#dnsbl

The email files: se 40000 in blocklist vi sembran pochi

Vabbeh giusto un paio di giorni fa mi son trovato a discorrere di una richiesta di un SOC di mettere 40000 domini in una email-blocklist. Ho cercato di spiegare che la cosa non ha senso, ma ho trovato una certa rigidità in merito. Poi mi sono soffermato un attimo e mi son chiesto: io parlo di sicurezza, ma loro? E mi son ricordato di quando cercavo di spiegare che mettere miliardi di regole su…

Finally it happened. 

Suomispam does get people upset pretty often. Especially spammers really do not like it when we list their domains or IP’s. Every now and then they threaten to either sue us or file criminal complaints against us. Those are almost always empty threats. We know our legal basis pretty well so we do not feel particularly threatened by them. All those threats do is block the possibility of reëvaluation of the listing in the near timeframe.

However, finally someone actually did file a criminal complain due to Suomispam listing them. This “brave” spammer in question was toimistotarviketukku.fi (Owela Oy) whose chairman of the board Tero Ojala filed a criminal complaint with the police. He asked the police to investigate if Suomispam is guilty of interfering with electronic communications. Unfortunately he apparently did not know that the statute does not cover what reputation databases do. (It covers only unlawfully interfering with communications). 

The admins of email servers are perfectly in their right to filter emails using blacklist information and Suomispam absolutely has the right to distribute reputation information to user organisations. It is basically the same legal principle of it being lawful for restaurant critics to tell everyone how certain restaurants serve terrible food. Even if it may be bad for business for the restaurants to get bad reviews.

Filtering the Web With Proxy Servers

C O N T E N T S: KEY TOPICS Icon Description A popular Proxy server for Windows., and web filtering in one.(More…) While explicit web proxy is widely used for web filtering, and does a good job in well-controlled environments, maintaining such a process is a difficult and time consuming task for IT admins.(More…) Squid is a high-performance proxy caching server for web clients, supporting FTP,…

Para realizar testes em bases de DNSBL, basta uma simple consulta de DNS por registros TXT por um FQDN composto do IP reverso que gostaria de consultar + o endereço da lista, por exemplo:

Irei consultar o endereço de IP hipotético 1.2.3.4 na lista dnsbl da sorbs cujo url é dnsbl.sorbs.net. Então minha busca pelo IP reverso + a lista seria 4.3.2.1.dnsbl.sorbs.net

Irei demonstrar com 2 endereços de…

Comment ca marche ? Je recois une connexion de l'adresse ip 178.41.131.179 sur le serveur smtp, que je soupconne d'etre un vilain spammeur.

Avant d'aller plus loin dans la discussion SMTP, je vérifie auprès d'un serveur dnsbl si cette adresse ip est référencée comme sujette a l'envoi de spams.

Un serveur dnsbl est un serveur dns qui répond par un champ NXDOMAIN si l'adresse est "clean" et par une adresse ip 127.0.0.x si l'adresse est "not clean".

Demandons au dnsbl spamhaus (il en existe beacoup d'autres) si l'adresse ip 178.41.131.179 peut etre considérée comme fiable

# dig -t any 179.131.41.178.sbl-xbl.spamhaus.org +short 127.0.0.4 "http://www.spamhaus.org/query/bl?ip=178.41.131.179"

la réponse 127.0.0.4 indisque que cette @ip ne devrait pas envoyer des mails.

La meme chose avec un serveur de gmail:

# dig  43.160.85.209.sbl-xbl.spamhaus.org +short

Pas de réponse, on considère alors que ce serveurs est clean