> Personally i filter based on IP and sender domain. > > My company does not do business with anyone out > site the USA so i can block most international domains > without legitimate messages getting blocked.
Uhm .. what if someone outside US gets a message from "you" and wants to contact the "postmaster" (btw I hope that one isn't filtered :D) At any rate, the idea behind country scoring is exactly to solve the above issue, using that approach you won't be filtering "particular countries" you'll just be narrowing the filters for countries which have an higher spam volume and this info will come directly from the emails you receive :) > Add A few country based DNSBLs and spam gets cut > down a great deal. sure, using http://countries.nerd.dk/ is as easy as 1-2-3 :D but that means *totally* blocking emails coming from a given country and .. well, I can't say I like the idea :) What else.. uh, yes, since we're at "country mapping", in case you need some more infos and you don't want all the infos returned by senderbase you may try this one origin.asn.cymru.com just reverse the IP, append the above to it and perform a TXT query and you'll obtain ... enough infos ;-) e.g. dig 80.134.212.211.origin.asn.cymru.com TXT ;; QUESTION SECTION: ;80.134.212.211.origin.asn.cymru.com. IN TXT ;; ANSWER SECTION: 80.134.212.211.origin.asn.cymru.com. 14400 IN TXT "9318 | 211.212.0.0/14 | KR | apnic | 2001-06-15" and you'll have the ASN, the IP block, the country, the allocation authority and the date the record was last updated; not bad for a simple DNS query :-) ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
