[Resolved] Large number of spam IPs to block, I'm Parsing IPs from exchange logs... Options

[seth76]

We have a spam box where our users forward their spam. We have been using this data to check keyword filters and to generally see where how well we are taking care of spam issues. Recently I developed a way to compare message subject lines to the exchange message tracking logs to determine the origin IP.

To make a long story sort, I have a list of 6800 IPs that we have received spam from. I've done the best that I can to clear out any legitimate IP addresses, including doing an nslookup to see the domain if available. Does anyone have any sugestions on how I might submit this data?

I'm currently trying to get our own rbldnsd running, however the exchange server so far hasn't liked using this sever...

Many thanks,
~Seth

[turetzsr]

...SpamCop has no such provision, as far as I know. There are only two ways of which I'm aware that IP Addresses land in the SpamCop blacklist:

• Sending e-mail to spam Traps.
• Enough SpamCop users reporting spam sourced from the IP address to meet the criteria.

...See SpamCop FAQ entry "What is on the list?".

[seth76]

Thank you for your reply turetzsr. I've understood how the list works for some time. It's not really what I need, that is, the explanation of how the system works.

I guess I could scri_pt a way to automatically make the submissions. This seems a little monotonous that each one should be submitted individually...

[SpamCopAdmin]

Turetzsr is correct.

The only way an IP can get on our list is by it being reported using our service.

We don't have a provision for manually adding an IP to the list so that someone on the staff with a personal agenda can't abuse the system.

Our Founder created SpamCop that way.

- Don D'Minion - SpamCop Admin -
.

[Telarin]

Seth,
I also run an exchange server can have my users submit spam to a shared folder for reporting. I manually review the submitted spam, clean out any legitimate messages, and submit the rest to spamcop daily. I use a program call OLSpamCop to submit all the messages in a single batch. I also have my account setup for quick reporting so that I do not need to process each message individually. In this way I am able to submit several hundred messages in just a few minutes. I would not recommend using quick reporting until you have done manual submissions for a while and made sure that your mailhost setup is working correctly, as you don't want to accidentally report yourself.

[turetzsr]

<snip>
I would not recommend using quick reporting until you have done manual submissions for a while and made sure that your mailhost setup is working correctly, as you don't want to accidentally report yourself.

...Also, any time there is any new server added to your mail network between the outside internet and your users, you need to re-run the MailHost setup (or if for some reason that doesn't work, ask the SpamCop Deputies to add the new server).