[TriLUG] Spamassassin to filter non-US

[Brian Phelps]

On Thu, Oct 2, 2008 at 12:07 PM, Cristóbal Palmer <cmp at cmpalmer.org> wrote:
> On Thu, Oct 2, 2008 at 10:07 AM, Brian Phelps <brphelps at ieee.org> wrote:
>> It looks like this doesn't check foreign IP's, which is the real
>> problem.  Often its a .com, but the IP is in another country.
>
> If this thread is any indication, a neat list of "foreign" IPs is a unicorn:
>
> http://www.derkeiler.com/Newsgroups/comp.os.linux.security/2005-09/0201.html
>
> Any IP-based approach is going to be an approximation. I really think
> better filters and other anti-spam strategies is your answer. The
> mandate from above is impracticable in your case. If you must block
> IPs, pick some known-foreign ranges (eg. Chinese, Russian) and call it
> good, but don't waste time trying to find an exhaustive or
> authoritative list.
I figured spamassassin had a plugin that would query whois on the IP
to decide if its foreign.  I totally agree a list is useless, but I
never even considered a list.
I can whois the IP and check the country code myself, I figured
spamassassin should be able to also.
>
> Cheers,
> --
> Cristóbal M. Palmer
> "Small acts of humanity amid the chaos of inhumanity provide hope. But
> small acts are insufficient."
>    -- Paul Rusesabagina
> --
> TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
> TriLUG FAQ  : http://www.trilug.org/wiki/Frequently_Asked_Questions
>



-- 
Brian Phelps
System Design Engineer
Custom Light and Sound
919-286-0011
http://customlightandsound.com