Hi there,

Yes - i like to collect in real time all Limbo IPs "IP cache Blacklist" into a text file as spamfilter is running. Anyone doing this?  if it is not simple, then is there a way to do it offline from logs?

my second question:  how can i filter IPs based on keywords that RDNS of IP reports? I mean, how can i RegEX any IP number of sender server which has a PTR string with *.dhcp.* or *.dynamic.* and so on... 

lastly,  I get a lot of IPs in limbo cache, but they very very seldom ever go over 3 strike. So figure spammer is smarter. Can i safely lower the block IP threshold in limo list?  is anyone using two or one??

Any help is much appreciated. Many Thanks

S.

Let me throw an idea into the frey ... we have done quite a bit of experimenting with the IP Cache values.  We struck upon:

IPCacheLimboCountTrigger=6
;
IPCacheLimboTimeTrigger=1
;
IPCacheBlacklistDuration=30

This has worked well at protecting the Spamfilter with the periodic email phishing attacks we get.  The low time trigger makes it quick to respond to abuse. The 30 minute time period allows for retries of valid email.  If the spammer is persistant then they simply end up blacklisted a minute after the duration has expired.

Anybody else try this?