Print Page | Close Window

NULL on Max # of recipients

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5435
Printed Date: 10 February 2026 at 6:38pm


Topic: NULL on Max # of recipients
Posted By: Guests
Subject: NULL on Max # of recipients
Date Posted: 05 January 2006 at 2:37pm
Hi,
    Is there an easy way to reject emails to NULL when it gets higher than the # of recipients (the setting in spamfilter).. we receive 30 to 40 outbreaks per hour of (75 emails) each time... from differents addresses... if we could drop the connection as soon as it gets outside the limit.. it would save on bandwidth... and definetively on Quarantine size...

Many thanks and keep up the good work.


Replies:
Posted By: LogSat
Date Posted: 05 January 2006 at 8:27pm
Stephane,

The option to send to NULL for that filter is not available, however the new SpamFilter ISP v2.7 features a new blacklist IP cache that will actually be even better. The "send to NULL" still forces SpamFilter to receive the full email, so bandwidth is still not saved. However with the new IP cache functionality, the "bad" IPs will be denied a connection. The following is an excerpt from the help file describing the new filter:

Enable Cached IP Blocking - If an IP address sends more than a certain number of spam emails (3 by default) during a certain time interval (10 minutes by default), then it can be temporarily banned (blacklisted). All further connections from that IP address will be immediately rejected without allowing the sender to transmit any data. This should greatly reduce the load on the server. A banned IP address will be automatically removed from this temporary blacklist after a defined time interval (60 minutes by default).


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Marco
Date Posted: 06 January 2006 at 8:44am

Would adding another threshhold, one that counts the number of connection attempts by the bad IP, be usefull for putting that IP into a permanent ban? (honeypotlist)

Marco



-------------
Anyone who is capable of getting himself made president, should on no account be allowed to do the job. D.Adams

Posted By: Guests
Date Posted: 06 January 2006 at 10:38am
Hi,

Is it not that effective for that kind of attack, since the attacks are coming from a different ip addresses each time (infected computers used as open relays or others ..) But the connection would be dropped when the max number of recipient is reach ? I can do so at this moment, manually by using the connection screen and terminate the connection for which is sending more that # of recipient.

Thanks.


Print Page | Close Window