Block broadband dynamic IP spammers
We are seeing lots of spammers trying to send spam from broadband connections with dynamic IP and virus infected zombie computers. Here is a mod for Spamblocker 4.1 to block them and easily create new rules as spammer patterns change.
Got the idea from
http://www.janoszen.com/2013/01/07/filtering-spam-with-exim-only/
# Create block list
touch /etc/virtual/bad_sender_hosts_ip_dy
chown mail:mail /etc/virtual/bad_sender_hosts_ip_dy
nano /etc/virtual/bad_sender_hosts_ip_dy
# add and customize the block list as per your server, dynamic IP spammer patterns.
^\N.*ppp-(.*)\N
^\Ndsl-pool\N
^\N.*\.(pool|pppoe|adsl|dsl|xdsl|dialup|broad|cust-adsl|dynamicip|dynamicIP|dyn)\..*\N
^\N(pool|pppoe|adsl|dsl|xdsl|dialup|broad|cust-adsl|dynamicip|dynamicIP|dyn)\..*\N
^\N(pool|pppoe|adsl|dsl|xdsl|dialup|broad|cust-adsl|dynamicip|dynamicIP|dyn)-.*\N
^\Nip\-[a-fA-F0-9]+\-.*\N
^\N.*([0-9]+)(\.|-)([0-9]+)(\.|-)([0-9]+).*\N
^\N([0-9]+)-([0-9]+)-([0-9]+)-([0-9]+)\..*\N
^\N([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+)\..*\N
^\N.*\.ip([0-9]+)\.fastwebnet\.it$\N
*.dip.t-dialin.net
*.telecomitalia.it
*.shawcable.net
*.codetel.net.do
*.vie.surfer.at
*.pip.digsys.bg
*.dip0.t-ipconnect.de
*.cablenet.net.ar
*.telecom.net.ar
*.anbid.com.br
*.codetel.net.do
*.avc.upei.ca
*.dyn.telnor.net
*.speedy.com.ar
# Edit exim.conf
nano /etc/exim.conf
# Ensure host lookup is enabled.
#EDIT#18:
host_lookup = *
# change
#EDIT#34:
deny message = Email blocked by local blacklist
hosts = +bad_sender_hosts_ip
# to
#EDIT#34:
deny message = Email blocked by local blacklist
hosts = +bad_sender_hosts_ip
# Block Spam from broadband ISP dynamic IP pools
deny message = Reverse DNS indicates dynamic IP : Please use ISP SMTP
!authenticated = *
sender_domains = !+whitelist_domains
condition = ${lookup{$sender_host_name}wildlsearch{/etc/virtual/bad_sender_hosts_ip_dy}{true}{false}}
# restart exim
service exim restart
Note : got few false positives from couple of datacenters with reverse DNS config that looks like dynamic IP, we can whitelist such hosts
and if any specific IP's in these datacenters do spamming we can block them in bad_sender_hosts_ip as below:
#EDIT#31:
accept hosts = +whitelist_hosts
logwrite = $sender_host_address whitelisted in local hosts whitelist
to
accept hosts = +whitelist_hosts
hosts = !+bad_sender_hosts_ip
logwrite = $sender_host_address whitelisted in local hosts whitelist
.
