RE: spamhaus drop list

Well, there is always the bogon-list from Team Cymru

http://www.cymru.com/Documents/bogon-bn-agg.txt

And the bogon-list from BGPmon

http://bgpmon.net/showbogons.php?inet=4&global=yes&private=yes

Both containing prefixes that should not be announced on the internet,
but often used by spammers trying to deliver their content.

Hi!

Both containing prefixes that should not be announced on the internet,
but often used by spammers trying to deliver their content.

When did you experience this last time, this is not what we see on various antispam projects.

So if you have new information, please share, we didnt see bogons used a lot at least the last 12 months.

Drop list is a completely different thing, and effective, but also effective to loos legitimate mails, the blocks inside there are too wide. I would not recommend people putting that inside iptables or something :wink:

Bogon filtering is something that should be considered common practice. So your borders or upstreams should take care of that :wink:

Bye,
Raymond.

Traffic from bogon IP space is more likely than anything else to be
the result of misconfiguration rather than a spammer abusing it.

The cymru bogons list and the spamhaus drop list target two entirely
distinct issues and they shouldnt be confused together.

Correct. And whatever list you use, for whatever purpose, at the time you start using it also set up a process to update it or age old entries. Don't wait until later.

Those lists will be there long after you forget about it, and maybe even longer than you; and it will save you or your successor a lot of troubleshooting headaches.

.. and to sanity check the fallout of fat fingers, bitrot or whatever
(like where you set out to block a /24 but end up blocking a /2
instead)