"Charles Sweeney" <me@charlessweeney.com> wrote in message
news:Xns969CDD0E8933Cmecharlessweeneycom@130.133.1 .4...
> wrote
>
> > Here's a good start.
> >
> >
> > 12.148.209.196 #Bad Spiders and Bots
> > 12.39.35.130 #deny_hosts auto add
> > 12.44.209.227 #Korea
>
> [snip long list]
>
> > 81.64.11.17 #Korea
> > 81.86.230.210 #Korea
>
> Why when the bulk of spam (and presumably harvesters) is from the US,
> does your list mainly have China and Korea on it?
This is only partial. I left of Vietnam
I currently am blocking nearly 9,000 ips on every server we have.
The bulk is US, yes, but the nasties are PacRim.
> What's the point of having such a list, don't the bots simply use a new
> IP address after a while?
Yes, but the IP'll get used again, so most go /24
> How often do you update it?
I don't. It auto adds due to server activity.
> What processing is involved to check every request against it?
Authentication failures, Server requests, Exim and FTP.
mod_security - apf - bfd and a touch of me own scripting
--
When it absolutely, positively has to be smak'd - -
SmakDaddy