[ Date Index ]
[ Thread Index ]
[ <= Previous by date /
thread ]
[ Next by date /
thread => ]
Re: [LUG] OT: abusive IP address list processing or blocklist for web spam
- To: list@xxxxxxxxxxxxx
- Subject: Re: [LUG] OT: abusive IP address list processing or blocklist for web spam
- From: Simon Avery <digdilem@xxxxxxxxx>
- Date: Tue, 15 Jan 2013 11:15:16 +0000
- Delivered-to: dclug@xxxxxxxxxxxxxxxxxxxxx
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=ieNb4SVF5fnheNOU3GeRKbzidM7qjTtjCsyfVYpQXJ8=; b=Ezdx5Wtjf7PddB3m/m3AT9JjEqs/ty0rmyKr4TTsxqBADUNxLgL8/RFyCbm68CTSvt uxbHcPH/TTK3UnYem1TAsQp4hNNt+o12K2H9sAC2i4RPVZnz8hdX8efgrra5gY28uNDH zwQpkAJN1T1ULgu3LR2dKGhbYpN1MabOBqGpR+zyqsolx8JUJhJtdFBHU+HGAmq7yxLX Z+dIYn46IGRUT9sZjjBGu8Qymihr2n6GBkNrtCPdU+XwTOnHNYiirS88qllYdBLdDBUv nFzaCVJ2vVZtAm1vHqbeG4BQuXxCoW7Z9kbc10e9jvGYcbW3AMZwm/CfiwWz8EnR6vYK b4zA==
If you're considering blocking by ISP already, another angle of
defense, which you may already have thought of, is to block by country
of origin or country of relay. I've do this at SMTP for email for a
bunch of countries using Mail::SpamAssassin::Plugin::RelayCountry, and
there is stuff on CPAN to make a best guess on country and at least
one freely available geoip database. On a high traffic this may mean
unacceptable overhead.
Of course, if you have legitimate traffic from such countries (and I'm
seeing mostly Asian and Russian) my suggestion's not going to be a lot
of use. :)
--
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq
