Quali Realtime Blackhole Lists (RBL) conservative – aggiornamento 2018

Le RBL possono essere utilizzate per verificare se le mail arrivano da una fonte nota di spam, o di possibile spam o da fonti comunque non attendibili e nel caso rifiutarla.

Dal momento che esisto varie RBL ciascuna con le proprie peculiarità e finalità nasce il problema di quali utilizzare per ridurre lo spam, ma senza generare falsi positivi. Un altro aspetto da tenere presente è che l’uso delle RBL ovviamente genera un overhead di traffico e quindi occorre sceglierle con cura le RBL per evitare di usarne troppe.

Avevo già affrontato questo argomento nel post Exchange e Realtime Blackhole Lists (RBL) Conservative del 30 Novembre 2007, di seguito un elenco di RBL aggiornato che ho verificato essere efficaci, ovviamente l’elenco delle RBL utilizzate dovrebbe essere rivisto periodicamente in quanto alcune RBL potrebbero non essere più attive o non essere più efficaci o potrebbero nel frattempo essere disponibili RBL migliori.

Ovviamente anche l’ordine di utilizzo delle RBL è importante per cercare di bloccare fonti di mail non attendibili in base alle loro caratteristiche con un minimo overhead, per esempio valutando prima le fonti di spam e poi i sistemi compromessi e quindi quelli che non dovrebbero inviare mail.

zen.spamhaus.org

Per info si veda https://www.spamhaus.org/zen/:

“ZEN is the combination of all Spamhaus IP-based DNSBLs into one single powerful and comprehensive blocklist to make querying faster and simpler. It contains the SBL, SBLCSS, XBL and PBL blocklists.

zen.spamhaus.org should be the only spamhaus.org DNSBL in your IP blocklist configuration. You should not use ZEN together with other Spamhaus IP blocklists, or with blocklists already included in our zones (such as the CBL) or you will simply be wasting DNS queries and slowing your mail queue.

zen.spamhaus.org replaces sbl-xbl.spamhaus.org in most configurations. If you are currently using sbl-xbl.spamhaus.org you should replace sbl-xbl.spamhaus.org with zen.spamhaus.org.

Caution: Because ZEN includes the XBL and PBL lists, do not use ZEN on smarthosts or SMTP AUTH outbound servers for your own customers (or you risk blocking your own customers). Do not use ZEN in filters that do any ‘deep parsing’ of Received headers, or for anything other than checking IP addresses that hand off to your mailservers.”

cbl.abuseat.org

Per info si veda https://www.abuseat.org/:

“The CBL only lists IPs exhibiting characteristics which are specific to open proxies of various sorts (HTTP, socks, AnalogX, wingate, Bagle call-back proxies etc) and dedicated Spam BOTs (such as Cutwail, Rustock, Lethic, Kelihos, Necurs etc) which have been abused to send spam, worms/viruses that do their own direct mail transmission, or some types of trojan-horse or “stealth” spamware, dictionary mail harvesters etc.

The CBL does not list based upon the volume of email from a given IP address.

The CBL also lists certain portions of botnet infrastructure, such as Spam BOT/virus infector download web sites, botnet infected machines, machines participating in DDOS, and other web sites or name servers primarily dedicated to the use of botnets. Considerable care is taken to avoid listing IP addresses that are shared or are likely to be shared with legitimate use, except in the case of infector download websites, phish emission or DDOS.

Our botnet detections may not necessarily directly involve the observation of spam emission, but most botnets are at least occasionally involved in email spam, in addition to infostealing, DDOS attacks etc.

In other words, the CBL only lists IPs that have attempted email connections to one of our servers in such a way as to indicate that the sending IP is infected with a spam-sending virus or worm, acting as a open proxy for the sending of spam, OR, IPs primarily used in the operation of botnets.”

bl.spamcop.net

Per info si vedano https://www.spamcop.net/bl.shtml e How do I configure my mailserver to reject mail based on the blocklist?:

“The SpamCop Blocking List (SCBL) lists IP addresses which have transmitted reported email to SpamCop users. SpamCop, service providers and individual users then use the SCBL to block and filter unwanted email. The SCBL is a fast and automatic list of sites sending reported mail, fueled by a number of sources, including automated reports and SpamCop user submissions. The SCBL is time-based, resulting in quick and automatic delisting of these sites when reports stop.”

b.barracudacentral.org

Per info si vedano http://www.barracudacentral.org/rbl e Barracuda Reputation Block List (BRBL) – How to Use:

“Starting in September 2008, Barracuda Networks introduced the Barracuda Reputation Block List (BRBL – pronounced “bahr-bel”) as a free DNSBL of IP addresses known to send spam. Barracuda Networks fights spam and created the BRBL to help stop the spread of spam.”

ix.dnsbl.manitu.net

Per info si veda http://www.dnsbl.manitu.net:

“This publicly available DNS blacklist is permanently regenerated by the NiX Spam project of the German IT magazine iX. It contains IP addresses of spam senders and hash values (fuzzy checksums) of incoming spam.”

truncate.gbudb.net

Per info si vedano GBUdb.com Truncate e GBUdb.com Truncate More Information:

“A result of 127.0.0.2 indicates that the IPv4 address in question produces exclusively email containing spam, scams, viruses, or other malware patterns based on statistics in the global GBUdb network. The parameters used to select IPs for this list are so strict that most systems should be able to safely reject SMTP connections from IPs found on this list.
Maintenance of this list is completely automated and there are no provisions for the manual addition or removal of entries.”

“Truncate is very conservative. On most systems it can be safely used to reject connections!“

dnsrbl.org

Per info si veda https://dnsrbl.org/:

“DNSRBL is a Real-time Blackhole List (RBL) – Started in 2006, we store IP Addresses that are used to send unsolicited and undesired (Junk) mailings.”

smtp.dnsbl.sorbs.net

Per info si vedano About Listings e Using SORBS:

“smtp.dnsbl.sorbs.net – List of Open SMTP relay servers.”

web.dnsbl.sorbs.net

Per info si vedano About Listings e Using SORBS:

“web.dnsbl.sorbs.net – List of web (WWW) servers which have spammer abusable vulnerabilities (e.g. FormMail scripts) Note: This zone now includes non-webserver IP addresses that have abusable vulnerabilities.”

zombie.dnsbl.sorbs.net

“zombie.dnsbl.sorbs.net – List of networks hijacked from their original owners, some of which have already used for spamming.”

dul.dnsbl.sorbs.net

Per info si vedano About Listings e Using SORBS:

“dul.dnsbl.sorbs.net – Dynamic IP Address ranges (NOT a Dial Up list!)”

noserver.dnsbl.sorbs.net

Per info si vedano About Listings e Using SORBS:

“noserver.dnsbl.sorbs.net – IP addresses and Netblocks of where system administrators and ISPs owning the network have indicated that servers should not be present.”

rhsbl.sorbs.net

Per info si vedano About Listings e Using SORBS:

“rhsbl.sorbs.net – Aggregate zone (contains all RHS zones)

badconf.rhsbl.sorbs.net – List of domain names where the A or MX records point to bad address space.

nomail.rhsbl.sorbs.net – List of domain names where the owners have indicated no email should ever originate from these domains.”

rbl.realtimeblacklist.com

Per info si vedano About e How to use:

“The realtime blacklist (RBL) is an database with IP addresses from which realtimeBLACKLIST.COM does not recommend the acceptance of e-mail.”

“The RBL is queriable in realtime by e-mail systems though out the Internet, allowing mail server administrators to identify, tag or block incoming connections from IP addresses which realtimeBLACKLIST.COM deems to be involved in the sending, hosting or origination of Unsolicited Bulk Email. This RBL also list IP addresses that are used in Botnet or for spreading malware/viruses. The RBL database is maintained by IPrange.net / realtimeBLACKLIST.COM specialists and some of it sponsors that are located in the Netherlands working 24/7 to list new confirmed spam issues and to delist resolved issues.”

z.mailspike.net (oppure bl.mailspike.net)

Per info si vedano About Mailspike e Usage.

“Using the Reputation Services via public DNS queries is restricted to low volume sites, which shall comply with the following rules:

• Email traffic does not exceed 100,000 messages per day;
• Total volume of DNS queries does not exceed 100,000 queries per day;”

“z.mailspike.net
This zone lists all IP addresses seen participating in a distributed spam wave. A query for an A record should always return 127.0.0.2 if the IP address is currently listed. Recommended action: Block at MTA level.”

“bl.mailspike.net
this zone combines both the z.mailspike.net and IP addresses from rep.mailspike.net that are listed between L3 and L5. This combined zone can be used for a single DNS query to determine if messages coming from this IP address should be blocked. The DNS A record is always mapped either to 127.0.0.2 (z.mailspike.net) or the corresponding A record from rep.mailspike.net. Recommended action: Block at MTA level.”

dnsbl.zapbl.net

Per info si veda ZapBL Policy.

“ZapBL is a list of opinions as to where the ZapBL admins do not want to receive mail from.”

“ZapBL and its admins are NOT calling anyone spammers, we are merely saying there are certain places on the Internet from which we’ve received mail that matches the above definition of spam and we would no longer like to receive mail from these places. If anyone is using our list to block email, it’s their choice.”

Da test eseguiti a luglio 2018 tale RBL blocca diversi IP relativi a mail server di yahoo.

rbl.interserver.net

Per info si veda Real time suspected malware list as detected by InterServer’s InterShield protection system e https://mxtoolbox.com/problem/blacklist/interserver.

“The InterServer DNS-based Blackhole List is a spam trap DNSBL. This list does not take spam reports from third-parties. All blocking is done based on email recieved to our multiple spam trap email addresses throughout our network.”

db.wpbl.info

Per info si veda WPBL – Weighted Private Block List.

“WPBL is a private block list consisting of IP addresses which connect to members’ systems and deliver unsolicited bulk mail (spam).” The list is designed to be most effective when used by WPBL members, but may not be suitable for other uses. WPBL should not be used to block SMTP connections outright. It is most effective in a scoring system like SpamAssassin.

auth.spamrats.com

Per info si veda RATS-Auth – An IP Address that has been shown to be used in an AUTH Attack.

“This is a list of IP Addresses that have been detected as being the source of a trojan/bot attack specifically used to try and guess passwords, or similar technique by attempting to just ‘authenticate’ without really sending email. We suggest that it be used to protect your servers from these types of attacks, which can also contribute to large loads. However, this can occasionally happen even from normal email servers, if the server is compromised or seriously misconfigured, or shares an IP gateway with infected machines. Historically, these attacks typically have been seen from older windows installations.”

dnsbl-1.uceprotect.net

Per info si veda UCEPROTECT Network Project.

Conclusioni

La gestione dello spam mediante RBL deve essere fatta cercando di ottenere il giusto connubio tra riconoscimento di fonti di mail non attendibili, falsi positivi e overhead di traffico generato per il controllo. Quindi come già detto prima occorre selezionare le RBL migliori per la propria tipologia di traffico di posta.

Ad esempio l’uso di RBL come new.spam.dnsbl.sorbs.net (e quindi alche le recent.spam.dnsbl.sorbs.net, old.spam.dnsbl.sorbs.net, spam.dnsbl.sorbs.net) riconosce le mail in arrivo da GMail come spam quindi tale RBL potrebbe essere troppo aggressiva per poter essere utilizzata in molti scenari, ma alcuni altri in cui lo scambio di mail con domini non aziendali non è previsto potrebbe essere utilizzata.

Ovviamente l’utilizzo delle RBL comporta anche un carico di gestione aggiuntivo per gestire eventuali falsi postivi che dovessero sorgere successivamente per identificare quale RBL a iniziato a causare il problema e per risolverlo tramite un’esclusione sull’indirizzo di mail o un’esclusione sul dominio o ancora valutando di abbandonare l’RBL ed eventualmente sostituirla.

Per avere una panoramica su quali siano le RBL attualmente attive e quindi approfondire le loro caratteristiche è possibile vedere, ad esempio, utilizzare uno strumento come MxToolbox valutando su quali RBL esegue il controllo quando si avvia il controllo se un dominio o un IP è in blacklist disponibile a questo link MXToolbox – Blacklists.

Update 01:

In Exchange per verificare quali RBL bloccano il maggior numero di messaggi ed eventualmente rivedere l’ordine di applicazione o escluderne alcune è possibile usare lo script Get-AntispamTopRBLProviders.ps1 che è memorizzato in %ProgramFiles%\Microsoft\Exchange Server\V14\Scripts.

Per ulteriori informazioni su come vedere in Exchange come viene gestito lo spam e come sono utilizzate le RBL si vedano:

• Anti-spam agent logging
• Exchange Server: How to Diagnose Spam Problem
• Exchange Server 2007: How are RBLs performing?

Di seguito un esempio di utilizzo dello script:

Cd $env:ExchangeInstallPath\Scripts
.\Get-AntispamTopRBLProviders.ps1

.\Get-AntispamTopRBLProviders.ps1 -startDate 04/26/2018

Update 02:

Un modo per individuare quali RBL sono le più adatte è quello di iniziare con un elenco base che potrebbe essere quello suggerito in questo post, ma successivamente modificarlo ad esempio in base allo spam che si continua ricevere.

Un metodo può essere quello di agire a ritroso ovvero a fronte di una mail di spam ricevuta ricercare il mail server o l’IP da cui è stata generata e quindi valutare se vi sono delle RBL che riconoscono tale mail server / IP come fonte di mail non desiderata o pericolosa, per eseguire tale analisi è possibile avvalersi strumenti online quali:

• MXToolbox – Blacklists
• The Anti-Abuse Project – Multi-RBL Check

Una seconda attività che è necessario eseguire è quello di monitorare sul proprio sistema quali sono le RBL che filtrano effettivamente le mail e cessare l’utilizzo delle RBL che non eseguono blocco di mail per ridurre il traffico di controllo quando si ricevono mail.

Un altro utile strumento disponibile online è Intra2net Blacklist Monitor che fornisce una statistica delle RBL in termini di accuratezza e inaccuratezza.

Update 03:

Di seguito a titolo di esempio le statistiche di utilizzo delle RBL su una infrastruttura di esempio nel periodo 26/04/2018 – 09/05/2018 ricavate con lo script Get-AntispamTopRBLProviders.ps1, ovviamente i dati sono puramente indicativi nel senso se la statistica fosse fatta in altri periodi o su altre infrastrutture potrebbe succedere che le RBL che intercettano più mail non desiderate siano altre sia per come è implementa ciascuna RBL sia per come è aggiornata:

Update 04:

Per verificare se un indirizzo mail o un dominio è stato bloccato da una RBL è possibile utilizzare i seguenti comandi:

Get-AgentLog -StartDate “07/01/2018” -EndDate “07/02/2018” | where {$_.P1FromAddress -eq “name@domain.ext”}

Get-AgentLog -StartDate “07/01/2018” -EndDate “07/02/2018” | where {$_.P1FromAddress.endswith(“@domain.ext”)}

Get-AgentLog -StartDate “06/27/2018” -EndDate “06/28/2018” | where {$_.P1FromAddress.endswith(“@domain.ext”)} | Select Timestamp, P1FromAddress, Reasondata, IPAddress

Per verificare se una RBL blocca uno specifico indirizzo IP è possibile usare il seguente comando:

Test-IPBlockListProvider dnsbl.zapbl.net -IPAddress xxx.xxx.xxx.xxx

Update 05:

Per verificare se le RBL hanno bloccato mail verso un indirizzo è possibile utilizzare i seguenti comandi:

Get-AgentLog -StartDate “07/01/2018” -EndDate “07/02/2018” | where {$_.Recipients -like “name@domain.int”}

Get-AgentLog -StartDate “07/01/2018” -EndDate “07/02/2018” | where {$_.Recipients -like “name@domain.int”} | Select Timestamp, P1FromAddress, Reasondata, IPAddress

Update 06:

Zen Spamhaus potrebbe non funzionare se il server Exchange non è in grado di risolvere una query DNS inversa per il dominio zen.spamhaus.org ad esempio 2.0.0.127.zen.spamhaus.org come indicato nel post Exchange 2013, 2016 – Zen Spamhaus RBL not working:

“The problem here is that our internal DNS server is using a DNS forwarder that cannot resolve the names we require. The way it needs to work is that when your Exchange server receives a connection from an IP which is submitting an email, it does a DNS forward lookup on <the IP in reverse>.zen.spamhaus.org.

 

To demonstrate a failed DNS lookup for Zen SpamHaus, we can do a lookup for 2.0.0.127.zen.spamhaus.org (127.0.0.2 in reverse) on Google’s DNS servers like below:

nslookup

server 8.8.8.8
2.0.0.127.zen.spamhaus.org

 

As you can see above, this fails: Non-existent domain

 

If we change the DNS server to use one of the domain controllers (192.168.0.8) that is configured to use the root hints and no forwarders then this works:

nslookup
server 192.168.0.8
2.0.0.127.zen.spamhaus.org”

Dopo aver verificato che Exchange sia in grado di eseguire query DNS inverse per il dominio zen.spamhaus.org è possibile testare se l’RBL configurata per Zen Spamhaus funziona testandone l’utilizzo con un IP in black tramite il seguente comando Powereshell:

Test-IPBlockListProvider -IPAddress x.y.w.z Spamhaus

Si noti che in Exchange la risoluzione DNS può anche essere specificata in Configurazione Sever / Trasporto Hub / Tab Ricerche DNS Esterne dove è possibile specificare se utilizzare le impostazioni del sistema o server DNS specifici.

L’impossibilità di utilizzare alcuni “open DNS resolver” come Google Public DNS e altri da parte è anche evidenziata nella FAQ Your DNSBL blocks nothing at all!:

“Check what DNS resolvers you are using: If you are using a free “open DNS resolver” service such as the Google Public DNS (8.8.8.8) and others (eg. Alternate DNS, Comodo Secure, DNS.Watch, DynDNS, FreeDNS, Hurricane, NeuStar DNS Advantage, Norton ConnectSafe, OpenNIC, Puncat, Quad9, SafeDNS, Uncensored, Verisign, Yandex.DNS), or large cloud/outsourced public DNS servers, such as Level3’s, Verizon’s or AT&T’s to resolve your DNSBL requests, in most cases you will receive a “not listed” (NXDOMAIN) reply from Spamhaus’ public DNSBL servers. We recommend using your own DNS servers when doing DNSBL queries to Spamhaus. If this is not possible, contact us for other options.”