<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=US-ASCII">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV dir=ltr align=left><SPAN class=189064108-11062004><FONT face=Arial
color=#0000ff size=2>Have a look at Vispan ( <A
href="http://www.while.homeunix.net/mailstats/">http://www.while.homeunix.net/mailstats/</A> ).
It does IP blacklisting of virus senders / spammers on the
fly.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=189064108-11062004><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=189064108-11062004><FONT face=Arial
color=#0000ff size=2>Far too many sites are broken with respect to reverse DNS
lookups (even us, blush) to even consider using that as a
tool.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=189064108-11062004><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=189064108-11062004><FONT face=Arial
color=#0000ff size=2>Cheers,</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=189064108-11062004><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=189064108-11062004><FONT face=Arial
color=#0000ff size=2>Phil</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=189064108-11062004></SPAN><FONT
size=2>----<BR>Phil Randal<BR>Network Engineer<BR>Herefordshire
Council<BR>Hereford, UK </FONT></DIV>
<DIV> </DIV><BR>
<BLOCKQUOTE
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> MailScanner mailing list
[mailto:MAILSCANNER@JISCMAIL.AC.UK] <B>On Behalf Of </B>Philip
Waters<BR><B>Sent:</B> 10 June 2004 21:12<BR><B>To:</B>
MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> SMTP-time spam rejection by
IP<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV><FONT face=Arial size=2>I've read several documents on how it isn't
useful to have a spam rule set based on an IP address because spammers are
constantly changing their ip address. </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Does there exist, however, a script that would
integrate with mailscanner to identify an ip address of someone sending
massive amounts of messages in succession to which our server only responds
"user unknown" (indicating a spammer). Furthermore, would it be possible to
dynamically take that ip address and immediately block or tarpit the sender
for a given time.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Is there any existing active filter that modifies
the access.db on the fly based on failed reverse DNS lookups? would it be
possible to have mailscanner send a message to like a 7-layer switch
instructing it what type of message to just DISCARD.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>If there is anyone who has already implemented
something like this I'd be interested to know.</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>There's no place like root#cd
~/</FONT></DIV>-------------------------- MailScanner list
----------------------<BR>To leave, send leave mailscanner to <A
href="mailto:jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A><BR>Before
posting, please see the Most Asked Questions at<BR><A
href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A> and
the archives at<BR><A
href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A><BR></BLOCKQUOTE></BODY></HTML>
-------------------------- MailScanner list ----------------------<br>
To leave, send leave mailscanner to <a href="mailto:jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a><br>
Before posting, please see the Most Asked Questions at<br>
<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a> and the archives at<br>
<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a><br>