Newsgroup: it.news.net-abuse
Titolo: [STATISTICHE] spam rifiutato da attila.bofh.it (giugno 2004)

Queste sono le statistiche aggregate dello spam rifiutato da
attila.bofh.it
 tra queste date:
Jun 6 06:52:11
Jul 4 06:49:37
Al momento della generazione di queste statistiche, il server era
protetto (nell'ordine) da queste DNSBL:
sbl-xbl.spamhaus.org
list.dsbl.org
dnsbl.njabl.org
korea.services.net
relays.ordb.org
dul.dnsbl.sorbs.net
l1.spews.dnsbl.sorbs.net
 339795	DNSBL 
xbl.spamhaus.org
 121269	Bad HELO
 100530	Sender address rejected
  78783	DNSBL 
dul.dnsbl.sorbs.net
  52910	header checks
  41147	body checks
  40865	Recipient address rejected
  29380	DNSBL 
dnsbl.njabl.org
  25147	DNSBL 
list.dsbl.org
  18928	Client host rejected
  18569	DNSBL 
korea.services.net
   4777	User unknown
   4770	DNSBL 
sbl.spamhaus.org
   4643	DNSBL 
l1.spews.dnsbl.sorbs.net
   3989	Relay access denied
   2682	Need FQDN address
   1614	Other
    160	DNSBL 
relays.ordb.org
     23	Need FQDN address (recipient)
      9	Bad pipelining
 889990	TOTAL
Rejected headers:
  31083	no executable attachments allowed
  14701	Gibe-F/Swen.A worm
   3865	keep your viruses for yourself (ZIP)
   2645	Your mailer is not RFC 2047 compliant
    549	do not send stupid bounces
     55	Message content rejected
      4	we do not accept automatically generated complaints
      4	Ralsky from 
cta.cq.cn
      3	sex spam not allowed
      1	Ralsky from 
cqnet.com.cn
Rejected bodies
  12866	keep your viruses for yourself (hidden iframe)
   9924	suspicious .zip file detected
   7835	
wonderland.linux.it
 is being forged by a spammer (SBL13098)
   5140	suspicious .zip file detected (password-protected)
   2678	
wonderland.linux.it
 is being forged by a spammer (SBL11848 93)
   1801	
wonderland.linux.it
 is being forged by a spammer (SBL11848 45)
    511	
wonderland.linux.it
 is being forged by a spammer (SBL14905)
    342	
wonderland.linux.it
 is being forged by a spammer (SBL12959)
     49	do not send stupid bounces
      1	
wonderland.linux.it
 is being forged by a spammer (SBL11848)
Rejected HELO commands
  99907	using my own HELO hostname
  16222	fake IP literal in HELO hostname
   3507	forged HELO hostname
   1043	unqualified HELO hostname
    590	Invalid name
Rejected hosts
  15079	Too much spam from CHINANET
   3520	non accettiamo posta da IP dinamici
    244	Too much spam from 
gwbn.net.cn
     29	Too much spam from 
ethome.net.tw
     28	Too much spam from your site
     19	Too much spam from 
chinamobile.com
      6	nigerian spam source
      3	Too much spam from 
consultingweb.it
-- 
ciao,
Marco

 Jul 4 06:49:37
Ciao, volevo chiederti che programma utilizzi per proteggere la tua rete.
Grazie mille
    Nicola Trevisan

Ciao, volevo chiederti che programma utilizzi per proteggere la tua rete.
http://www.postfix.org/
-- 
ciao, |
Marco |  The Italian Usenet Cabal, Abuse Department (TINC)
"It's about damn time that all of us who actually give a damn about Usenet
stand up and tell the people who don't to fuck off and die." -- Russ Allbery

 
Intendi /dev/brain - postfix esclusi? :P

      19 Too much spam from 
chinamobile.com
Che range di ip tieni?

pent...@despammed.com
 wrote:

61.128-191              REJECT Too much spam from CHINANET
202.96-111              REJECT Too much spam from CHINANET
218.0-95                REJECT Too much spam from CHINANET
211.136.0.0/13
          REJECT Too much spam from 
chinamobile.com
220.112.0.0/14
          REJECT Too much spam from 
gwbn.net.cn
80.180.0.0/14
           REJECT non accettiamo posta da IP dinamici
A proposito, questa è la mia nuova configurazione, che funziona
correttamente con postfix 2.x:
smtpd_helo_required = yes
smtpd_recipient_restrictions =
        reject_invalid_hostname
        reject_non_fqdn_sender
        reject_non_fqdn_recipient
        reject_unknown_sender_domain
        reject_unknown_recipient_domain
        permit_mynetworks
        reject_unauth_destination
#       check_recipient_access hash:/etc/postfix/recipient_access
        check_helo_access pcre:/etc/postfix/helo_access.pcre
        check_helo_access hash:/etc/postfix/helo_access
        check_sender_access hash:/etc/postfix/sender_access
        check_client_access hash:/etc/postfix/access
#       check_policy_service inet:
127.0.0.1:9999
        reject_rbl_client 
sbl-xbl.spamhaus.org
        reject_rbl_client 
list.dsbl.org
        reject_rbl_client 
dnsbl.njabl.org
        reject_rbl_client 
korea.services.net
        reject_rbl_client 
relays.ordb.org
        reject_rbl_client 
dul.dnsbl.sorbs.net
        reject_rbl_client 
l1.spews.dnsbl.sorbs.net
        permit
smtpd_data_restrictions =
        reject_unauth_pipelining
        permit
header_checks = pcre:/etc/postfix/header_checks
body_checks = pcre:/etc/postfix/body_checks


 correttamente con postfix 2.x:
Assomiglia parecchio alla mia. Io ho aggiunto anche:
         reject_rhsbl_client 
blackhole.securitysage.com
,
         reject_rhsbl_sender 
blackhole.securitysage.com
,
Qualcosa prendono (~1.5% negli ultimi 21gg)
Con:
    whois TELECOM-ADSL-2 @
whois.ripe.net
|grep inetnum	
    whois TELECOM-ADSL-3 @
whois.ripe.net
|grep inetnum
becco qualcosa di utile o nel mezzo ci sono anche gli IP
statici (che non vorrei filtrare) e/o quei dati non sono
del tutto affidabili?

del tutto affidabili?
Io blocco 
80.180.0.0/14
 e so che ci sono dentro degli IP statici, ma è
talmente raro che uno di loro mi mandi posta e dagli altri mi arriva
abbastanza spam che è più comodo usare una whitelist quando necessario.


 
80.180.0.0/14
           REJECT non accettiamo posta da IP dinamici
Se puo' interessare ultimamente sto ricevendo spam da chinanet dai seguenti
blocchi di ip:
221.224.0.0-221.231.255.255
221.232.0.0-221.235.255.255
221.236.0.0-221.237.255.255
222.76.0.0-222.79.255.255
222.83.0.0-222.84.255.255
222.88.0.0-222.89.255.255
222.240.0.0-222.247.255.255
-- 
Veneziano Davide
http://www.vene.ws
ICQ# 14047537