Comments on: Top 10 Global Spammers 1Q 2010

By: Sys_Admin

Sys_Admin — Tue, 04 Jan 2011 14:40:13 +0000

I noticed the CPU on the email servers decrease and I see hits in the firewall on the Linux email servers. I have to say this site is AWESOME! I have eliminated bandwidth thieves from India/Russia/China and other unsavory countries.

By: Stewart White

Stewart White — Mon, 03 Jan 2011 19:35:29 +0000

Glad to hear you are finding our website useful.

We have several options we are considering:

A per user administrative section where you could log in, create your lists using our database and either download this data, access it via your control panel or through a text file created specifically for your use.

Read only access to our database.

A downloadable administrative template, including SQL files that will allow webmasters to directly block IP traffic or net admins to generate iptables or other formats.

By: Sys_Admin

Sys_Admin — Mon, 03 Jan 2011 19:23:09 +0000

I am managing 2 email servers, I have been bombarded by attacks, spam and unwanted traffic from China/Russia/Africa/India/Middle_East. I created my iptables separate firewall listing, it has about 10,000 lines, I do not see a performance impact. All of the servers are running Linux. You mentioned about a database, how would this data be accessed via a database? Thank you again for the BEST website on dealing with spammers/Denial_service_attackers and other unwanted traffic.

By: Rune Jensen

Rune Jensen — Sat, 25 Dec 2010 15:49:31 +0000

Ah, BTW, thanks for the good work, I’ll take a closer look at your site now

By: Rune Jensen

Rune Jensen — Sat, 25 Dec 2010 15:41:43 +0000

I block all of Israel and all of Ukraine. Those are the worst harvesters, and the harvester bots are the ones you would want to block first of all. Furthermore, nothing good has ever come out from these countries.

Then I block all user agents whcih contains “java”, since those are harbesters as well.

I allso only accept POSTing from IPs that accepts GZIP, since almost no bots understand it (they do not have the library).

Lastly I block all querystrings that contains anything else than alphanumeric chars (and plus).

Have kept me free of spam and injection for half a year now.

By: Stewart White

Stewart White — Sun, 19 Dec 2010 14:53:40 +0000

Add them to your .htaccess file as follows:
order allow,deny
# Country: CHINA
# ISO Code: CN
# Total Networks: 1,848
# Total Subnets: 276,586,240
1.12.0.0/14
1.24.0.0/13
1.45.0.0/16
................. allow from all

By: ummah

ummah — Sun, 19 Dec 2010 14:45:16 +0000

Ok i want to block chines .What to do in order to block them shall i copy pate these in to our .htaccc file ? Please reply asap as its bloody really anoying .Every day our social network is full of their shity blogs etc.

By: maniaco007

maniaco007 — Thu, 16 Dec 2010 17:23:47 +0000

Brilliant! Just what I needed!!

By: pecko

pecko — Thu, 02 Dec 2010 17:15:49 +0000

How do i do things differently?

I mean, how can I allow IPs from certain country only and block everybody else without bloating the .htaccess file with ranges from all over the world?

somethink like

#blab
allow from 10.10.0.0/16
deny all
#

will it work?

By: jfv

jfv — Tue, 16 Nov 2010 04:01:16 +0000

hi i want the list of ip spam from united states to put on the .htacesss because i have a lot of spam from united states thanks

By: anonymous

anonymous — Mon, 15 Nov 2010 04:13:56 +0000

thanks for the list. hopefully this will stop those damn chinese ddosers.

i’ve been having problems with them for over a month, after htaccess denying one another two would show up to take his place.

By: firecraftx

firecraftx — Mon, 18 Oct 2010 18:31:23 +0000

Very resourceful. Thanks for this generous move towards web security implementation. Any chance for the message board to go live? Couldn’t register or post there.
Regards.

By: mommaroodles

mommaroodles — Sat, 28 Aug 2010 10:01:52 +0000

This is awesome thank you so much Just what I needed! )

By: Stewart White

Stewart White — Fri, 06 Aug 2010 15:19:55 +0000

Good eye. Thanks.

By: eSparky

eSparky — Fri, 06 Aug 2010 03:42:24 +0000

very useful website…

Problem with a CIDR dotted quad conversion on the cheat sheet. CIDR /20 is missing a trinary.

Should read /20 = 255.255.240.0 4096

Thanks again