Its goal
A Real-time Blackhole List (RBL) is a list of IP addresses known for spam sending. This works pretty well to block known and already categorized spammers, but what happens if a new spam campaign starts flooding your gateway as is not yet categorized? In most cases the antispam engine will block messages, but this is an intensive operation, and in case of a massive attack could take your server down. LibraCyber ESG offers Local RBL Service to protect you in these situations.
How does it work
Local RBL Service is an integrated module that runs in background and maintains an hourly history going back 23 hours about each IP address that sends mail through ESG. An IP address is blocked when it has sent more than a configured number of definite spam messages in the previous 23 hours and has not sent any definite ham messages. The IP address is then put into a table of blocked IP addresses together with information on when the record should expire (default after 120 hours).
Service Configuration
In the first tab the are 3 configurable parameters:
- Message threshold (minimum number of threat messages to be received before considering the threat percentage)
- Threat percentage (percentage of threat messages received compared to clean messages)
- Block IP interval (minutes for which messages coming from an IP are rejected)
RBL Dynamically Blocked
Sender listed here are temporarily blocked as they sent too much spam. You can filter out displayed results performing a Search operation. Each entry has an expiration time, after that it will be automatically removed. For each entry you can forever blocklist/welcomelist the IP address or remove it from the local RBL block.
RBL Blocklist
Sender listed here are permanently blocked and are excluded from Dynamic RBL criterias. You can filter out displayed results performing a Search operation. For each IP address displayed here is displayed also the country as additional information. You can easily remove an entry by clicking the red trash icon at the end of the record.
RBL Welcomelist
Sender listed here are permanently allowed and are excluded from Dynamic RBL criterias. You can filter out displayed results performing a Search operation. For each IP address displayed here is displayed also the country as additional information. You can easily remove an entry by clicking the red trash icon at the end of the record.