Blacklisting spammers

[cearnshaw]

Hello all,

Is there a way to blacklist spammers based on a count of messages received from a given IP address, or perhaps the number of local recipients? It is relatively easy to see spam attacks in the smtp logs as one IP will be seen sending to numerous recipients, but it would be nice to automate it so that after a certain threshold is reached the sender's IP is automatically blacklisted. Seems like all I really need is a way to count transactions and then I could generate the rest with a content filter rule.

Thanks,

Cameron

[rob]

There is indeed a feature which can do something like this, tar-pitting. Basically it works by counting the number of failed recipient delivery attempts (every time the mail server refuses a non valid email address). Simply enable this feature from within the SPAM settings and if an IP exceeds the limit, it will be blocked for specified time. You an also set a daily limit on the number of mails per IP, which if a SPAM source is getting mails into the system, this would place a cap on how many that IP can do one in day.

[cearnshaw]

Thanks for the reponse Rob. We are using the tarpitting now. As for the IP limits, we had to set them high because we found that our own customers were getting blocked. Is there a way to white list our own IPs from the daily IP limits. It would also be nice to set the limits high for IPs we get a lot of mail from (Yahoo and local ISPs, for example) while keeping it fairly low for everyone else. As it stands now we have to set the limit so high that it is just about ineffective at stopping spam.

Thanks,

Cameron

[rob]

Unfortunatly the mail sending limits have no white listing capability, but this is something we should perhaps add. I have made a recommendation that we look into this for a future update. In the meantime you may have to just set the limit quite high like you currently already have, this will at least catch out the highly abusive SPAM sources.