You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Justin Mason <jm...@jmason.org> on 2008/09/22 15:43:31 UTC
Re: New free blacklist: BRBL - Barracuda Reputation Block List
SM writes:
> At 03:24 22-09-2008, Chris Russell wrote:
> > I've had servers listed on Barracuda before, despite 17 emails to their
> >support systems we never had any response, and had to change a customers
> >mail architecture to compensate.
>
> It's a free blacklist. People will use it until they get listed and
> find out that there is no way to get unlisted as the blacklist is
> said to be accurate or there's no delisting policy.
>
> This new free blacklist has not published its listing methodology
> yet. There is a removal request link. I'll wait for someone to get
> listed to find out whether that actually works.
The fact that there's a prominent removal-request link is a good
sign, in my opinion ;) Let's see how it goes.
--j.
Re: New free blacklist: BRBL - Barracuda Reputation Block List
Posted by mouss <mo...@netoyen.net>.
Joseph Brennan wrote:
>
> Ralf Hildebrandt <Ra...@charite.de> wrote:
>
> My top rejections for today are:
>
>
> x 28 smtp-out.orange.net[193.252.22.118]:
>
>
>
> Orange is a major ISP. Their mail-sending hosts are in 193.252.22 and
> 80.12.242. Mail from Orange runs about 85 to 90% spam here. The
> minority remaining are legit users, some sending from cell phones.
> Mail to abuse or postmaster is not answered.
>
> http://openrbl.org/client/#193.252.22.118 shows it blacklisted only
> on lists I'm not familiar with. Blocking it will block legit mail,
> if people in Europe send mail to your system.
>
orange have become a lot better than they were. since they started
blocking port 25, I no more need to block their "residential" users.
while I still get junk via their relay, it's less than before. not as we
would like, but let's see. (their postmaster address is still a Dave
Null...).
Re: New free blacklist: BRBL - Barracuda Reputation Block List
Posted by mouss <mo...@netoyen.net>.
Michelle Konzack wrote:
> Am 2008-09-22 11:36:39, schrieb Joseph Brennan:
>> Ralf Hildebrandt <Ra...@charite.de> wrote:
>>
>> My top rejections for today are:
>>
>>
>> x 28 smtp-out.orange.net[193.252.22.118]:
>>
>>
>>
>> Orange is a major ISP. Their mail-sending hosts are in 193.252.22 and
>> 80.12.242. Mail from Orange runs about 85 to 90% spam here. The
>> minority remaining are legit users, some sending from cell phones.
>> Mail to abuse or postmaster is not answered.
>>
>> http://openrbl.org/client/#193.252.22.118 shows it blacklisted only
>> on lists I'm not familiar with. Blocking it will block legit mail,
>> if people in Europe send mail to your system.
>
> I am from Strasbourg and nearly ALL (180) of my french customers using
> <orange.fr>. Using this list would block over 600 E-Mails at once.
>
At the MTA level, use DNSWL to protect against such blocks.
$ grep orange.fr postfix-dnswl-permit
...
193.252.22.118/32 permit_auth_destination none orange.fr ...
...
Re: New free blacklist: BRBL - Barracuda Reputation Block List
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Am 2008-09-22 11:36:39, schrieb Joseph Brennan:
>
> Ralf Hildebrandt <Ra...@charite.de> wrote:
>
> My top rejections for today are:
>
>
> x 28 smtp-out.orange.net[193.252.22.118]:
>
>
>
> Orange is a major ISP. Their mail-sending hosts are in 193.252.22 and
> 80.12.242. Mail from Orange runs about 85 to 90% spam here. The
> minority remaining are legit users, some sending from cell phones.
> Mail to abuse or postmaster is not answered.
>
> http://openrbl.org/client/#193.252.22.118 shows it blacklisted only
> on lists I'm not familiar with. Blocking it will block legit mail,
> if people in Europe send mail to your system.
I am from Strasbourg and nearly ALL (180) of my french customers using
<orange.fr>. Using this list would block over 600 E-Mails at once.
Thanks, Greetings and nice Day/Evening
Michelle Konzack
Systemadministrator
24V Electronic Engineer
Tamay Dogan Network
Debian GNU/Linux Consultant
--
Linux-User #280138 with the Linux Counter, http://counter.li.org/
##################### Debian GNU/Linux Consultant #####################
Michelle Konzack Apt. 917 ICQ #328449886
+49/177/9351947 50, rue de Soultz MSN LinuxMichi
+33/6/61925193 67100 Strasbourg/France IRC #Debian (irc.icq.com)
Re: New free blacklist: BRBL - Barracuda Reputation Block List
Posted by Joseph Brennan <br...@columbia.edu>.
