Bill, I am looking forward to that. Would this be using the Declude logs or the Imail logs to gather the IPs to block?
John T From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Foresman Sent: Friday, November 23, 2007 4:43 PM To: [email protected] Subject: Re: [IMail Forum] Suddenly Imail Refusing Mail from Gateway Server We're using the logs for data mining to determine what IP's to block. It's been extremely enlightening and productive. At this point we're trying to determine an algorythm to automate the process of identifying IP's that we're not going to accept maill from. Just after a few days we're denying connections from over 30,000 IP's that are absolutely spammers! We're going to release the software opensource as soon as possible. Regards, Bill Foresman Matrosity Hosting 850-656-2644 -----Original Message----- From: "Len Conrad" <[EMAIL PROTECTED]> Sent 11/23/2007 7:36:36 PM To: [email protected] Subject: RE: [IMail Forum] Suddenly Imail Refusing Mail from Gateway Server >So what does that translate to for Imail? Max two sessions? 1 bad >recipient, then blacklist it? That seems awfully low. IMGate doesn't blacklist in a session. It disconnects the session after 2 5xx's. Eventually, through harvesting the mail log, enough sessions with (even one) bad recip, and the IP gets blacklisted. How many is enough? over how much time? day? week? The threshold depends on several other factors. eg, if the IP doesn't have a PTR, then the blacklist threshold is a lot lower than if it had an IP. And John is right. A gateway that accepts all recips and passes them to Imail is asking for trouble, is a useless gateway. Rejecting bad recips is the FIRST task of an MX gateway. Len To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
