Re: New list of spammer IP addresses

[john@xxxxxxxxxxxxxxx (John Sievert)]

There are two files:

1. The list of spammer IP addresses that can be cut and pasted into 
the IP address block under the mail blocking config.
2. The list of 'bad Boy' domain names.  This can be put in as a name 
filter and is an OR'ing of alot of bad boy names.  You can put it in 
for either a look at the Src Host or From.

Note:  #2 will cause some performance degradation on sending mail. 
This will add some latency as Post.Office looks the mail over.  Once 
it passes the filter, it sends as before.   Tenon is looking at ways 
to increase the speed of some of these sorts of filters.  I am hoping 
that they will make it faster for a AND filter to fail.  For example: 
If you put your network IP address NOT AND this list of OR'ed 
spammers, then if it comes from your domain, it would send fail the 
filter quickly and not go through the OR ing.  Presently it doesn't 
work this way, but Tenon is looking it over.

The IP list is pretty effective at stopping alot of SPAM.  I would 
suggest that you save this as a text file and then batch submit it to 
nslookup to make sure that it isn't whacking any site that you might 
want.

Note that there are alot of networks specified in there - ending in 
'.0'.  However most of these have been verified to be spammer 
networks.  When we see the IP for a server, we do an nslookup to 
verify where it came from.  Most of the networks have been verified 
by looking for addresses in the vicinity.  If they return another 
server with the same domain - the network is listed.

It has worked very well for us and we are adding to it every day as 
we identify the recurrent spammers.  We keep this page up to date for 
our own use.  Please feel free to use it for your own use.  Only 
caveat is that we take no responsibility if it has an IP address that 
means something to you - that is your responsibility to check.

Regards,
John


On Monday, November 11, 2002, at 01:44 a, Nitai @ ComputerOil wrote:

> On 10.11.2002 4:11 AM, "John Sievert" <john@xxxxxxxxxxxxxxx> wrote:
>
> > I posted a new list of spammer IP addresses.  this can be copied and
> > pasted into the block ip list on post.office.
> >
> > Get it here:
> >
> > http://www.customer1st.com/AntiSpam/
> >
> > This has all your favorites like freelotto.com, bbwgroup.com, and many
> > other fun guys.  This list was responsible for 949 refused connections
> > on our server today!
>
> Thank you. What about the "list" file? Are these words to filter in the
> "from" header, or?
>
> Sincerely
> Nitai Aventaggiato
> CEO
>
> --
> Tools to energize your business
> Content Management & eBusiness Systems
>
> ComputerOil? GmbH               http://computeroil.com/
> Hauptstrasse 12                 info@xxxxxxxxxxxxxxx
> 8252 Schlatt/Switzerland
> Tel: +41 (0)52 654 15 55
> Fax: +41 (0)52 654 15 59
--
"Its what you do, not what you say.
If you're not part of the future, then get out of the way."
-John Cougar Mellencamp

John Sievert
Customer 1st, Inc.
2950 Metro Drive, Suite 101
Minneapolis, MN 55425
Phone: (952) 851-7901 (direct)
Fax: (952) 851-7907
Pager: mailto:john.pager@xxxxxxxxxxxxxxx (<150 chars)