: 11 November 2007 at 3:27pm

Roberto,

The firewall rules were the last resort.

We had the spamflters so busy telling the connections ( you are not allowed) that there was no more time left to do anything.

With these rules the number of connections are way too less.

Also I made once a list by watching the limbo cache and the ips that were in the cache. Our watchlist allowed 10 connections after recievieving

$line=~/IP is in local blacklist cache/;

and then block them for good on the firewall.

The second rule (block by ip address) made a lot of hoo--haa (strangely).
No one has yet complained about the first (block by country) rule yet.

]]> Sun, 11 Nov 2007 15:27:11 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11135&title=report-ip-to-sfdb#11135 <![CDATA[Report IP to SFDB : As a side-note, SpamFilter is...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11123&title=report-ip-to-sfdb#11123 Author: LogSat
Subject: 6283
Posted: 10 November 2007 at 4:23pm

As a side-note, SpamFilter is able to block emails by country as well. If you let SpamFilter block unwanted countries rather than using firewall rules, you'll still be able to receive emails from blocked countries by using whitelists. If using firewall rules to block countries, it will be harder to allow emails from these countries (if there's ever a need). ]]> Sat, 10 Nov 2007 16:23:35 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11123&title=report-ip-to-sfdb#11123 <![CDATA[Report IP to SFDB : Thank you all for your suggestions....]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11120&title=report-ip-to-sfdb#11120 Author: StevenJohns
Subject: 6283
Posted: 09 November 2007 at 5:44pm

Thank you all for your suggestions. I am implementing some of them at the moment and will let you know how it goes.
 
Cheers
 
]]> Fri, 09 Nov 2007 17:44:39 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11120&title=report-ip-to-sfdb#11120 <![CDATA[Report IP to SFDB : Steven,This reduced the spam a...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11118&title=report-ip-to-sfdb#11118 Author: atifghaffar
Subject: 6283
Posted: 09 November 2007 at 12:47pm

Steven,

This reduced the spam a lot for us.

iptables -A INPUT -m geoip  --src-cc AF -j DROP
iptables -A INPUT -m geoip  --src-cc AG -j DROP
iptables -A INPUT -m geoip  --src-cc AR -j DROP
iptables -A INPUT -m geoip  --src-cc AI -j DROP
iptables -A INPUT -m geoip  --src-cc AL -j DROP
iptables -A INPUT -m geoip  --src-cc BG -j DROP
iptables -A INPUT -m geoip  --src-cc BR -j DROP
iptables -A INPUT -m geoip  --src-cc BY -j DROP
iptables -A INPUT -m geoip  --src-cc CO -j DROP
iptables -A INPUT -m geoip  --src-cc CL -j DROP
iptables -A INPUT -m geoip  --src-cc CM -j DROP
iptables -A INPUT -m geoip  --src-cc CN -j DROP
iptables -A INPUT -m geoip  --src-cc GT -j DROP
iptables -A INPUT -m geoip  --src-cc HK -j DROP
iptables -A INPUT -m geoip  --src-cc IN -j DROP
iptables -A INPUT -m geoip  --src-cc ID -j DROP
iptables -A INPUT -m geoip  --src-cc JP -j DROP
iptables -A INPUT -m geoip  --src-cc KG -j DROP
iptables -A INPUT -m geoip  --src-cc KR -j DROP
iptables -A INPUT -m geoip  --src-cc KZ -j DROP
iptables -A INPUT -m geoip  --src-cc MX -j DROP
iptables -A INPUT -m geoip  --src-cc MY -j DROP
iptables -A INPUT -m geoip  --src-cc NG -j DROP
iptables -A INPUT -m geoip  --src-cc PE -j DROP
iptables -A INPUT -m geoip  --src-cc PH -j DROP
iptables -A INPUT -m geoip  --src-cc RO -j DROP
iptables -A INPUT -m geoip  --src-cc RU -j DROP
iptables -A INPUT -m geoip  --src-cc SV -j DROP
iptables -A INPUT -m geoip  --src-cc TH -j DROP
iptables -A INPUT -m geoip  --src-cc TW -j DROP
iptables -A INPUT -m geoip  --src-cc UA -j DROP
iptables -A INPUT -m geoip  --src-cc VE -j DROP
iptables -A INPUT -m geoip  --src-cc VN -j DROP


