Mailing List Archive: How to block reverse hostname

How to block reverse hostname

Jan 9, 2020, 12:30 PM

Post #1 of 3 (411 views)

How to mark all messages from *hostwindsdns.com server?

192.236.198.0
192.236.198.1
192.236.198.2 client-192-236-198-2.hostwindsdns.com.
192.236.198.3 client-192-236-198-3.hostwindsdns.com.
192.236.198.4 client-192-236-198-4.hostwindsdns.com.
192.236.198.5 client-192-236-198-5.hostwindsdns.com.
192.236.198.6 client-192-236-198-6.hostwindsdns.com.
192.236.198.7 2t1.ntdservices.icu.
192.236.198.8 client-192-236-198-8.hostwindsdns.com.
192.236.198.9 client-192-236-198-9.hostwindsdns.com.
192.236.198.10 client-192-236-198-10.hostwindsdns.com.
192.236.198.11 client-192-236-198-11.hostwindsdns.com.
192.236.198.12 client-192-236-198-12.hostwindsdns.com.
192.236.198.13 client-192-236-198-13.hostwindsdns.com.
192.236.198.14 client-192-236-198-14.hostwindsdns.com.
192.236.198.15 client-192-236-198-15.hostwindsdns.com.
192.236.198.16 exchange.xforce.ibmcloud.com.
192.236.198.17 bbg3.ntdservices.icu.
192.236.198.18 client-192-236-198-18.hostwindsdns.com.
192.236.198.19 t3ulb.ntdservices.icu.
192.236.198.20 client-192-236-198-20.hostwindsdns.com.
192.236.198.21 client-192-236-198-21.hostwindsdns.com.
192.236.198.22 client-192-236-198-22.hostwindsdns.com.
192.236.198.23 client-192-236-198-23.hostwindsdns.com.
192.236.198.24 client-192-236-198-24.hostwindsdns.com.
192.236.198.25 exchange.xforce.ibmcloud.com.
192.236.198.26 exchange.xforce.ibmcloud.com.
192.236.198.27 client-192-236-198-27.hostwindsdns.com.
192.236.198.28 exchange.xforce.ibmcloud.com.
192.236.198.29 client-192-236-198-29.hostwindsdns.com.
192.236.198.30 client-192-236-198-30.hostwindsdns.com.
192.236.198.31 client-192-236-198-31.hostwindsdns.com.
192.236.198.32 client-192-236-198-32.hostwindsdns.com.

Re: How to block reverse hostname [ In reply to ]

me at junc

Jan 9, 2020, 6:01 PM

Post #2 of 3 (410 views)

Permalink

Marc Roos skrev den 2020-01-09 21:30:
> How to mark all messages from *hostwindsdns.com server?
>
> 192.236.198.0

http://multirbl.valli.org/lookup/192.236.198.0.html

dont block random reverse

add more rbls or rhsbl to spamassassin

http://multirbl.valli.org/list/

be carefull with testing

Re: How to block reverse hostname [ In reply to ]

jhardin at impsec

Jan 10, 2020, 8:00 AM

Post #3 of 3 (405 views)

Permalink

On Thu, 9 Jan 2020, Marc Roos wrote:

> How to mark all messages from *hostwindsdns.com server?
>
> 192.236.198.0
> 192.236.198.1
> 192.236.198.2 client-192-236-198-2.hostwindsdns.com.
> 192.236.198.3 client-192-236-198-3.hostwindsdns.com.

...etc

If you are confident that you only ever receive spam from those IP
addresses, add them to an IP blacklist in your MTA so they get rejected up
front. Why accept the SA processing overhead?

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Never forget, even for an instant, that the one and only reason
anyone has for taking your gun away is to make you weaker than
he is, so he can do something to you that you wouldn?t let him
do if you were equipped to prevent it. This goes for burglars,
muggers, and rapists, and even more so for policemen,
bureaucrats, and politicians. -- Alexander Pope
-----------------------------------------------------------------------
7 days until Benjamin Franklin's 314th Birthday