Print Page | Close Window

Idea-Possible future add in?

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6091
Printed Date: 09 March 2026 at 8:59pm


Topic: Idea-Possible future add in?
Posted By: IKILLSPAM1
Subject: Idea-Possible future add in?
Date Posted: 01 June 2007 at 9:42pm

We already have the following options in our spamfilter.ini, whats below is what I have in mine. Anyways, why not add more to this. If multiple IPs in the same class C end up in the limboblacklistcache, why not give us the option to autoblacklist the whole class c after a customizable number of IPs appear from that class c. So for example, 3 IPs in my limbo are all on the same class C. take it and auto blacklist the whole class C automatically to the IP blacklist.  Also what about adding permanent abilities to the already available options below? If a certain IP sends X number of spams add his IP to the IP blacklist. This would have to be a higher number as you dont want to end up with a boat load of IPs.  Well just some ideas. Maybe someones already had them Im not sure.  THoughts???

;If an IP sends more than this number of spams in a certain period of time then it is temporarily banned (blacklisted)
IPCacheLimboCountTrigger=3

;If an IP sends more than a certain number of spams during this number of minutes then it is temporarily banned (blacklisted)
IPCacheLimboTimeTrigger=60

;If an IP address was banned because it sent too many spams in a certain time interval, it will be un-banned after this number of minutes
IPCacheBlacklistDuration=90


Replies:
Posted By: LogSat
Date Posted: 02 June 2007 at 1:15pm
The idea is a good one. Do you have cases where this has happened, meaning an IP gets blacklisted in the cache, but then they resort to sending more emails from a different IP within the same class C? We've not seen a lot of this happening, however should spammers start to do this, again, the idea is very good.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: WebGuyz
Date Posted: 02 June 2007 at 4:10pm
We haven't seen this as an issue, but everyones spam situation is different. If implemented it should be able to be turned on/off in ini settings.

-------------
http://www.webguyz.net

Posted By: Desperado
Date Posted: 02 June 2007 at 7:40pm

We *do* see this but are semi-afraid that aol or hotmail will get blocked more than they are now.  That is 2 issues however.
On the first:  We see lots of cases where a spammer spans not only Class C's but Calss B's and this *IS* and issue that hounds us.  HOWEVER...
On the second Issues (of mine):  I am getting many aol and hotmail server IP's on the black list and this then causes a period of false positives.  While it erks me that both of the above mentioned services seem to block prematurely ... I am not happy to do the same.

Comments?



-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Posted By: IKILLSPAM1
Date Posted: 05 June 2007 at 11:21am

Yes Roberto, I actually monitor from time to time the blacklist limbo and if I see multiple ip's from same class c I paste it into notepad, change the last octet to .0 and then paste it into the IP blacklist in SFI.

On a seperate note, IPs Ive added to the IP Blacklist file dont appear to be blocked, well I say that because there are IPs in the limbo cache which are in a class c I have blocked in the IP blacklist. So it appears that IP blacklist isnt working for me, otherwise I wouldnt be seeing them in limbo correct?

I would also agree with Dan, I see some signs of class b's which appear to be all crap.  With the limbo cache auto sorting the IPs, it makes it very easy to spot.

I would also agree with webguyz, this would be an option in the ini which is tunable just like the other limbo cache settings are.


Print Page | Close Window