LogSat Software

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   We already have the following options in our spamfilter.ini, whats below is what I have in mine. Anyways, why not add more to this. If multiple IPs in the same class C end up in the limboblacklistcache, why not give us the option to autoblacklist the whole class c after a customizable number of IPs appear from that class c. So for example, 3 IPs in my limbo are all on the same class C. take it and auto blacklist the whole class C automatically to the IP blacklist.  Also what about adding permanent abilities to the already available options below? If a certain IP sends X number of spams add his IP to the IP blacklist. This would have to be a higher number as you dont want to end up with a boat load of IPs.  Well just some ideas. Maybe someones already had them Im not sure.  THoughts???

;If an IP sends more than this number of spams in a certain period of time then it is temporarily banned (blacklisted)
IPCacheLimboCountTrigger=3
;If an IP sends more than a certain number of spams during this number of minutes then it is temporarily banned (blacklisted)
IPCacheLimboTimeTrigger=60
;If an IP address was banned because it sent too many spams in a certain time interval, it will be un-banned after this number of minutes
IPCacheBlacklistDuration=90

Author	Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic
IKILLSPAM1 Members Profile Send Private Message Find Members Posts Add to Buddy List Groupie Joined: 02 May 2007 Location: United States Status: Offline Points: 70	Post Options Post Reply Quote IKILLSPAM1 Report Post Thanks(0) Quote Reply Topic: Idea-Possible future add in? Posted: 01 June 2007 at 9:42pm
	We already have the following options in our spamfilter.ini, whats below is what I have in mine. Anyways, why not add more to this. If multiple IPs in the same class C end up in the limboblacklistcache, why not give us the option to autoblacklist the whole class c after a customizable number of IPs appear from that class c. So for example, 3 IPs in my limbo are all on the same class C. take it and auto blacklist the whole class C automatically to the IP blacklist. Also what about adding permanent abilities to the already available options below? If a certain IP sends X number of spams add his IP to the IP blacklist. This would have to be a higher number as you dont want to end up with a boat load of IPs. Well just some ideas. Maybe someones already had them Im not sure. THoughts??? ;If an IP sends more than this number of spams in a certain period of time then it is temporarily banned (blacklisted) IPCacheLimboCountTrigger=3 ;If an IP sends more than a certain number of spams during this number of minutes then it is temporarily banned (blacklisted) IPCacheLimboTimeTrigger=60 ;If an IP address was banned because it sent too many spams in a certain time interval, it will be un-banned after this number of minutes IPCacheBlacklistDuration=90

LogSat Members Profile Send Private Message Find Members Posts Add to Buddy List Admin Group Joined: 25 January 2005 Location: United States Status: Offline Points: 4106	Post Options Post Reply Quote LogSat Report Post Thanks(0) Quote Reply Posted: 02 June 2007 at 1:15pm
	The idea is a good one. Do you have cases where this has happened, meaning an IP gets blacklisted in the cache, but then they resort to sending more emails from a different IP within the same class C? We've not seen a lot of this happening, however should spammers start to do this, again, the idea is very good.
	Roberto Franceschetti LogSat Software Spam Filter ISP

WebGuyz Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Member Joined: 09 May 2005 Location: United States Status: Offline Points: 348	Post Options Post Reply Quote WebGuyz Report Post Thanks(0) Quote Reply Posted: 02 June 2007 at 4:10pm
	We haven't seen this as an issue, but everyones spam situation is different. If implemented it should be able to be turned on/off in ini settings.
	http://www.webguyz.net

Desperado Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Member Joined: 27 January 2005 Location: United States Status: Offline Points: 1143	Post Options Post Reply Quote Desperado Report Post Thanks(0) Quote Reply Posted: 02 June 2007 at 7:40pm
	We do see this but are semi-afraid that aol or hotmail will get blocked more than they are now. That is 2 issues however. On the first: We see lots of cases where a spammer spans not only Class C's but Calss B's and this IS and issue that hounds us. HOWEVER... On the second Issues (of mine): I am getting many aol and hotmail server IP's on the black list and this then causes a period of false positives. While it erks me that both of the above mentioned services seem to block prematurely ... I am not happy to do the same. Comments?
	The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com

IKILLSPAM1 Members Profile Send Private Message Find Members Posts Add to Buddy List Groupie Joined: 02 May 2007 Location: United States Status: Offline Points: 70	Post Options Post Reply Quote IKILLSPAM1 Report Post Thanks(0) Quote Reply Posted: 05 June 2007 at 11:21am
	Yes Roberto, I actually monitor from time to time the blacklist limbo and if I see multiple ip's from same class c I paste it into notepad, change the last octet to .0 and then paste it into the IP blacklist in SFI. On a seperate note, IPs Ive added to the IP Blacklist file dont appear to be blocked, well I say that because there are IPs in the limbo cache which are in a class c I have blocked in the IP blacklist. So it appears that IP blacklist isnt working for me, otherwise I wouldnt be seeing them in limbo correct? I would also agree with Dan, I see some signs of class b's which appear to be all crap. With the limbo cache auto sorting the IPs, it makes it very easy to spot. I would also agree with webguyz, this would be an option in the ini which is tunable just like the other limbo cache settings are.

LogSat Software

Site Navigation[Skip]

Spam Filter ISP Support Forum

Idea-Possible future add in?