*UPDATED on 1/12/07 to remove the 216. range as it is assigned to ARIN at this time.*

A few customers have expressed interest in blocking messages from other countries. One way to do this is to setup a content filter based on the ip of the sending server.

1. login to smartermail (mail.yourdomain.xyz) or (mailxx.safesecureweb.com).
2. go to "Settings" and choose "My content Filtering" (you can use "Domain settings" and "domain content filterings" if you are logged in as the administrator and want to set the filter for all addresses on your domain)
3. Click "Add Filter"
4. Expand "Other" and check the box next to "Sent through a specific server (by ip)" and click "next"
5. enter in the ip addresses or ranges you would like to block and click "next"
6. Give the rule a name (ie IP Ranges) and select an action such as delete, or bounceback, etc.

A list of class A ip assignments can be found here:
http://www.iana.org/assignments/ipv4-address-space


Here is a list of ips some of our customers block:

58.0.0.0-62.255.255.255
77.0.0.0-91.255.255.255
121.0.0.0-126.255.255.255
189.0.0.0-190.255.255.255
193.0.0.0-195.255.255.255
200.0.0.0-203.255.255.255
210.0.0.0-213.255.255.255
217.0.0.0-222.255.255.255

Thanks Joe - I've been meaning to post that for AGES.

Hi,

Thanks a ton. Could someone post more IP's that can be blocked?

Also, Jamie, Could you please look into the topic

http://forums.hostmysite.com/viewtopic.php?t=2706

Please. Anyone can help??

Regards,

About 10 days ago, I began blocking all those IPs suggested above and it eliminated about 75% of the spam. In order to see this action wasn't blocking legitimate email, instead of deleting these messages I had them diverted to my SPAM EMAIL FOLDER to check. Soon, I'll just have them automatically deleted.

I just updated Joe's ranges because he included 216., which belongs to ARIN and as such is local to the US.

Aside from using that list of IPs for blocking email (except for 216) has anyone had HMS block the same list in order to deny them entry into ones website? After all, if we don't want their email then why should we want them visiting our website?

If these are all foreign IP addresses then we wouldn't be losing much traffic. Further, it should reduce the spam on our feedback forms.

Allen, unfortunately such blocking either needs to be set at a global server level, affecting 200+ other people. It's fine if you have a VPS or dedicated, but unfortunately otherwise, you have to write your own framework to do it unlike email. Sorry about this.

Well, that's strange because HMS never mentioned any problem blocking IPs before (to deny entry into my website)... last September they did it for me. I asked they block 81.177.14.X and 81.177.15.X which they say they did (although it was only about 75% effective... some of these were still slipping in). Have things changed since then?

One in particular pissing me off now is 195.225.177.48 (posting spam on my new feedback form)

Allen: submit a ticket to support. That can be done in both Apache (Linux accounts) and IIS (Windows accounts)

To clarify, this *can* be done globally, however as Derek mentioned you can also do it for individual sites in both Linux and Windows.

Also I used the same ranges to block foreign traffic to a client site where I did some dev work once. The site was a scholarship that is only available to residents of certain US states, so I blocked as much foreign as I could from logging into the application. Of course, when I did it I made it different - a redirect statement in the application.cfm file that triggers off the ip given by the HTTP request. The redirect was based on a comparison I made to a sql table of 'bad ips'. Also, I recorded all of the connecting IPs for troubleshooting and to determine where each applicant was submitting from for security reasons.

It was a little bit of custom coding but in the end I was very happy with the results.

Can i ask in the move message box are you using the text: Junk E-Mail

My filtered emails are disappearing rather than appearing in the Junk E-Mail folder and i cant work out why

In the filter actions, are you specifying 'delete' as well as another action? If you have more than one action specified and DELETE is one of them, then it just deletes the message. Also, be careful if you've got more than one filter setup; one of the ones that you think is 'harmless' may be doing it.

Problem solved. The HMS outgoing mailserver was deleting the email.

Reference the first post IP list.
Beaware some of the IP addresses cover a number of genuine UK Servers. So if you have genuine international emails/customers this may be a problem.

I am going to try these out on my smartermail blacklist ( globally ) to see if that helps things out. I use a number of RBLs that work pretty well to block most spam, but today I had one email that made it past the RBLs and my own proprietary list of bad words ( viagra, cialis, ext ).