Favorite Blacklists

garv221

Anyone have one for exchange they like? I have a few...

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

Non-Profit Techie

stupid question: what is a blacklist?

Drakonblayde

Email blacklist for smtp servers, so they'll reject users, domains, or ip's outright instead of wasting time processing a message

Personally, I've found forcing remote clients to be RFC compliant to cut down on ALOT of spam, but I'm not sure you can do that with Exchange. Postfix owns.

garv221

The one I was using shutdown, so I am using multiple ones now. I also completely blocked the country of Germany. ha..

lordy

I'm using the following:

bl.spamcop.net
list.dsbl.org
relays.ordb.org

I also completely blocked the country of Germany. ha..

Very smart... .US and .CN are way bigger spam sources...

Regards,
Lordy

garv221

I am using
http://relays.visi.com <

I think it might have shutdown?
cbl.abuseat.org
list.dsbl.org <

Favorite

The only real problem I had was from Germany sending German links. Once I blocked Germany, Spam was down 99%.

lordy

garv221 wrote:

I am using
http://relays.visi.com <
I think it might have shutdown?

Definitely dead.

The only real problem I had was from Germany sending German links. Once I blocked Germany, Spam was down 99%.

That's the infamous Sober virus. I noticed that many viruses send the receivers IP address in the HELO command.

Example:
SMTP-Server = 1.2.3.4
Infected-Host = 5.6.7.8

Infected-Host sends HELO 1.2.3.4 which is definitely incorrect. I have successfully blocked lots of Spam by filtering out clients that send specific HELO names (my IP, my domain, localhost) and this does far less colleteral damage then just filtering a whole country.

Regards,
Lordy

P.S.: My MTA is qmail.

garv221

lordy wrote:

That's the infamous Sober virus. I noticed that many viruses send the receivers IP address in the HELO command.

Example:
SMTP-Server = 1.2.3.4
Infected-Host = 5.6.7.8

Infected-Host sends HELO 1.2.3.4 which is definitely incorrect. I have successfully blocked lots of Spam by filtering out clients that send specific HELO names (my IP, my domain, localhost) and this does far less colleteral damage then just filtering a whole country.

Regards,
Lordy

P.S.: My MTA is qmail.

Nice feedback. That makes sense..I was getting so frustrated with the spam....I will see what information I can find (it was a while ago) & unblock Germany. I figured that blacklist was down. Do you know what happened? I use Exchange; qmail is without a doubt better. I do not have much experience with qmail or thats what I would run.

Ricka182

I use Mailwasher, which has three blacklists...I know one is Spamcop...works pretty well, lets me see the spam titles before I delete them in case of an error, and sorts out by friend, normal, or B-listed....