Ralf Hildebrandt <Ra...@charite.de> wrote:
My top rejections for today are:
x 28 smtp-out.orange.net[193.252.22.118]:
Orange is a major ISP. Their mail-sending hosts are in 193.252.22 and
80.12.242. Mail from Orange runs about 85 to 90% spam here. The
minority remaining are legit users, some sending from cell phones.
Mail to abuse or postmaster is not answered.
http://openrbl.org/client/#193.252.22.118 shows it blacklisted only
on lists I'm not familiar with. Blocking it will block legit mail,
if people in Europe send mail to your system.
Joseph Brennan
Columbia University Information Technology
Re: New free blacklist: BRBL - Barracuda Reputation Block List
Posted by Ralf Hildebrandt <Ra...@charite.de>.
* Joseph Brennan <br...@columbia.edu>:
>
>
>> My top rejections for today are:
>>
>> % fgrep www.barracudanetworks.com/reputation /var/log/mail.log |
>> awk '{print $10}' | sort |uniq -c | sort -n | tail
>>
>> 18 mx35.ispgateway.de[80.67.29.41]:
> . . .
>> 21 mx20.ispgateway.de[80.67.18.53]:
>> 21 mx43.ispgateway.de[80.67.29.52]:
> . . .
>> 24 mx31.ispgateway.de[80.67.29.35]:
>
>
> We see those too. Hosts in this domain are sending mail FROM:<>
> to recipients that do not exist, subject "Mail delivery failed:
> returning message to sender".
They send mail with fake senders to fake recipients here. So, that's
another point.
--
Ralf Hildebrandt (i.A. des GB IT) Ralf.Hildebrandt@charite.de
Charite - Universitätsmedizin Berlin Tel. +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-Berlin Fax. +49 (0)30-450 570-962
Geschäftsbereich IT Standort CBF I'm looking for a job!
Re: New free blacklist: BRBL - Barracuda Reputation Block List
Posted by Joseph Brennan <br...@columbia.edu>.
> My top rejections for today are:
>
> % fgrep www.barracudanetworks.com/reputation /var/log/mail.log |
> awk '{print $10}' | sort |uniq -c | sort -n | tail
>
> 18 mx35.ispgateway.de[80.67.29.41]:
. . .
> 21 mx20.ispgateway.de[80.67.18.53]:
> 21 mx43.ispgateway.de[80.67.29.52]:
. . .
> 24 mx31.ispgateway.de[80.67.29.35]:
We see those too. Hosts in this domain are sending mail FROM:<>
to recipients that do not exist, subject "Mail delivery failed:
returning message to sender".
It's ironic for Barracuda to blacklist hosts for backscatter.
Joseph Brennan
Columbia University Information Technology
Re: New free blacklist: BRBL - Barracuda Reputation Block List
Posted by Ralf Hildebrandt <Ra...@charite.de>.
* Justin Mason <jm...@jmason.org>:
> The fact that there's a prominent removal-request link is a good
> sign, in my opinion ;) Let's see how it goes.
My top rejections for today are:
% fgrep www.barracudanetworks.com/reputation /var/log/mail.log |
awk '{print $10}' | sort |uniq -c | sort -n | tail
18 mx35.ispgateway.de[80.67.29.41]:
x 18 unknown[203.210.244.169]:
x 18 unknown[62.64.92.218]:
x 18 unknown[77.222.138.14]:
x 19 unknown[194.186.250.230]:
21 mx20.ispgateway.de[80.67.18.53]:
21 mx43.ispgateway.de[80.67.29.52]:
x 22 unknown[222.124.11.83]:
24 mx31.ispgateway.de[80.67.29.35]:
x 28 smtp-out.orange.net[193.252.22.118]:
The hosts marked x can be found in other RBLs (I used openrbl.org to
check).
--
Ralf Hildebrandt (i.A. des GB IT) Ralf.Hildebrandt@charite.de
Charite - Universitätsmedizin Berlin Tel. +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-Berlin Fax. +49 (0)30-450 570-962
Geschäftsbereich IT Standort CBF I'm looking for a job!