]]> Fri, 09 Nov 2007 12:47:30 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11118&title=report-ip-to-sfdb#11118 <![CDATA[Report IP to SFDB : I myself have an ongoing lists...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11107&title=report-ip-to-sfdb#11107 Author: mbrusl
Subject: 6283
Posted: 05 November 2007 at 4:46pm

I myself have an ongoing lists of names and IPs that I get from the quarentine area everyday and put them in lists and have them available on my site at www.spacequad.com  One of my list has over 22 thousand known spammer domains that if that domain name is in the email, it gets trashed right away with no questions asked.  You can try using that as a suppliment as well.

Michael


]]> Mon, 05 Nov 2007 16:46:54 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11107&title=report-ip-to-sfdb#11107 <![CDATA[Report IP to SFDB : You could try tuning your SF configuration....]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11105&title=report-ip-to-sfdb#11105 Author: IKILLSPAM1
Subject: 6283
Posted: 05 November 2007 at 11:09am

You could try tuning your SF configuration. Maybe your not using it to its full potential.
 
Are you using DNSBLs, if so which? URBLs? Block no PTR,InvalidMX. Block countries with whom you dont communicate with. Setup keywords based on emails you get in. Bayesain Filtering. Honeypots, using email addrs sent in to invalid users. I tend to go into the quarantine and build a list from time to time of addresses that get lots of spam but which never even existed.
 
Used properly SF does a great job.
]]> Mon, 05 Nov 2007 11:09:19 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11105&title=report-ip-to-sfdb#11105 <![CDATA[Report IP to SFDB : OK, what do you suggest we do...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11103&title=report-ip-to-sfdb#11103 Author: StevenJohns
Subject: 6283
Posted: 05 November 2007 at 4:20am

OK, what do you suggest we do with the spam that is getting through then ???]]> Mon, 05 Nov 2007 04:20:02 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11103&title=report-ip-to-sfdb#11103 <![CDATA[Report IP to SFDB : This is currently not possible....]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11099&title=report-ip-to-sfdb#11099 Author: LogSat
Subject: 6283
Posted: 03 November 2007 at 10:47pm

This is currently not possible. Only SpamFilter itself is able to upload spammer data back to the SFDB (and this is done via encrypted parameters to avoid chances of poisoning the database with invalid data). We currently do not see adding the ability to upload new data to it in a different way.

We're currently working on developing another new filter similar to the SFDB, but which will track the actual contents of the emails even if they originate from unknown sources. We'll have more on this within a couple of months..
]]> Sat, 03 Nov 2007 22:47:46 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11099&title=report-ip-to-sfdb#11099 <![CDATA[Report IP to SFDB : Roberto, We are seeing an increasing...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11095&title=report-ip-to-sfdb#11095 Author: StevenJohns
Subject: 6283
Posted: 02 November 2007 at 6:24pm

Roberto,

We are seeing an increasing number of spam emails slip through the filters over the last few months. We run a secondary filtering system after SF which is catching these emails (fortunately the users don’t get them!), which is exactly what it is there for.

My understanding of the SFDB is that SF will report the IP if any of the SF filters get triggered. However, these filters are obviously not getting triggered and the spam is being let through. However, I would like to be able to take the sending smtp server IP and feed it into SFDB as a spam sending server as reported by our secondary filter.  How can I do this?

]]> Fri, 02 Nov 2007 18:24:43 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6283&PID=11095&title=report-ip-to-sfdb#11095